Data Processing Addendum

1. Parties, scope, and priority

This addendum is between the business accepting Flaria’s Terms (“Customer”) and Web Vizual SIA, registration number 40203462329, “Viesturi 2”–1, Rendas pagasts, Kuldīgas novads, LV-3319, Latvia (“Flaria”). It applies to personal data Flaria processes on the Customer’s behalf to provide the agreed service. The Customer is the controller, or a processor authorized by its controller; Flaria is the processor or subprocessor. This addendum takes priority over conflicting service terms concerning that processing.

Account administration, our own invoicing, fraud prevention, and similar purposes for which Flaria determines the purpose of processing are covered separately by the Privacy Policy. Applicable data-protection law includes the GDPR where it applies and relevant U.S. state privacy law where applicable.

2. Documented instructions and lawful collection

The agreed service, this addendum, the project configuration, and requests made through authorized account or support channels are the Customer’s documented instructions. Flaria processes data only on those instructions, including instructions concerning transfers, unless law requires otherwise. Where legally permitted, Flaria informs the Customer before processing required by law. Flaria promptly informs the Customer if it considers an instruction to infringe applicable data-protection law.

The Customer is responsible for lawful collection, accurate notices, permissions, and the instructions it gives. The standard service must not be used to collect special-category data, criminal-offence data, payment-card information, passwords, or children’s data. Such processing requires a separately agreed service and safeguards.

3. Subject matter and processing details

The subject matter is the agreed website rebuild, hosting, maintenance, contact-form delivery, project communication, and support. Processing includes receiving, organizing, storing, generating or editing content, transmitting enquiries, viewing information to resolve requests, applying access controls, backing up, returning, and deleting data. It continues for the service term and the limited return, deletion, or legal-retention period described below.

Data subjects may include the Customer’s staff and representatives, website visitors, prospects, and customers whose information the Customer lawfully supplies. Data may include names, business contact details, enquiry contents, submitted images or documents, project instructions, website URLs, timestamps, delivery status, and technical connection or security information. The exact fields depend on the form and features the Customer authorizes.

4. Confidentiality and security

Flaria limits access to authorized people who need it for the service and are subject to confidentiality obligations. Flaria maintains appropriate measures considering the nature of the data and the risks, including HTTPS transport, authenticated access, customer-project access checks, administrator multifactor authentication, password hashing, server-side validation, upload limits, rate limits, and anti-abuse controls. Flaria reviews and adjusts the measures when risks or the service change. These are safeguards, not a guarantee that incidents can never occur.

5. Subprocessors and other recipients

The Customer gives general authorization for Flaria to use subprocessors necessary for the agreed service, including hosting and backup, automated content processing, email delivery, security, and support messaging. Flaria maintains a register of the services used and makes the relevant identities, functions, locations, and transfer information available on request. Optional integrations selected by the Customer are assessed according to the roles the parties actually perform.

Before a new or replacement subprocessor begins processing Customer data, Flaria provides at least 30 days’ notice to the account contact, with enough information to assess the change. The Customer may raise a reasoned data-protection objection before the change takes effect. The parties work to resolve it; if no reasonable solution is available, the affected processing will not proceed under the new arrangement without agreement, and the affected service may be ended. Flaria imposes equivalent applicable processing obligations on subprocessors and remains responsible for their performance of those obligations.

6. International transfers

Flaria processes data in the service locations relevant to the project and may use recipients outside the EEA. Transfers requiring protection under applicable law must use a valid mechanism, such as an applicable adequacy decision or appropriate standard contractual clauses with any supplementary measures needed. This addendum alone is not a substitute for a required transfer mechanism. Information about the applicable arrangements is available from [email protected].

7. Assistance and individual rights

Taking account of the nature of the processing and the information available, Flaria assists the Customer with access, correction, deletion, restriction, objection, portability, security assessments, impact assessments, and regulator consultations as required by applicable law. Requests received directly from individuals about Customer-controlled data are referred to the Customer unless law requires otherwise. Flaria does not independently answer such requests on the Customer’s behalf without instructions.

8. Personal data breaches

Flaria informs the Customer without undue delay after becoming aware of a personal data breach affecting Customer-controlled data. Available information includes the nature of the breach, affected data and people, likely consequences, steps taken or proposed, and a contact for follow-up. Information may be supplied in stages as it becomes available. Flaria takes reasonable containment and remediation steps and assists the Customer with required notifications. The Customer determines its own regulator and individual notifications unless law requires otherwise.

9. Retention, return, and deletion

Support conversations are subject to the 30-day limit after last activity described in the Privacy Policy. At the end of the relevant processing, Flaria returns or deletes Customer-controlled personal data at the Customer’s choice and deletes remaining copies, unless applicable law requires retention. The Customer may request return through [email protected]. Return is completed before deletion; residual copies and backups are removed within 30 days after the return or deletion instruction can be carried out, except for a specific legal retention obligation. Retained data is restricted to that purpose.

Return of personal data is separate from website source-code delivery. It does not grant source files, a deployable website export, or a right to transfer the Flaria-built website to another host.

10. Information and audits

Flaria makes information reasonably necessary to demonstrate compliance available to the Customer and allows and contributes to required audits or inspections by the Customer or an independent auditor bound by confidentiality. The parties arrange scope and timing to protect security, other customers, and service continuity. Reasonable planning requirements do not prevent an urgent, regulator-required, or legally required audit.

11. U.S. service-provider restrictions

Where applicable U.S. privacy law treats Flaria as a service provider or contractor, Flaria does not sell or share Customer-controlled personal information for cross-context behavioral advertising, use it outside the specified business purposes or direct service relationship except as law permits, or combine it with unrelated personal information except as law permits. Flaria provides the required level of protection, informs the Customer if it can no longer meet these obligations, and allows reasonable steps to verify, stop, and remediate unauthorized use.

12. Contact and acceptance

Send data-processing instructions and questions to [email protected] or an authorized Flaria support channel. Acceptance of the Terms incorporates this addendum for the processing it covers. An existing Customer is not treated as having accepted a materially changed addendum merely because a new version is published.