Data Processing Agreement
Last updated: December 19, 2024
This Data Processing Agreement ("DPA") forms part of the agreement between GxP Flow and its customers regarding the processing of personal data. This DPA reflects our commitment to protecting personal data in accordance with applicable data protection regulations, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.
By using our services, customers agree to the terms of this DPA. For a signed copy of this DPA or to discuss specific data processing requirements, please contact us at contact@gxpflow.com .
1. Definitions
"Controller" means the entity that determines the purposes and means of the processing of Personal Data.
"Processor" means the entity that processes Personal Data on behalf of the Controller.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
2. Scope of Processing
GxP Flow acts as a Processor when handling customer data within our document management platform. We process Personal Data only:
- On documented instructions from the Controller (customer)
- For the purposes specified in the service agreement
- In accordance with applicable data protection laws
3. Sub-processors
We may engage sub-processors to assist in providing our services. Current sub-processors include:
- Cloud Infrastructure: Amazon Web Services (AWS) - Data hosting and storage
- Analytics: Google Analytics (if enabled by customer) - Usage analytics
- Email: SendGrid - Transactional email delivery
We will notify customers of any changes to sub-processors and provide an opportunity to object.
4. International Transfers
Personal Data may be transferred to countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data processing agreements with all sub-processors
- Compliance with applicable adequacy decisions
5. Security & Breach Notification
We implement appropriate technical and organizational measures to protect Personal Data, including:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Access controls and authentication
- Regular security assessments
- Employee training on data protection
In the event of a data breach, we will notify affected customers without undue delay and within 72 hours of becoming aware of the breach.
6. Data Retention & Deletion
We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected:
- Customer data is retained for the duration of the service agreement
- Upon termination, data is deleted within 30 days unless regulatory requirements mandate longer retention
- Customers may request earlier deletion of specific data
- Audit logs are retained as required for regulatory compliance (21 CFR Part 11)
Controller Rights and Obligations
As a Controller, you have the right to:
- Audit: Request information about our data processing activities and conduct audits
- Instructions: Provide documented instructions regarding the processing of Personal Data
- Deletion: Request deletion of Personal Data subject to legal retention requirements
- Portability: Request export of Personal Data in a machine-readable format
- Object: Object to the appointment of specific sub-processors
Compliance with Data Subject Requests
We will assist you in responding to data subject requests, including requests for:
- Access to Personal Data
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability
- Objection to processing
Contact Information
For questions about this DPA or to exercise your rights, please contact:
Data Protection Officer
Email: privacy@pharmadoc.com
Phone: +91 9876543210
Address: Meraki Latitude, 211/212, Old Padra Rd, Vadodara, Gujarat - 390007