General Terms & Conditions

The General Terms and Conditions are valid from 1 December 2024.

1.      Terms of Service Privision

1.1. These Terms of Service (hereinafter referred to as the "Terms") constitute an agreement between you (hereinafter referred to as "you" or "Customer") and wflow.com Czech Republic s.r.o., ID: 072 12 241, registered office at Pobřežní 658/34, Karlín, 186 00 Prague 8, registered in the Commercial Register maintained by the Municipal Court in Prague, file number C 295488 (hereinafter referred to as "wflow" or "we"). wflow is an online platform providing its users ("Customers") with secure transfer and circulation of accounting documents and their reliable and secure archiving. To use our website wflow.com (hereinafter referred to as the "Website") and all associated websites, including mobile websites and applications that we, our predecessors or successors, or our affiliates own and operate (collectively, the "Platform"), as well as to use all services, applications, software, functions, and products accessible via the Platform and referencing this Agreement, whether provided by us or our affiliates (collectively, the "Services"), you must read, agree to, acknowledge, and accept these Terms. Your agreement with us also includes the Privacy Policy available at https://wflow-old.solidpixels.com/gdpr and the Cookie Policy available at https://wflow.com/cs/cookies.

1.2. By signing, otherwise confirming a Price Offer, or clicking on the agreement button for the Terms when given the option, you enter into a service agreement with wflow (hereinafter also referred to as the "Agreement"), which includes the Terms. By using our Services, you confirm that you have read, understood, and agree with these Terms. If you do not understand, accept, or agree with these Terms, you are not authorized to use the Services.

1.3. wflow reserves the right to modify, amend, add, or remove parts of these Terms at any time within reasonable limits, particularly in the event of changes in legal regulations or agreements with its suppliers. You will be notified of changes via email or notification within the Platform. Changes take effect on the specified date, which will be at least 30 days from the date of the notification, and apply to all subsequent use of the Service.

1.4. If you do not agree with a change, you may terminate the Agreement with a one-month notice period beginning on the first day of the calendar month following delivery of written notice, with notice provided to wflow prior to the effective date of the change. In the case of termination under this provision, the currently valid Terms apply for the duration of the notice period. Your continued use of the Services after the effective date of the changes signifies your acceptance of and agreement with these changes.

2. Customer Account

2.1. When creating an account, you must provide accurate information in good faith and commit to keeping it updated in case of changes. By creating an account on behalf of a company, you warrant that you have the necessary authority to bind this company to these Terms (hereinafter referred to as the "Account").

Your name;
Company email address;
Company name;
Phone number;
Password.

2.3. You are responsible for the security of your Account and all activities conducted under it while someone is logged in. If you believe your Account has been compromised, please contact us immediately at support@wflow.com.

3. Customers

3.1. You as the Customer or any end-user to whom you grant access to your Account are authorized to use the Services listed in the Price Offer, further specified in Art. 8 of these Terms (hereinafter referred to as "Users").

3.2. When creating an Account, you will need to set your login credentials. If we create the Account for you, we will send you an invitation, upon which you will be prompted to create your login credentials.

3.3. You may update the list of Users by emailing us at: sales@wflow.com.

4. Account Deletion and Suspension

4.1. If you wish to permanently delete your Account, please contact us via email at support@wflow.com.

4.2. We may delete or suspend your Account at our discretion at any time.

4.3. These Terms remain in effect even if you no longer have an Account with us.

5. Scope of Services

5.1. The services that wflow may provide include, among other things, uploading accounting documents, data extraction, integration with other systems, invoice approval, and document storage. The full scope of services is listed on our Website.

5.2. wflow reserves the right to update, change, or discontinue certain features of the provided Services at its discretion. If wflow removes a feature without replacement, and such a change substantially affects the provided Services, we will attempt to notify you in advance where possible. In such a case, you may terminate the Agreement with a one-month notice period beginning on the first day of the calendar month following delivery of written notice, with notice provided to wflow within one month from the change.

5.3. wflow commits to providing the Customer with a hot-line service (help-desk) from Monday to Friday, 9:00 AM to 5:00 PM, excluding public holidays in the Czech Republic, via support@wflow.com or through the INTERCOM platform integrated on the Website.

5.4. The subscription period begins on the date specified in the agreement, or if not specified, on the day the Customer takes over the Service. The Customer is obligated to accept the activated Service, with or without reservations. Acceptance occurs upon the following conditions:

5.4.1. Confirmation by the Customer that the Service has been activated correctly, or
5.4.2. The expiration of 3 working days from the completion of admin training (or if the Customer indicates no interest in admin training, the expiration of 3 working days from the notification of completed implementation, which wflow may send to the Customer via email), if the Customer does not raise any objections preventing the use of wflow within this period.

5.5. Any objections regarding the activation of the Service may be raised by the Customer in writing via email sent to sales@wflow.com. If the Customer does not send objections within the specified period and to the specified address, the activation of the Service is accepted without reservation, and the Customer is obligated to start paying for the use of the Service.

6. Obligations Regarding User Content under EU Regulation

6.1. You are responsible for all activity on your Account. You may use your Account in a way that is reasonable, customary, and does not misuse the rights or legitimate interests of wflow or third parties. For example, you may not upload documents that are illegal or irrelevant, nor misuse API endpoints by sending unnecessary requests. The Account is associated with you and may not be used by, sold to, or transferred to another entity. Violation of this paragraph is considered a material breach of this Agreement.

6.2. If we discover content on your Account that violates these Terms, we may, at our discretion, remove such content or suspend your access to the Services and your User Account for a reasonable period after issuing prior notice. If a notifier, which could be you or another User (hereinafter also referred to as the "Notifier"), frequently submits obviously unfounded reports, wflow may, after issuing prior notice, suspend the processing of such reports. In making these decisions, wflow will consider the number of items of clearly illegal content or clearly baseless notifications submitted within a certain period, their proportion to the total amount of information or notifications, the severity of misuse, the nature of illegal content, the consequences of such misuse, and the intent of the service recipient, person, entity, or complainant, if it can be inferred.

6.3. wflow accepts all notifications containing information on the occurrence of user content (particularly photos, videos, review texts) within the Platform that the Notifier (e.g., User) deems illegal. The Notifier may send a notification to wflow at support@wflow.com. The notification may include at least the following information:

6.3.1. A sufficiently substantiated explanation of the reasons why the notifier claims the content in question is illegal,  
6.3.2. A clear indication of the precise electronic location of the content, such as an exact URL address, and, if necessary, additional information allowing identification of the illegal content depending on its type,  
6.3.3. The name or business name of the reporting person and their email address, unless you report content that you believe constitutes a criminal offense referred to in Articles 3 to 7 of Directive 2011/93/EU,  
6.3.4. A statement confirming that the person or entity submitting the report believes in good faith that the information and claims contained in the notification are accurate and complete.

6.4. If the notification contains the electronic contact details of the reporting person, wflow will promptly send the Notifier a confirmation of receipt of the notification. They will also be informed of the decision regarding the information in the notification without undue delay and provided information on available remedial options related to this decision. If wflow becomes aware of illegal activities, illegal content, or content incompatible with the Terms, it may take measures to remove it or block access to it. Alternatively, wflow may impose restrictions on the User, such as assigning a lower search ranking for the content, suspending, terminating, or restricting financial payments, suspending or terminating the Service for that User, or suspending or canceling the User Account. In such cases, wflow will provide all affected Users with clear and specific reasons for such restrictions. However, if the content is assessed as compliant with legal regulations and the Terms, wflow may also decide not to act against it.

7. Order, Price Quote, and Price

7.1. The Prices listed on our website are illustrative and are not binding on wflow.

7.2. You may order Services by completing a form or requesting a phone call on our Website, or you may contact us by email at sales@wflow.com (hereinafter the "Order"). After submitting the Order, we will send you a Price Quote (the "Price Quote"), together with a contract proposal upon your request. The Price Quote will include the ordered Services and will be valid for a specified period. If you wish to accept the Price Quote, return it signed or confirm it otherwise within the specified period. The accepted Price Quote forms part of the Agreement and is governed by these Terms.

7.3. The total price you are obligated to pay to wflow depends on the total number of active users, organizations, the number of processed documents, and other units within the subscription period and is governed by the Price Quote (the "Price").

7.4. If you wish to change the number of active users/organizations, you may do so in your account or contact us by email at support@wflow.com. Rules for changes in users/organizations are listed in the current price list available at https://wflow-old.solidpixels.com/en/pricing, and these rules are binding.

7.5. All prices are listed without VAT, and VAT will always be added to the Price in accordance with applicable legislation.

7.6. Wflow may, at its discretion, change prices, introduce new fees, or increase prices. Any changes will be communicated to you by email or via notification in the Platform and will become effective at the beginning of the next subscription period. Section 1.4 of the Terms applies accordingly, with any termination notice to be provided to wflow before the start date of the next subscription period. An exception applies when you increase the number of users or other metrics, in which case the new prices apply to all users and other metrics purchased after the price change announcement from the moment of purchase, not from the next subscription period.

7.7. In addition to the previous provisions, the Price will automatically increase each year on March 1 or another date determined by wflow by the inflation rate expressed as the increase in the average annual consumer price index for the past calendar year announced by the Czech Statistical Office. If the Czech Statistical Office ceases to announce this figure, the index that replaces it or most closely resembles it will be used. The increase will be rounded up to the nearest whole ten Czech crowns. The increase will only apply if the inflation rate exceeds 5% since the last price increase under this paragraph.

8. Payments

8.1. The Price may include a certain number of processed documents/timestamps/organizations/users/storage space/other units for the subscription period. You are obligated to pay the subscription even if you do not use all units. In such cases, unused units expire without compensation. If the Agreement is terminated, the price for unused units is not refunded.

8.2. If you exceed the agreed number of units in any period, you will pay an excess usage fee. Excess usage fees are payable together with the next invoice; however, wflow may bill them separately at any time.

8.3. The Agreement includes an arrangement for the selected subscription period. Unless expressly agreed otherwise, the subscription is due in advance based on an invoice issued before or at the beginning of each subscription period for Services provided in that period.

8.4. If you are in arrears with payment of any due amount, wflow may charge you a contractual penalty of 0.05% of the due amount for each commenced day of delay.

9. Security

9.1. Any database consisting of data entered by the Customer while using the provided Services is the Customer’s property, and the Customer is responsible for its content (the "Data"). The Platform's purpose is solely to facilitate the Customer's use of the Data, and wflow is not liable for any damages resulting from any breach of the Data's security or integrity by the Customer.

9.2. wflow will make reasonable efforts to secure the Data against loss, disruption, or unauthorized access in accordance with standard practice. Data security is implemented at the Platform level using standard protection measures (e.g., server communication is encrypted with an SSL security certificate, application login is via the OAuth 2.0 protocol, data on servers is encrypted with the AES 256-bit algorithm). The Platform is hosted with a leading B2B infrastructure service provider, and we take necessary measures to minimize the risk of any breach of Data security or integrity.

9.3. Since the Platform is a cloud tool designed, among other things, for data processing, wflow may process personal data of third parties uploaded or collected by the Customer on the Platform ("Personal Data") as a processor for the Customer while fulfilling the Agreement. This processing is governed by the data processing agreement, the content of which forms Annex No. 1 to these Terms, becoming an integral part of the Agreement. You are responsible for ensuring that you are authorized to transfer all your data to wflow and that using and processing it for providing the Service does not infringe upon the rights of third parties, especially intellectual property rights, privacy rights, or legal obligations. You must inform individuals whose personal or other data you transfer to wflow for the purpose of providing the Service about such a transfer to wflow as the processor or, if necessary, obtain consent to such transfer of personal data.

10. Intellectual Property

10.1. wflow has invested considerable effort and resources in developing its intellectual property, including the Platform, Services, and any other software, features, functions, designs, copyrights of any kind, information, or other materials made available to you ("Intellectual Property"). wflow hereby grants you the right to use the Intellectual Property for the purpose of using the Services and/or the Platform "as is" on a non-exclusive basis, with no other warranties than those stated in these Terms, for the duration of the Services provision. You also acknowledge and agree that all Intellectual Property remains the exclusive property of wflow and its suppliers and that you do not acquire any other rights except those expressly granted by these Terms unless wflow gives prior written consent. wflow reserves the right to remove Customer access to any Intellectual Property upon termination of Service provision.

10.2. You also agree not to attempt reverse engineering or any other access

to the source code of any Intellectual Property. Regardless of this restriction, you may not circumvent technical protections or other limitations associated with the Platform or Services, except where expressly permitted by applicable law. You may not use Intellectual Property to create any software similar to the Services. You may not bypass any technological protection measures in the Services and/or Platform or related protective measures, nor may you allow access to the Services by unauthorized third-party applications.

10.3. If you provide us with feedback on the Services, such as recommendations for improvements or features, such feedback will not be considered confidential or proprietary, and the implementation of such feedback will be the property of wflow and may become part of our Intellectual Property without compensation to you.

10.4. Each party to this Agreement has the right to use the other party’s logo and name on their websites and in their marketing materials, granting a revocable license to that extent to the other party.

11. Confidential Information

11.1. Both wflow and the Customer agree that all financial, business, and technical information (e.g., business and marketing plans and strategies, business relationships, supplier and customer information, source codes, and trade secrets), including any information disclosed by wflow or the Customer or on their behalf in connection with the provision of the Services, which is of a nature that should reasonably be considered confidential and sensitive, constitutes "Confidential Information" of each party. Confidential Information of wflow includes the pricing terms of the Agreement. Confidential Information does not include data related to the use of the Service, including statistical and performance information relating to the operation of the Service, which we use in an anonymized form. By concluding the Agreement, or at the moment of creating such data, you assign to us rights to the data as described in the preceding sentence.

11.2. Wflow and the Customer declare and guarantee that they will keep the Confidential Information secret and take all reasonable measures to prevent unauthorized access to it and that they will not disclose or use it except to fulfill their obligations and exercise their rights under this Agreement.

11.3. The obligations above do not apply to Confidential Information that is (a) already demonstrably known to the recipients without any restrictions; (b) demonstrably and legitimately provided to the recipients by a third party without any restriction; (c) generally available to the public without violation of these Terms; (d) independently developed by them without reference to or use of the Confidential Information of the discloser; or (e) used or disclosed with the express consent of the discloser.

11.4. If the recipient is required to disclose Confidential Information due to a judicial or administrative proceeding or order, they are obligated to provide the other party with sufficient notice and reasonable assistance as soon as possible, prior to any such disclosure, to enable the other party to contest such a requirement or order, should they wish to do so.

11.5. The obligations under this article remain in effect even after the termination of this Agreement for a period of three (3) years.

12. Third-Party Applications

12.1. For logging into the user account and using additional functions, you may grant wflow access to your third-party accounts, such as Google. You may cancel wflow's access to these accounts at any time through the security settings page of the respective third party.

12.2. To the extent that any services, tools, or content provided by third parties (hereinafter the "Third Parties") can be accessed through the Platform, the terms of the Third Parties apply, and by using the Platform, you explicitly declare that you agree to their terms. For instance, Rossum or Dativery applications are integrated into the Platform, and their terms of use can be found at https://drive.google.com/file/d/1Lr4WbcK216CGk_r9mjyNLWkSVV42udbM/view and https://www.dativery.com/cs/spolecnost/terms/, respectively. Other Third Parties are listed on the Website.

12.3. Wflow has no control over the operation of Third Parties. Therefore, you acknowledge and agree that wflow is not responsible for any damage caused by the use of or reliance on content or services of Third Parties. If there is an issue with the Third Parties, you may assert your rights under the terms of these Third Parties.

13. Limitation of Liability

13.1. Wflow is not liable for lost profits resulting from outages or other issues with the Services. The total liability of wflow arising from this Agreement or related thereto is limited to an amount equal to the Price you paid for using the Services during the four (4) months immediately preceding the date of the event that led to the claim, up to a maximum amount of CZK 50,000. The existence of more than one claim does not increase this limit. You explicitly waive the right to compensation for damages exceeding this amount.

13.2. To avoid any doubt, we are not responsible for the legal archiving of data, and we strongly recommend that you regularly back up all Data contained in your Account.

13.2. For the purposes of this article, the terms “we” and “our” (and other uses of the first-person plural) are defined to include our subsidiaries, affiliates, officers, directors, employees, agents, consultants, and third-party service providers.

14. Disclaimer

14.1. We reserve the right to make changes and updates to any information contained on our Platform without prior notice. We strive to accurately describe each Service offered on the Platform. However, we do not guarantee that the specifications of the Services, Prices, or other content provided on our Platform are complete, accurate, reliable, up-to-date, or error-free, and we disclaim any liability to the maximum extent permitted by law.

14.2. Unless explicitly agreed otherwise, the Platform and the Services thereon are provided "as is" and "as available" without any warranties. Any warranties of merchantability, fitness for a particular purpose, non-infringement, or any other warranty are excluded to the maximum extent permitted by applicable law. If we agree to provide a warranty for the Services, such a warranty does not apply to issues arising from or related to events beyond the control of wflow.

14.3. The disclaimers in this article also apply to our subsidiaries, affiliates, and third-party service providers.

15. Indemnification

15.1. To the extent permitted by applicable law, you agree to indemnify us for any losses and liabilities, including legal representation fees, arising from these Terms or related to your use of our Services and/or Platform. We reserve the exclusive right to enforce and defend any claims covered by this article. If we choose to exercise this right, you agree to provide us with all necessary cooperation.

15.2. Your obligation to indemnify us under this article also applies to our subsidiaries, affiliates, officers, directors, employees, other agents, and third-party service providers.

16. Notices

16.1. A notice or other communication is considered duly given and effective if:

16.1.1. it was sent to the other party's email address; you agree that we may send you notices to the email address provided when creating your User Account, for receiving the newsletter, or any other email address through which you communicate with us; or  
16.1.2. the other party obstructed or refused delivery.

16.2. If more than one day can be considered the date of delivery under the rules above, the earlier date shall be the effective date of delivery.

17. Term and Termination of the Agreement

17.1. For annual and multi-year subscriptions:

17.1.1. These subscriptions are offered at a discounted price; by choosing an annual or multi-year subscription, you agree that, due to the discounted price, you may not terminate the Agreement earlier than the end of the subscription period, and the payment is non-refundable.  
17.1.2. The subscription period is automatically renewed for an additional subscription period of the same length, repeatedly. Renewal will not occur if either party notifies the other party in writing (including by email) of its intent to terminate the Agreement by the last day of the current subscription period. In that case, we will terminate the Service on the last day of the subscription period.

17.2. For monthly subscriptions:

17.2.1. The subscription period is automatically renewed for an additional subscription period of the same length, repeatedly. Either party may terminate the Agreement without cause; the termination notice must be sent in writing (including by email) to the other party. The notice period is 3 months and begins on the first day of the subscription period (month) following delivery of the notice to the other party. You are obligated to pay the Price to wflow for the entire notice period, and wflow is obligated to provide the Services.  
17.2.2. The minimum Service usage period is 3 months. Due to the initial investment associated with implementation, we cannot offer a shorter period.

17.3. Unless otherwise specified in the Agreement, you have chosen a monthly subscription period.

17.4. Either party may also withdraw from the Agreement if the other party materially breaches the Agreement and cannot remedy it, or if it can be remedied but remains uncorrected 30 days after receiving written notice of such breach.

17.5. In addition to other instances arising from the Agreement or applicable law, wflow may suspend or terminate your or any User's access to the Service with immediate effect, without incurring any obligations or liabilities, if:

17.5.1. wflow receives a court or government authority order requiring it to do so, or if a governmental body or other authority with lawful power introduces new, or amends existing, laws, rules, regulations, interpretations, or decisions making wflow's performance of any part of the Agreement illegal or otherwise unlawful;
17.5.2. you fail to comply with the Agreement, violate laws, use the Service beyond the granted rights or for a purpose not permitted by the Agreement, or engage in fraudulent or illegal activities;  
17.5.3. you become insolvent or face impending insolvency under applicable laws on the date of termination, file a debtor’s petition for bankruptcy, or enter liquidation; or  
17.5.4. you fail to pay any amount due to wflow within the payment period and fail to rectify this within 5 days after we request payment.

17.6. Termination of the Agreement does not relieve the parties of obligations and claims that, in accordance with the Agreement and applicable laws, remain in effect even after the termination. This includes intellectual property rights, confidentiality and data protection obligations, monetary claims, and damage claims. If you terminate the Agreement under section 17.4, you will be released from the obligation to pay the subscription for the period

after the effective date of such termination; in all other cases, all fees and other charges that would become due if the Agreement remained in effect until the end of the current payment period shall immediately become due, and you are obligated to pay them, along with all previously incurred but unpaid amounts, upon receiving an invoice.

17.7. Upon termination of the Agreement, wflow will provide the Customer with the option of long-term archiving and/or a one-time data backup in a commonly used database format, according to the current price list.

18. Dispute Resolution and Governing Law

18.1. These Terms are governed by and construed in accordance with the laws of the Czech Republic, excluding conflict of law principles.

18.2. The parties shall primarily seek to resolve any disputes arising out of these Terms amicably. If the dispute cannot be resolved amicably, any such dispute shall be subject to the exclusive jurisdiction of the competent courts of the Czech Republic.

19. Miscellaneous

19.1. These Terms and policies constitute the entire agreement between you and us and replace all previous contractual relationships.

19.2. If any provision of this Agreement is or becomes illegal, invalid, or unenforceable in any respect under the laws of any jurisdiction, it shall not affect the legality, validity, or enforceability of any other provision of this Agreement in that jurisdiction. If any invalid, unenforceable, or illegal provision would be valid, enforceable, or lawful if part of it were removed, that provision shall apply with minimal modifications necessary to make it legal, valid, and enforceable.

19.3. Any delay, action, or omission by either party in exercising any right or remedy shall not be deemed a waiver of that or any other right or remedy.

19.4. Without the prior written consent of the other party, neither party may assign the Agreement to a third party; however, wflow may assign the Agreement as a whole to its affiliate without your prior consent (e.g., in the case of reorganization or acquisition).

19.5. The headings of articles and paragraphs do not affect the interpretation of the Agreement.

Appendix No. 1 to the T&C of Service Provision

DATA PROCESSING AGREEMENT

1.      Introductory Provisions

1.1. This agreement is concluded as part of the Agreement between wflow and the Customer pursuant to Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council, General Data Protection Regulation ("GDPR"), and is governed by the Terms ("DPA"). All terms used in the Terms or the Agreement have the same meaning for the purposes of this DPA unless otherwise specified in this DPA. The DPA pertains to the processing of personal data for which the Customer acts as a data controller (or sub-processor) and wflow processes personal data on behalf of the Customer as a processor (or sub-processor).

 1.2. If this DPA specifies that a certain action must be performed in writing, this includes email or a written instruction via the Account on the Platform.

 2. Subject of Processing, Categories of Data Subjects, and Types of Personal Data

 2.1. In connection with the performance of the Agreement, personal data processing will take place as described above in this DPA, specifically for personal data related to the management of digital accounting. The Customer may create an Account for Users, store documents on the Platform, and perform other actions, leading to processing activities by wflow. Specifically, the following categories of personal data may be processed: 

2.1.1. Identification data; 
2.1.2. Contact data; 
2.1.3. Data on relationships with Third Parties; 
2.1.4. Data contained in documents uploaded by the Customer or User to the Platform; 
2.1.5. Data contained in the Account; 
2.1.6. Information provided to wflow through HelpDesk; 
2.1.7. Other information provided by the Customer or specific User to wflow in connection with the provision of Services.

 2.2. Data subjects whose personal data will be processed include:

 2.2.1. Service Users; 
2.2.2. Subjects whose Personal Data are included in documents uploaded by the Customer to the Platform or data on relationships with Third Parties;
2.2.3. Contact persons of the Customer within support provision.

 3. Nature and Purpose of Processing

 3.1. Wflow will process personal data electronically, automatically (and partially manually), and potentially using third-party tools specified below as sub-processors. The scope of activities that wflow will perform with personal data corresponds to the scope of Services. Specifically, it may include:

 3.1.1. Collecting personal data; 
3.1.2. Modifying, changing, and structuring personal data; 
3.1.3. Organizing personal data; 
3.1.4. Retaining and storing personal data; 
3.1.5. Searching, sorting, and making personal data accessible; 
3.1.6. Using personal data; 
3.1.7. Deleting personal data; 
3.1.8. Viewing personal data in connection with support provision.

 3.2. The purpose of processing is:

 3.2.1. Processing and archiving accounting documents for the Customer; 
3.2.2. Managing user Accounts and their permissions; 
3.2.3. Recording access/changes made by Users to Accounts; 
3.2.4. Extracting data from documents uploaded by Customers to the Platform; 
3.2.5. Ensuring additional activities related to providing Services and fulfilling obligations under the Agreement.

 4. Processing Duration and Termination of Processing

 4.1. Wflow will process personal data for the duration of the Agreement or as needed to perform specific instructions from the Customer or actions related to the provided Service, unless the Customer, as the controller, deletes the personal data earlier.

 4.2. Upon termination of cooperation and the DPA, regardless of the manner and reason for termination, wflow will delete (on all devices and media except for those owned by the Customer or Third Party) all personal data processed based on the DPA, unless EU or Czech Republic law requires their retention. The Customer may also choose additional paid services for exporting and transferring personal data from the Platform. If wflow must return personal data upon termination of processing, such data will be returned within the timeframe and format determined by wflow.

 5. Additional Obligations

 5.1. As the data controller, the Customer undertakes to maintain a valid legal basis for the relevant processing of personal data on the Platform throughout the processing period and to fulfill all legal obligations to data subjects, particularly the duty to inform. The Customer further undertakes to promptly remove from the Platform any personal data for which it lacks a valid legal basis for processing.

 5.2. Personal data will not be transferred to non-EU countries, i.e., third countries.

 5.3. Based on the DPA, wflow undertakes to comply with the obligations set out in Article 28 of the GDPR, specifically, it must:

 5.3.1. Process personal data solely based on documented instructions from the Customer as specified in the DPA or Agreement; for the avoidance of doubt, processing personal data as per Service provision is considered done per documented instructions; a written instruction includes an instruction issued through the Account by a User; each User is authorized to give instructions on behalf of the Customer, and wflow will not examine the User's authority to act for the Customer; 
5.3.2. Notify the Customer if it believes that their instructions conflict with legal regulations; for the avoidance of doubt, the Customer expressly confirms that the provision of Services defined in this DPA cannot compromise the security, confidentiality, and protection of personal data; 
5.3.3. Follow the Customer's instructions regarding the transfer of personal data to a third country or international organization, unless processing is mandated by EU or Member State law applicable to wflow; in such cases, wflow shall inform the Customer of this legal requirement before processing;
5.3.4. Ensure that persons authorized to process personal data are bound by confidentiality obligations or are subject to statutory confidentiality obligations; the confidentiality obligation remains in effect even after the termination of the DPA; 
5.3.5. Assist the Customer by providing cooperation and appropriate technical and organizational measures to meet the requirement to respond to data subject rights requests within 14 days from the day the request is sent by the Customer via email; 
5.3.6. Assist the Customer within 14 days of receiving such a request via email in ensuring compliance with (i) data security obligations, (ii) personal data breach notifications to the Data Protection Authority and, if applicable, data subjects, (iii) data protection impact assessments, and (iv) prior consultations with the Data Protection Authority. Wflow will comply with Customer requests only to the extent of information available to it.

 5.4. In accordance with GDPR, wflow must allow the Customer to conduct inspections (including audits and inspections) and provide the Customer with all necessary information to demonstrate compliance with the obligations set out in Article 28 of GDPR, for the purpose of verifying compliance with this DPA and related obligations. Any audit request may be sent by the Customer to support@wflow.com, and wflow and the Customer will electronically agree on audit conditions, including security measures and confidentiality obligations during the inspection. If no agreement is reached within 30 days of the audit request, wflow will set the audit conditions.

 5.5. The Customer, as a data controller, grants wflow general permission to make changes in the involvement of sub-processors. If the Customer is a sub-processor, they confirm having the data controller's permission to involve wflow as a sub-processor. Wflow will inform the Customer at least thirty (30) days before adding or replacing sub-processors. The Customer may object to changes regarding sub-processors involved in Processing within ten (10) calendar days of such notification. In such cases, wflow and the Customer will cooperate in good faith to resolve the objection reasons. If wflow deems the objections valid, it will not involve the sub-processor in Processing or may refrain from providing a specific Service type or terminate the contractual relationship with the Customer to the extent related to the Processing.

 5.6. Providers listed in the Terms participate as sub-processors in processing personal data under a contractual relationship with wflow, if you choose to use them, as well as:       

Sub-processor

Type of Activity Provided by Sup-processor

Additional information

Microsoft Azure

Platform operation and personal data storage

Data centers in Ireland and the Netherlands are used.

Rossum Ltd

Part of the Service integrated into the Platform

The company is established in a country with adequate protection under Article 45 of GDPR

Intercom, Inc.

Platform for gathering information through helpdesk.

The company is registered within the Data Privacy Framework

PDF GENERATOR API (Actual Reports OÜ)

 5.7. Any additional sub-processor involved in processing performed by wflow is contractually bound by the same obligations as in this DPA.

5.8. Wflow is not liable for damage caused in connection with the processing of personal data, including damage caused by breaches of obligations under this DPA. All damage includes damage caused by unforeseen and insurmountable obstacles and circumstances arising independently of wflow’s will or the will of persons authorized to act on behalf of wflow. If wflow were required to compensate for any damage, the total compensation would be limited as stated in the Terms. The total liability of wflow under the DPA, Agreement, or related thereto, regardless of whether the claim is based on the DPA, Agreement, tort, or otherwise, shall in no case exceed the Price received from the Customer for using the Platform and/or Services during the 4 months immediately preceding the date of the event leading to the claim and shall not exceed CZK 50,000. Damage limitation amounts under the DPA and the Agreement do not combine (the claim amount may be up to CZK 50,000 regardless of the cause of the damage).

5.9. Wflow is entitled to charge the Customer reasonable costs associated with handling any request and fulfilling any obligation under this DPA at an hourly rate of CZK 2,000.

6. Technical and Organizational Measures

6.1. Wflow undertakes to implement and maintain technical and organizational measures related to processing, at least to the following extent:

● A secure data center certified with ISO 27001 located in the EU, with logical (firewall, passwords, roles, and permissions) and physical access control measures (doors, locks, reception/security, electronic security, CCTV);  
● Encryption of transmitted Customer data;  
● Strong password policy on the Platform and encryption of passwords;  
● Confidentiality obligations for all wflow employees with access to personal data;  
● Data processing agreements in compliance with Article 28 GDPR with all processors;  
● Internal data protection guidelines, including access control to personal data;  
● Regular automatic backups;  
● Regular review of the security concept.

6.2. If wflow detects a personal data security breach, it will notify the Customer in writing without undue delay, but no later than 48 hours after becoming aware of the breach, providing all information known. For the avoidance of doubt, wflow will make reasonable efforts to provide information under Article 33(3) GDPR, though it is not required to provide all information under this article if it is not known to wflow. 

‍