Data Processing Terms

These Data Processing Terms apply when GTO Business OÜ processes Customer Personal Data on behalf of a customer in connection with the provision of NoimaFlow. They supplement the Terms of Service and are intended to reflect Article 28 GDPR-style processor commitments.

The customer is the controller (or, where applicable, a processor acting on behalf of its own client) for Customer Personal Data submitted to the service. GTO Business OÜ acts as processor for that Customer Personal Data except where we clearly act as an independent controller for our own account administration, billing, marketing, security, abuse prevention, or legal compliance activities.

The customer instructs us to process Customer Personal Data as necessary to provide the service, maintain security, and carry out documented customer actions within the product. The customer is responsible for ensuring that its instructions are lawful and that it has a valid legal basis, transparency notice, and all required permissions for the Customer Personal Data it submits.

Customers must not instruct us to process special category data or other highly sensitive personal data unless such processing is strictly necessary, lawful, and supported by appropriate safeguards.

We ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory duty of confidentiality.

We implement technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are risk-based and may include access controls, encrypted transport, token encryption, restricted operational access, credential segregation, and vendor security reviews.

The customer authorises us to use subprocessors reasonably required to operate the service, including infrastructure, storage, billing, email, AI, and social platform providers. We remain responsible for managing those subprocessors in accordance with applicable data protection obligations.

RECHYNY CORP S.R.L. (Digital Wizards) supports technical development, product maintenance, and operational administration as a service provider acting under our instructions.

Our public Privacy Policy identifies the principal categories of providers currently used. Material changes to subprocessors may be reflected there or otherwise communicated through customer-facing documentation.

Where subprocessors or authorised personnel process Customer Personal Data outside the EEA, we use a transfer mechanism recognised under Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses, together with supplementary safeguards where appropriate.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to help the customer respond to data subject requests and comply with obligations relating to security, breach notification, data protection impact assessments, and prior consultations, where applicable.

If we become aware of a personal data breach affecting Customer Personal Data, we will notify the relevant customer without undue delay and provide information reasonably available to us so the customer can assess and meet its own notification obligations.

At the end of the customer relationship, we will delete or return Customer Personal Data in accordance with the customer's instructions, product functionality, and our ordinary deletion processes, unless applicable law requires continued retention.

We will make available information reasonably necessary to demonstrate compliance with these Data Processing Terms. Where a customer reasonably requires further assurance, the parties may agree an appropriate and proportionate audit or information-sharing process that protects other customers, security, and confidentiality.

If there is a conflict between these Data Processing Terms and the Terms of Service with respect to processor obligations, these Data Processing Terms prevail to that extent. Questions may be sent to hello@noimaflow.com.