This Data Processing Addendum ("DPA") is part of the Agreement between Flourish Public Benefit LLC ("Flourish") and the Customer named in an Order Form or account. It applies to every customer that accepts our Terms of Service, and to any customer whose signed agreement incorporates it, whenever Flourish processes Customer Personal Data in providing the Services, and it needs no separate signature. Words defined in the Terms mean the same here. Where this DPA and the Terms conflict about personal information, this DPA comes first. For the products it covers, a signed agreement that addresses data protection, such as the Data Protection section of the Flourish Customer Agreement, comes before both.
1. Definitions
- "Customer Personal Data" means personal information in Customer Data that Flourish processes on Customer's behalf.
- "Data Protection Laws" means the laws that apply to that processing, which may include the California Consumer Privacy Act, the Texas Data Privacy and Security Act and other United States state privacy laws, and, where they apply, the EU General Data Protection Regulation ("GDPR") and the United Kingdom's version of it.
- "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
- "Subprocessor" means a third party that Flourish engages to process Customer Personal Data.
- "Controller", "processor", "business", "service provider", "data subject" and "processing" have the meanings Data Protection Laws give them.
2. Roles
For Customer Personal Data, Customer is the controller (or business), and Flourish is its processor (or service provider). Where Customer itself processes the data for another controller, such as a partner organization, Flourish is Customer's subprocessor, and Customer is responsible for having that controller's authorization. Flourish is a controller only of the personal information it processes for its own purposes, such as Users' account and billing details, security records and Usage Data, which its Privacy Policy covers.
3. Processing on Customer's instructions
Flourish processes Customer Personal Data only on Customer's documented instructions. The Agreement, Customer's configuration of the Services, and its Users' use of them, including the instructions they give Agents, are those instructions. Flourish will tell Customer if it believes an instruction violates Data Protection Laws, and may decline to follow it. Annex 1 describes the processing.
Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it provides, including giving the notices and obtaining the consents that Data Protection Laws require.
4. United States privacy laws
Where United States state privacy laws apply, Flourish acts as Customer's service provider or processor and will not: sell or share Customer Personal Data, as those laws define those terms; retain, use or disclose it for any purpose other than providing the Services, or outside its direct business relationship with Customer; or combine it with personal information Flourish receives from others, except as those laws allow. Flourish will comply with the obligations those laws place on it, give the same level of privacy protection they require, and tell Customer if it can no longer meet them. Customer may take reasonable steps to stop and remedy any unauthorized use of Customer Personal Data.
5. Confidentiality and security
Flourish ensures that everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality. Flourish maintains the technical and organizational measures in Annex 2, appropriate to the risk of the processing, and may update them as long as it does not materially reduce the overall protection they give.
6. Subprocessors
Customer authorizes Flourish to engage Subprocessors, including cloud infrastructure providers, AI model providers, and providers of content delivery, communication, support and data services. Flourish holds each to data protection terms appropriate to its service and remains responsible for its Subprocessors' performance under this DPA. Flourish uses commercially reasonable efforts to engage only Subprocessors whose terms do not permit them to train or fine-tune models on customer data, configures its use of them to prevent it where they offer that option, and never authorizes it itself. On Customer's written request, Flourish will tell Customer which Subprocessors it then uses for Customer Personal Data, and the relevant terms on which they process it.
A service a User connects, such as their Google, Microsoft or Salesforce account, and an AI provider account Customer brings, are not Subprocessors. They are Customer's or the User's own services, which they direct Flourish to use, under their own agreements with their providers.
7. Requests from individuals
Taking into account the nature of the processing, Flourish will help Customer respond to requests from individuals exercising their rights under Data Protection Laws, through the Services' features or as Customer reasonably asks. If Flourish receives such a request directly, it will refer the person to Customer and will not respond itself except to do so, unless the law requires it.
8. Personal Data Breaches
Flourish will notify Customer without undue delay after confirming a Personal Data Breach. The notice will describe the breach, the data and individuals affected, its likely consequences and the steps taken to address it, as far as Flourish knows them, with more detail as it becomes available. Flourish will take reasonable steps to contain and remedy the breach and will help Customer meet its own obligations to notify regulators and individuals. Notifying Customer is not an admission of fault.
9. Assessments
Flourish will give Customer the information about the Services reasonably needed for data protection impact assessments and consultations with regulators that Data Protection Laws require of Customer.
10. Return and deletion
For 60 days after the Agreement or a subscription ends, Customer may ask Flourish to make the affected Customer Personal Data available for export in a commonly used machine-readable format. Flourish then deletes it, including extracts, cached data, prompts, embeddings and logs that contain it, within a reasonable period, unless the law requires Flourish to keep some, and certifies the deletion in writing if Customer asks. Copies in routine backups are deleted as those backups expire in the ordinary course, and this DPA continues to protect them until then.
11. Information and audits
On Customer's reasonable written request, made no more than once in any 12 months except for good cause, Flourish will provide the documentation reasonably needed to show that it meets this DPA, including about where data is stored, access controls, retention and deletion. Where a Data Protection Law gives Customer a right to audit that this documentation does not satisfy, Flourish will cooperate with an audit as that law requires, on reasonable notice, at Customer's expense, under a duty of confidentiality, and in a way that does not disrupt the Services or put other customers' data at risk.
12. Where data is processed
Flourish currently hosts the Services in the United States, and Subprocessors may process Customer Personal Data in other countries. If Customer's Order Form requires that Customer Data be stored and processed in the United States, Flourish will do so, apart from data in transit over networks neither party controls. If the GDPR or the United Kingdom's version of it applies to a transfer of Customer Personal Data to Flourish, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (Module Two, or Module Three where Customer is a processor), and for the United Kingdom the International Data Transfer Addendum to them, are incorporated into this DPA, with Annexes 1 and 2 supplying their annexes. In those clauses, the optional docking clause does not apply, Clause 9 follows option 2, and Flourish will tell Customer of intended additions or replacements of Subprocessors at least 30 days in advance, the optional language in Clause 11 does not apply, and Clauses 17 and 18 name Ireland.
13. Health information
This DPA does not make Flourish a business associate under HIPAA. If Customer will put protected health information into the Services, the parties must first sign a business associate agreement, and Flourish then processes that information on its HIPAA-eligible infrastructure.
14. Liability
Each party's liability under this DPA is subject to the limitations of liability in the Terms.
Annex 1: Description of the processing
- Subject matter and duration: providing the Services under the Agreement, for its term and until Customer Personal Data is deleted as Section 10 describes.
- Nature and purpose: hosting, storing, organizing, analyzing, matching, transmitting and otherwise processing Customer Personal Data to provide the Services, including AI agents that read and act on it at Users' direction, connections to services Users choose, support, and keeping the Services secure.
- Data subjects: Customer's Users; and people whose information Customer brings into the Services or directs the Services to reach, such as its clients, members, participants, donors, volunteers, applicants, constituents and contacts, and people named in documents, messages and records in Connected Accounts.
- Categories of data: names and contact details; organization, role and relationship details; account identifiers and the authorizations for Connected Accounts; the contents of records, documents, files and messages that Customer provides or directs the Services to reach; Input and Output; and records of use of the Services.
- Sensitive data: only what Customer chooses to provide, subject to the Terms (Section 7.4). It may include government identifiers, dates of birth, health, demographic or financial information present in Customer's records.
- Frequency: continuous, for as long as Customer uses the Services.
Annex 2: Technical and organizational measures
- Hosting: the Services run on Amazon Web Services, and Flourish maintains HIPAA-eligible infrastructure for protected health information under a business associate agreement.
- Encryption: data is encrypted in transit with TLS and at rest. The authorizations and keys for Connected Accounts are each sealed under a key of their own, issued by a key management service whose master key only the parts of the Services that hold connections may use, and every use of it is logged.
- Least privilege: each part of the Services holds only the permissions it needs. Services that act in a Connected Account receive a short-lived access token, never the lasting authorization, and each issue is logged with who asked for it.
- Separation of customers: every request passes the Services' permission checks, which keep each customer's data apart from every other's, and agents' files are stored separately for each organization.
- Access by staff: limited to personnel whose work requires it, through individual accounts.
- Logging and monitoring: requests to the Services and administrative actions are logged, alarms watch for errors and unusual spending, and the agent platform's logs record the length of messages, not their text.
- Resilience: managed databases with automated backups, and infrastructure defined in code so it can be rebuilt.
- AI providers: chosen and configured as Section 6 describes, so that, wherever a provider allows it, customer data is not used to train its models.
- Incident response: suspected Personal Data Breaches are investigated and handled as Section 8 describes.