Data Processing Agreement

Last updated: August 16, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Use between Fluxnoma and the customer ("you"). It governs the processing of personal data that Fluxnoma carries out on your behalf when you use the service. Where you are subject to the GDPR, UK GDPR, or similar laws, this DPA applies to that processing.

1. Roles

For prospect and campaign data in your workspace, you act as the controller and Fluxnoma acts as your processor. For account and billing data about your own users, Fluxnoma acts as an independent controller as described in the Privacy Policy. Fluxnoma processes personal data only on your documented instructions, which include the service configuration you choose.

2. Subject matter and duration

The subject matter is the operation of the Fluxnoma service. Processing continues for as long as your workspace is active and for the limited retention periods described in the Privacy Policy, after which data is deleted or returned.

3. Nature and purpose

Fluxnoma processes personal data to source prospects, detect buying signals, enrich and verify contact data, sequence and send outreach, handle replies, score leads, generate content, and provide analytics and support.

4. Categories of data and data subjects

Personal data may include business-contact details (name, job title, employer, business email, business phone), professional and engagement signals from public sources, and reply content. Data subjects are the prospects, contacts, and recipients that your campaigns target. You must not use the service to process special categories of personal data.

5. Our obligations

Fluxnoma will: process personal data only on your instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organizational security measures; assist you, taking into account the nature of processing, with data subject requests and with your security, breach-notification, and impact-assessment duties; and make available the information needed to demonstrate compliance.

6. Subprocessors

You authorize Fluxnoma to engage the subprocessors listed on our Subprocessors page to provide the service. We impose data-protection terms on each subprocessor no less protective than this DPA, and we remain responsible for their performance. We will give notice of intended changes and you may object on reasonable data-protection grounds.

7. International transfers

Where personal data is transferred across borders, Fluxnoma relies on an appropriate transfer mechanism, such as the Standard Contractual Clauses or an adequacy decision, and applies supplementary measures where needed.

8. Personal data breach

Fluxnoma will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.

9. Data subject requests

Fluxnoma will, to the extent legally permitted, promptly inform you of requests it receives from data subjects and will help you respond using the tools the service provides. Prospects may contact privacy@fluxnoma.io to have their business-contact data removed.

10. Deletion and return

On the end of the service, or on your written request, Fluxnoma will delete or return the personal data it processes for you and delete existing copies, unless the law requires storage.

11. Audits

Fluxnoma will make available information reasonably necessary to demonstrate compliance and will allow for and contribute to audits, subject to reasonable confidentiality, scope, and frequency limits.

12. Governing terms

This DPA is subject to the Terms of Use, including their limitations of liability. If there is a conflict on data-protection matters, this DPA controls. To request a countersigned copy, write to legal@fluxnoma.io.