Data Processing Addendum (DPA)

1. Scope

This DPA applies where Theodosios Bratelis, trading as Metiflow, processes personal data on behalf of business customers using Metiflow Trader and/or Metiflow Resto, including during any free trial or pilot period.

2. Roles

Customer acts as data controller for customer-submitted personal data. Theodosios Bratelis acts as processor for that data, except where acting as controller for account administration and legal compliance.

3. Processor Obligations

• Process personal data only on documented customer instructions.
• Implement industry-standard safeguards and commercially reasonable security measures.
• Restrict personnel access based on need-to-know principles.
• Assist with data subject rights and incident response where required.
• Provide the Customer with the ability to export a copy of Customer Content, including relevant personal data, to support the Customer's own data portability and data subject request obligations.

4. Subprocessors

We use subprocessors to deliver hosting and platform services. The current list is maintained at /subprocessors.

5. Contact and Company Details