Legal

Data Processing Addendum

Logiciel EvalFlow Inc., operating as EvalFlow

This Data Processing Addendum ("DPA") forms part of the EvalFlow Terms of Service, Order Form, subscription agreement, or other written agreement between Logiciel EvalFlow Inc., operating as EvalFlow ("EvalFlow," "we," "us," or "our"), and the organization, company, or legal entity using the EvalFlow Service ("Customer," "you," or "your").

This DPA applies where EvalFlow processes Personal Data on behalf of Customer in connection with the EvalFlow platform, website, applications, artificial intelligence features, integrations, support services, and related services collectively referred to as the "Service."

This DPA is designed to address controller/processor obligations under applicable privacy and data protection laws, including the GDPR where applicable. GDPR Article 28 requires processing by a processor to be governed by a contract that sets out the subject matter, duration, nature, purpose, types of personal data, categories of data subjects, and the obligations and rights of the controller.

1. Definitions

"Agreement" means the EvalFlow Terms of Service, this DPA, any applicable Order Form, and any other written agreement between Customer and EvalFlow governing the Service.

"Applicable Data Protection Laws" means all privacy, data protection, data security, and data transfer laws applicable to the processing of Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss data protection law, Canada's PIPEDA, Quebec privacy laws, and similar laws.

"Customer Data" means all data, content, files, text, employee information, feedback, reviews, goals, OKRs, recognition, surveys, tasks, comments, prompts, outputs, configurations, and other information submitted to, uploaded to, generated within, stored in, or processed through the Service by or on behalf of Customer.

"Data Subject" means an identified or identifiable individual to whom Personal Data relates.

"GDPR" means Regulation (EU) 2016/679, the General Data Protection Regulation.

"Personal Data" means any information relating to an identified or identifiable individual that is processed by EvalFlow on behalf of Customer through the Service.

"Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.

"Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by EvalFlow on behalf of Customer.

"Sensitive Data" means special categories of personal data or highly sensitive information, including health information, biometric data, government identifiers, financial account information, criminal records, union membership, religious or political beliefs, racial or ethnic origin, sexual orientation, precise geolocation, or other sensitive data under Applicable Data Protection Laws.

"Subprocessor" means a third party engaged by EvalFlow to process Personal Data on behalf of Customer in connection with the Service.

2. Scope of this DPA

This DPA applies only to Personal Data that EvalFlow processes on behalf of Customer as a processor, service provider, or equivalent role.

This DPA does not apply to information that EvalFlow processes as an independent controller for its own business purposes, such as billing, account administration, website analytics, marketing, fraud prevention, legal compliance, or business communications. Such processing is described in EvalFlow's Privacy Policy.

If there is a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls.

3. Roles of the Parties

As between Customer and EvalFlow: (a) Customer is the controller, business, or equivalent entity that determines the purposes and means of processing Personal Data; and (b) EvalFlow is the processor, service provider, or equivalent entity that processes Personal Data on behalf of Customer.

Customer instructs EvalFlow to process Personal Data as necessary to provide, secure, support, maintain, and improve the Service in accordance with the Agreement, this DPA, Customer's configuration of the Service, and Customer's written instructions.

EvalFlow will notify Customer if EvalFlow believes, in its reasonable opinion, that an instruction infringes Applicable Data Protection Laws, unless prohibited from doing so by law.

4. Customer Responsibilities

Customer is responsible for: (a) complying with Applicable Data Protection Laws in its use of the Service; (b) determining the lawful basis for processing Personal Data; (c) providing all required notices to Data Subjects; (d) obtaining all required consents, approvals, and authorizations; (e) ensuring that Personal Data submitted to the Service is accurate, lawful, relevant, and necessary; (f) configuring user permissions and access controls appropriately; (g) responding to Data Subject requests; (h) determining whether Customer's use of the Service requires a data protection impact assessment or similar review; and (i) ensuring that Customer does not submit Sensitive Data unless expressly authorized in writing by EvalFlow.

Customer acknowledges that EvalFlow does not control Customer's employment decisions, workplace policies, employee communications, legal basis for processing, or internal HR practices.

5. Subject Matter of Processing

The subject matter of processing is the provision of the EvalFlow Service to Customer, including a performance management platform with functionality for employee feedback, performance reviews, goals, OKRs, one-on-one meetings, recognition, employee profiles, pulse surveys, analytics, AI-assisted workflows, integrations, notifications, reporting, and related HR and performance-management processes.

6. Duration of Processing

EvalFlow will process Personal Data for the duration of the Agreement and for any additional period necessary to provide the Service; complete deletion, export, or transition activities; comply with legal obligations; maintain security and backup integrity; resolve disputes; enforce agreements; or establish, exercise, or defend legal claims.

7. Nature and Purpose of Processing

The nature and purpose of processing includes: hosting, storing, organizing, retrieving, displaying, transmitting, securing, backing up, and deleting Personal Data; enabling Customer to manage performance-management workflows; providing AI-assisted drafting, summarization, analysis, search, and insight features; providing integrations with third-party systems enabled by Customer; sending notifications and service communications; providing customer support, troubleshooting, and maintenance; monitoring and securing the Service; preventing fraud and unauthorized access; and complying with applicable legal obligations.

8. Categories of Data Subjects

Personal Data may relate to: Customer employees; Customer contractors; Customer managers; Customer administrators; Customer executives; Customer HR personnel; invited users; users of the Service; and other individuals whose information is submitted to the Service by or on behalf of Customer.

9. Categories of Personal Data

Personal Data processed through the Service may include: names; email addresses; job titles; departments; reporting relationships; manager names; employment-related profile information; user account information; role and permission information; goals and OKRs; performance feedback; performance reviews and ratings; recognitions; pulse survey responses; comments, notes, and messages; one-on-one meeting content; tasks, projects, and work-related records; AI prompts and AI-generated outputs; integration data enabled by Customer; usage logs and audit logs; authentication and security metadata; and other information submitted by Customer or Authorized Users.

10. Sensitive Data

EvalFlow is not designed to process health records, biometric identifiers, payroll data, benefits data, background-check data, criminal records, immigration records, medical data, regulated health information, or other highly sensitive categories of Personal Data.

If Customer submits Sensitive Data without EvalFlow's written authorization, Customer is solely responsible for all resulting legal, regulatory, contractual, operational, and security consequences. EvalFlow may delete, restrict, or quarantine Sensitive Data if EvalFlow reasonably believes it has been submitted in violation of this DPA.

11. EvalFlow Processing Obligations

EvalFlow will: (a) process Personal Data only on documented instructions from Customer; (b) ensure that personnel authorized to process Personal Data are subject to confidentiality obligations; (c) implement appropriate technical and organizational measures to protect Personal Data; (d) assist Customer with Data Subject requests where legally required and reasonably possible; (e) assist Customer with data protection impact assessments where legally required; (f) notify Customer without undue delay after becoming aware of a Security Incident; (g) impose appropriate data protection obligations on Subprocessors; (h) delete or return Personal Data as described in this DPA; and (i) make available information reasonably necessary to demonstrate compliance with this DPA.

12. Confidentiality

EvalFlow will ensure that persons authorized to process Personal Data are subject to confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

EvalFlow will limit access to Personal Data to personnel, contractors, advisors, service providers, and Subprocessors who need access to provide, secure, support, maintain, or improve the Service.

13. Security Measures

EvalFlow will implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. These measures may include: encryption in transit and at rest; role-based access controls; tenant isolation; database-level row-level security; authentication controls; audit logs and monitoring; secure software development practices; backup and recovery controls; server-side secret management; least-privilege access; incident response procedures; and other measures described on EvalFlow's Security page.

Customer acknowledges that no system can be guaranteed to be completely secure and that EvalFlow's security obligations are obligations to maintain appropriate safeguards, not to guarantee absolute security.

14. Security Incidents

EvalFlow will notify Customer without undue delay after becoming aware of a confirmed Security Incident affecting Personal Data processed on behalf of Customer. Notice may include, where available: a description of the incident; the categories of Personal Data and Data Subjects affected; the likely consequences; measures taken or proposed; and recommended steps for Customer.

Customer is responsible for determining whether it must notify Data Subjects, regulators, employees, or other third parties.

EvalFlow is not responsible for Security Incidents caused by Customer, Customer's Authorized Users, Customer's systems, Customer's credentials, Customer's integrations, Customer's misconfiguration, or third-party services not controlled by EvalFlow. EvalFlow's notification of a Security Incident is not an admission of fault or liability.

15. Data Subject Requests

Customer is responsible for responding to requests from Data Subjects exercising rights under Applicable Data Protection Laws, including requests for access, correction, deletion, restriction, portability, or objection.

EvalFlow will provide reasonable assistance to Customer in responding to Data Subject requests, taking into account the nature of processing and the information available to EvalFlow. EvalFlow may charge reasonable fees for assistance that requires significant manual effort, unless prohibited by law.

16. Subprocessors

Customer gives EvalFlow general authorization to engage Subprocessors to process Personal Data in connection with the Service. EvalFlow will maintain a list of Subprocessors and will impose contractual obligations on Subprocessors that are materially no less protective than the obligations in this DPA.

EvalFlow may add or replace Subprocessors from time to time and will provide notice of material Subprocessor changes where required by Applicable Data Protection Laws.

Customer may object to a new Subprocessor on reasonable data protection grounds by notifying EvalFlow in writing within ten (10) days. If the parties cannot resolve the objection, Customer may stop using the affected feature or terminate the affected Service as Customer's sole and exclusive remedy.

17. Current Categories of Subprocessors

EvalFlow may use Subprocessors for: cloud hosting and infrastructure; database and authentication services; AI model and API services; email delivery and notifications; payment processing; analytics and product usage monitoring; customer support and CRM; error tracking and logging; file storage; communication and collaboration integrations; HRIS or productivity integrations enabled by Customer; and security, monitoring, and operational tools. EvalFlow may use Merge.dev or similar unified API providers to enable Customer-authorized HRIS and workplace software integrations.

18. International Transfers

Customer authorizes EvalFlow and its Subprocessors to process Personal Data in Canada, the United States, and other jurisdictions where EvalFlow or its Subprocessors operate.

Where Personal Data is transferred from the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with data-transfer restrictions to a country that does not provide an adequate level of protection, the parties agree to use appropriate transfer safeguards, including the Standard Contractual Clauses (EEA), UK International Data Transfer Addendum (UK), and Swiss-specific modifications (Switzerland) where applicable.

Customer is responsible for determining whether Customer must complete a transfer impact assessment, employee notice, works council consultation, or other transfer-related compliance step.

19. Standard Contractual Clauses

Where the Standard Contractual Clauses are required: Module Two applies where Customer is a controller and EvalFlow is a processor; Module Three applies where Customer is a processor and EvalFlow is a subprocessor; Customer is the data exporter and EvalFlow is the data importer where applicable; the details in this DPA constitute the required annexes to the SCCs; and if there is a conflict between this DPA and the SCCs, the SCCs control to the extent of the conflict.

The parties agree that execution of the Agreement constitutes execution of the SCCs where required by Applicable Data Protection Laws.

20. Assistance with Compliance

Taking into account the nature of processing and information available to EvalFlow, EvalFlow will provide reasonable assistance to Customer with: responding to Data Subject requests; security obligations; Security Incident assessment and notification; data protection impact assessments; prior consultation with supervisory authorities where required; and documentation reasonably necessary to demonstrate compliance with this DPA. EvalFlow may charge reasonable fees for assistance that requires significant manual effort, unless prohibited by law.

21. Audits and Information Rights

EvalFlow will make available information reasonably necessary to demonstrate compliance with this DPA, including Security page, Privacy Policy, Subprocessor List, and written responses to security questionnaires.

On-site audits are not permitted unless required by Applicable Data Protection Laws and only if the requested information cannot reasonably be provided through documentation. Any audit must be subject to at least thirty (30) days' prior written notice; conducted during normal business hours; limited to systems relevant to Customer's Personal Data; subject to confidentiality obligations; conducted no more than once per year unless required by law; and performed at Customer's expense.

EvalFlow may refuse or limit any audit request that would create security risk, disclose information about other customers, reveal trade secrets, or unreasonably disrupt EvalFlow's business.

22. Return and Deletion of Personal Data

Customer is responsible for exporting Customer Data before termination or cancellation. Upon termination, expiration, or verified written deletion request, EvalFlow will delete or anonymize Personal Data from active systems and backups within ninety (90) days, unless retention is required by law or necessary for legitimate business purposes.

EvalFlow may retain aggregated, anonymized, or de-identified data that does not identify Customer, Authorized Users, employees, Data Subjects, or other individuals. EvalFlow is not responsible for Personal Data exported by Customer or retained by third-party integrations enabled by Customer.

23. AI Processing

The Service may include AI Features that process Customer Data to generate, summarize, analyze, search, draft, recommend, or assist with HR and performance-management workflows.

EvalFlow does not use Customer Data to train generalized AI models for other customers. EvalFlow may use third-party AI providers as Subprocessors who may temporarily process limited inputs, outputs, or metadata for abuse monitoring, security, or service operation purposes.

Customer remains responsible for: determining whether AI Features are appropriate; providing legally required notices to Data Subjects; ensuring that AI outputs are reviewed by qualified humans; ensuring that AI Features are not used as the sole basis for decisions producing legal or similarly significant effects on individuals; and complying with all applicable laws. AI outputs are not legal, HR, employment, compliance, medical, financial, or professional advice.

24. Regulated and High-Risk Use

Customer must ensure meaningful human review of AI-assisted outputs before using them in any employment-related process. Customer is solely responsible for validating AI outputs and ensuring that Customer's use of the Service complies with applicable employment, labor, human rights, anti-discrimination, privacy, and AI laws.

25. Government and Law Enforcement Requests

If EvalFlow receives a government, regulator, court, law enforcement, or similar request for Personal Data processed on behalf of Customer, EvalFlow will, where legally permitted, notify Customer. EvalFlow may disclose Personal Data where required by law and will use commercially reasonable efforts to limit disclosure to what is legally required.

26. Data Accuracy

Customer is responsible for the accuracy, completeness, quality, relevance, and legality of Personal Data submitted to the Service. EvalFlow has no obligation to verify Personal Data entered by Customer or Authorized Users.

27. Liability

Each party's liability under this DPA is subject to the limitations, exclusions, and liability caps in the Agreement. EvalFlow's total aggregate liability arising out of or relating to this DPA, Personal Data, Security Incidents, privacy claims, AI processing, Subprocessors, or international transfers is subject to the liability cap in the Agreement. Nothing in this DPA limits liability where such limitation is prohibited by Applicable Data Protection Laws.

28. Indemnity

Customer will defend, indemnify, and hold harmless EvalFlow, its directors, officers, employees, contractors, agents, representatives, Affiliates, and Subprocessors from and against any claims, damages, liabilities, losses, fines, penalties, costs, and expenses, including reasonable legal fees, arising out of or relating to: Customer's violation of Applicable Data Protection Laws; Customer's failure to provide required notices, consents, or legal bases; Customer's submission of Sensitive Data; Customer's employment or HR decisions; Customer's instructions to EvalFlow; Customer's use of AI Features; Customer's integrations or third-party services; Customer's failure to respond to Data Subject requests; or Customer's processing of Personal Data through the Service.

29. Changes to this DPA

EvalFlow may update this DPA from time to time to reflect changes in law, the Service, subprocessors, security measures, or business operations. EvalFlow will provide notice of material changes by posting an updated DPA, sending email, or providing in-app notice.

Customer's continued use of the Service after the updated DPA becomes effective constitutes acceptance. If Customer objects to a material change, the parties will work in good faith to resolve the objection. If unresolved, Customer may terminate the affected Service as its sole and exclusive remedy.

30. Contact

Questions about this DPA or data protection matters may be sent to:

Logiciel EvalFlow Inc., operating as EvalFlow
Email: info@evalflow.com
Website: www.evalflow.com

Questions about this DPA?

Contact us or book a call with our team to walk through data protection, security architecture, or compliance questions.

Book a demo