Legal
Data Processing Addendum
Last updated: Draft — October 20, 2026
Working draft for legal review. This text is not approved for publication. Complete every verification item and obtain counsel review before release.
Scope and roles
This working addendum applies when Flotick processes personal data on behalf of a customer organization. The customer’s instructions, processing subject matter, duration, nature, purpose, data types, and data-subject categories must be incorporated into the executed agreement: Pending confirmation in the legal review register.
Processing and security
Flotick processes workspace data to provide the service and applies implemented access controls and encryption to supported data flows. Security details and exceptions must be confirmed against production configuration: Pending confirmation in the legal review register.
Subprocessors and assistance
Potential providers are listed in the subprocessor register; actual engagement, notice, objection, and transfer mechanisms require verification. Assistance for rights requests, incidents, impact assessments, and deletion must follow the final contract and applicable law: Pending confirmation in the legal review register.
Deletion and audit
Organization deletion includes approval and a 30-day grace period; this does not state the retention of every copy or backup. Return/deletion at contract end and audit evidence require approved contractual language: Pending confirmation in the legal review register.