Data Processing Agreement

1. Parties, scope and status

1.1 This Data Processing Agreement (DPA) is between FluoSite (Dominik Sikora), Lou Jansenplein 17H, 1063 GT Amsterdam, Netherlands, KvK 95614397, BTW NL005164401B51, which owns and operates FluoTest ("FluoTest", "we"), and the person or organisation that owns the FluoTest account or workspace in which quizzes are created (the "Customer", "you"). For personal data in your quizzes, you are the controller and FluoTest is the processor. If you process that data on behalf of your own client, FluoTest acts as your sub-processor on the same terms.

1.2 This DPA covers personal data that FluoTest processes on your behalf through your quizzes, contacts, integrations, emails and drip campaigns. It does not cover personal data that FluoTest processes as a controller for its own purposes, such as your own account and billing data, product updates and website analytics. That is described in the Privacy Policy.

1.3 This DPA forms part of the Terms of Service. You accept it by using FluoTest to collect respondent data. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

1.4 "GDPR" means Regulation (EU) 2016/679. Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in the GDPR.

2. Subject matter, duration, nature and purpose

2.1 The subject matter is the provision of FluoTest under the Terms: building, publishing and embedding scored quizzes, collecting and scoring answers, showing results, sending the emails you configure, notifying you and your team, and passing data to the tools you connect.

2.2 The processing lasts as long as your account or workspace exists, followed by deletion as described in section 5.

2.3 The nature of the processing is collection, storage, scoring, display, transmission to the integrations and recipients you choose, emailing and deletion. The only purpose is to provide FluoTest to you as instructed.

2.4 The types of personal data and the categories of data subjects are listed in Annex 1.

3. Your instructions and responsibilities

3.1 FluoTest processes personal data only on your documented instructions. Your instructions are: the Terms and this DPA; the way you configure and use FluoTest (quiz settings, results emails, follow-up and abandoned-quiz emails, hot-lead alerts, integrations, webhooks, API and MCP access, drip campaigns); and any further written instruction you send to info@fluosite.com that is consistent with how the service works.

3.2 Starting a drip campaign is your instruction to FluoTest to copy the email address and name of each contact in that campaign's saved segment who gave marketing consent and has not unsubscribed into an audience list in FluoTest's account with our email provider Resend, to deliver and manage your workspace's email campaigns. We keep the list in sync with the saved segment. We remove a contact when they unsubscribe, lose marketing consent, are deleted from FluoTest or no longer match the segment, and we delete the list when you delete the segment, its workspace or your account. We use these lists for no other purpose.

3.3 FluoTest tells you if it believes an instruction infringes the GDPR or other data protection law.

3.4 You are responsible for having a lawful basis for collecting and using respondent data, for informing respondents, for obtaining and recording any consent you need (including marketing consent and cookie consent for tracking tags you add), for the accuracy of the data, and for not collecting data that the Terms prohibit, such as health information, financial account details, government ID numbers, passwords or payment card data.

4. FluoTest's obligations

4.1 Instructions. FluoTest processes personal data only on your instructions, unless EU or Member State law requires otherwise. In that case we tell you before processing, unless the law forbids it.

4.2 Confidentiality. People who process personal data for FluoTest are authorised to do so and bound by a duty of confidentiality. A small number of authorised FluoSite staff can view account data when needed for support, security or billing, and each such access is logged.

4.3 Security. FluoTest takes the technical and organisational measures required by GDPR Article 32. The measures in place are summarised in Annex 2 and on the Security page.

4.4 Assistance. Taking into account the nature of the processing, FluoTest helps you respond to requests from data subjects (access, correction, deletion, restriction, objection, portability) and helps you with security, breach notification, data protection impact assessments and prior consultation, using the information available to us. You can export and delete data yourself in the dashboard. If a data subject contacts us directly about data we hold for you, we refer them to you and tell you without undue delay.

4.5 Personal data breaches. FluoTest notifies you of a personal data breach affecting your data without undue delay and, where feasible, within 72 hours of becoming aware of it, and gives you the information we have so that you can meet your own notification duties.

4.6 Records. FluoTest keeps the records of processing activities carried out on your behalf that GDPR Article 30(2) requires.

4.7 Information and audits. FluoTest makes available the information needed to show compliance with Article 28, such as this DPA, the Security page and the sub-processor list, and answers reasonable written questions. If that is not enough to meet a requirement of the GDPR or a supervisory authority, FluoTest allows an audit by you or an auditor you appoint, on reasonable notice, during business hours, under confidentiality and without disrupting the service.

5. Deletion and return of data

5.1 You can export your data and delete quizzes, submissions, contacts and your account yourself at any time. Deleted submissions on plans with the trash feature stay in a 30-day trash before they are permanently deleted.

5.2 When you delete your account or workspace, or your agreement with FluoTest ends, FluoTest deletes the personal data it processes on your behalf, including result video files and drip campaign audience lists, unless EU or Member State law requires it to be kept. Partial quiz submissions and integration delivery logs follow the retention periods in section 5 of the Privacy Policy.

5.3 If you need your data returned before deletion, export it from the dashboard or contact info@fluosite.com before you close the account.

6. Sub-processors

6.1 You give FluoTest general authorisation to use sub-processors. The current sub-processors are listed in the sub-processor table on the Privacy Policy and repeated in Annex 3.

6.2 When we add or replace a sub-processor, or use an existing one for a new purpose, we update that list. For material changes we also email the account owners at least 14 days before the change takes effect.

6.3 If you object on reasonable data protection grounds within that period, tell us at info@fluosite.com. If we cannot reasonably accommodate your objection, you may stop using the affected service and terminate it without penalty.

6.4 FluoTest binds each sub-processor to data protection obligations that are no less protective than those in this DPA, and remains responsible to you for their performance. Services that you connect yourself (such as Google Sheets, Slack, HubSpot, Mailchimp, Notion, Airtable, Brevo or webhooks) are your own choice of recipient. You instruct FluoTest to send data to them, and they are not FluoTest's sub-processors for your data.

7. International transfers

7.1 Our database, sign-in, file storage and hosting (Supabase and Vercel) run in the EU. Where a sub-processor processes personal data outside the EU, the transfer relies on the EU-US Data Privacy Framework or Standard Contractual Clauses, as described in the Privacy Policy.

7.2 FluoTest will not transfer personal data outside the EU without one of these safeguards, or another transfer mechanism that the GDPR allows.

8. Liability and governing law

8.1 The liability of each party under this DPA is subject to the limitations in the Terms of Service, to the extent the law permits. Nothing in this DPA limits the rights of data subjects or any liability that cannot be limited under the GDPR.

8.2 This DPA is governed by the law that governs the Terms, and disputes are resolved in the same way as under the Terms.

9. Changes and contact

9.1 We may update this DPA, for example when the law or the service changes. We show the date at the top of this page, and we email account owners about material changes.

9.2 For questions about this DPA or to send an instruction or request, contact info@fluosite.com.