GDPR
Our role under GDPR
ModaFlow occupies a dual role — as a data processor, we process Tenant Data (your customers', employees', and vendors' personal data) on your instructions, for the purpose of providing the Platform. As a data controller, we control the personal data of our own subscribers — the account and billing information you give us directly when you sign up.
Data Processing Agreement (DPA)
Where ModaFlow processes personal data on your behalf as a processor, a Data Processing Agreement is required under GDPR. By accepting our Terms of Service →, you enter into a DPA with ModaFlow, incorporated into and forming part of those Terms. The DPA covers: the subject matter and duration of processing; the nature and purpose of processing; the types of personal data and categories of data subjects involved; our obligations and rights as processor; sub-processor arrangements and notification obligations; assistance with data subject rights requests; security measures; deletion or return of data on termination. If your organization requires a separately executed DPA document, contact support@modaflow.net.
Data subject rights
Individuals whose data you hold in ModaFlow have rights including access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and rights related to automated decision-making. As the data controller for your own customers, employees, and vendors, you are responsible for responding to their data subject rights requests. ModaFlow provides the tools within the Platform to access, correct, export, or delete data to help you fulfil these requests. For requests relating to data ModaFlow holds about you as a subscriber, contact support@modaflow.net. We will respond within one month.
Sub-processors
ModaFlow uses a limited number of sub-processors to deliver the Platform, including cloud hosting providers, payment processors, email service providers, and email delivery providers. All sub-processors are bound by data processing agreements and provide appropriate safeguards. Material changes to sub-processors will be communicated to Tenants in advance, giving you the opportunity to object. Contact support@modaflow.net for the current sub-processor list.
International data transfers
Where sub-processors process data outside the EU/EEA/UK, we rely on appropriate transfer mechanisms, including EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs), to ensure an equivalent level of protection.
Legal basis for processing
See Section 4 of the Privacy Policy → for the lawful bases relevant to processing on the Platform.
Contact
support@modaflow.net · Moda Flow LLC, 2769 Golfside Rd, Ypsilanti, Michigan 48197, USA