Data processing agreement (DPA)

1. Parties and roles

CITYVIBES S.R.L., societate cu răspundere limitată, Tax ID / CUI 42122488, Trade Register J22/131/2020, registered office Str. Valea Adâncă nr. 9B, ap. 1B, 700712, Iași, RO, share capital 200,00 RON, referred to as Fluxe, processes personal data on behalf of the Customer identified in the account and contract confirmation.

This agreement supplements the Terms and Conditions and takes precedence in the event of a conflict concerning data processing on behalf of the Customer. The Customer determines the purpose of processing data from its activities and is the controller; Fluxe is the processor. Where the Customer lawfully acts as a processor for another controller, Fluxe is a subprocessor and the Customer must hold the necessary authorisation.

Fluxe remains an independent controller for its own account, security, contracting, billing, payment and communications data, as set out in the Privacy Policy. The Customer is responsible for the lawfulness of its purposes, legal basis and instructions; Fluxe is responsible for its own GDPR obligations and for processing outside or contrary to lawful instructions.

2. Object, duration, nature, and purpose

Processing begins when the relevant features are activated and continues for the duration of the service and the operations necessary to return or erase data. Its purpose is to provide the features selected by the Customer: hosting, organisation and search, documents and accounting, billing, reporting, integrations, support and security.

Operations include receipt and upload, storage and backup, extraction and structuring, consultation and correction, transmission to authorised recipients, export and erasure. OCR or external AI analysis applies only to the workflow in which the Customer uploads or selects data for that feature. Fluxe does not sell the Customer's content or use it for its own behavioural advertising.

3. Data categories and data subjects

• Data subjects: authorised users, representatives, employees, collaborators, customers, suppliers, contact persons and recipients of the Customer's documents.
• Identification and contact data: name, address, email, telephone, position, tax identifiers and representation details; Romanian personal identification number or identity document only where necessary for the activity and supported by a legal basis.
• Professional, financial and accounting data: invoices, contracts, IBANs, transactions, payroll records, personnel documents, signatures, messages, files and information entered in integrations.
• Technical data: account and document identifiers, access permissions, IP addresses, timestamps, audit events and metadata necessary for the feature.

The Customer limits data to what is necessary. Health data or other special categories of data and data relating to criminal convictions may be entered only where required by the feature and the Customer's activity, where an appropriate basis under Article 9 or 10 GDPR exists and appropriate safeguards are applied. A file containing such data must not be submitted for AI analysis if external processing is not authorised for that case.

4. Instructions, privacy, and security

Documented instructions arise from this agreement, settings and actions of authorised users, and validated support requests. Fluxe does not change the purpose of processing. If an instruction appears to infringe the GDPR or other data protection rules, Fluxe informs the Customer and suspends that instruction until clarification. If a law requires additional processing, the Customer is informed in advance unless prohibited by law.

Staff access is limited to authorised duties and subject to confidentiality. Measures include access separation by company and role, authentication and session protection, secure connections, protection of credentials and stored sensitive data, file validation, logging of relevant operations and backups with controlled access. The Customer sets team permissions, protects devices and revokes access for people who no longer need it.

Găzduire, baze de date și copii de siguranță: CITYVIBES S.R.L.; location: Europa. Operarea siteului, a serverelor, bazelor de date și copiilor de siguranță de către Fluxe.

Emailurile platformei și suport: CITYVIBES S.R.L.; location: Europa. Administrarea și livrarea emailurilor platformei de către Fluxe.

Measures are adapted to risk and reviewed when the service changes. Their description does not constitute security certification or a guarantee that every incident is impossible.

5. Sub-authorized persons and transfers

The Customer grants general authorisation for the subprocessors identified in the register, within the services and purposes stated. Fluxe selects them on the basis of sufficient guarantees and contractually requires data protection obligations at least equivalent to those in this agreement. Fluxe remains liable to the Customer for the performance of their obligations.

Subprocessor list — version 2026-10-15-r2.

Document analysis and AI Assistant may use different providers; the register identifies the active service and its purpose. Components running only on Fluxe infrastructure are not separate legal providers. Authorities and integrations contracted directly by the Customer do not automatically become Fluxe subprocessors.

Before adding or replacing a subprocessor, Fluxe informs the Customer by email or in the account and gives it an effective opportunity to raise a reasoned objection before the new provider is used. The notice identifies the provider, service, proposed date and objection deadline. The parties seek a reasonable solution; if none is possible, the Customer may stop the affected feature or terminate the service under the contract.

Data is not transferred outside the EEA solely on the basis of this general authorisation. For each transfer, the basis under Chapter V GDPR is verified: an adequacy decision or appropriate safeguards, including standard contractual clauses, a transfer assessment and supplementary measures where necessary. Information and a copy of the applicable safeguards may be requested from the Fluxe contact, with protection of trade secrets and security.

6. Support, incidents, and audit

Taking into account the nature of processing and the information available, Fluxe assists the Customer with the exercise of data subjects' rights and compliance with Articles 32–36 GDPR: security, impact assessments, prior consultation and breach notification. Requests received directly concerning the Customer's data are forwarded to it; Fluxe responds on its behalf only on instruction or where required by law.

On becoming aware of a personal data breach affecting the Customer's data, Fluxe notifies it without undue delay. As details become known, the notice includes the nature of the incident, categories and approximate numbers of affected persons and records, likely consequences, measures taken or proposed, and a contact for clarification. Information may be provided in stages; missing details do not delay the initial notification. The Customer determines its obligations to notify the authority and data subjects.

Fluxe provides the information necessary to demonstrate compliance and allows for and contributes to audits, including inspections, by the Customer or its mandated auditor. The parties establish reasonable access, confidentiality and security conditions without preventing necessary checks or the authority's powers. Access to other customers' data is not permitted.

7. Termination, return, and deletion

On termination of the service, the Customer chooses the return of data through available exports and erasure of copies, or direct erasure. Before closing the account, the Customer downloads documents it is required to retain. Fluxe removes data processed on its behalf, except where retention is required by Union law or applicable national law; data retained on that basis is isolated and used only for the justified legal purpose.

Technical backups are removed through the retention cycle no later than 7 days after operational erasure. They are not accessed for ordinary use, and erasure instructions are reapplied after restoration. On request, Fluxe provides available information about completion of return or erasure.

Fluxe's own invoices, payments and evidence of the contract are retained separately in its capacity as controller, in accordance with the Privacy Policy. This retention does not authorise other uses of the Customer's professional documents.

8. Parties' liability

Under Article 82 GDPR, the Customer is responsible for its obligations as controller, while Fluxe is liable for damage caused where it infringes GDPR obligations directed at processors or acts outside or contrary to lawful instructions. A party is exempt from liability only if it proves that it is not in any way responsible for the event. No clause removes data subjects' rights, authorities' powers or mandatory liabilities.

9. Contact and instructions

For instructions, incidents, assistance or audit requests, or objections concerning providers: contact@fluxe.ro; telephone 0750446660. Requests must identify the account and operation concerned; Fluxe verifies the requester's authority before disclosing or changing data.