Data Processing Agreement

Between: Leegwater GmbH, Schachenstrasse 80, 8645 Jona, Switzerland, operating the "Flok" platform (the "Processor", "Flok") — and the customer identified in the Flok account (the "Controller", "Customer").

1. Formation and scope

1.1 This Data Processing Agreement (the "DPA") forms an integral part of the Flok Terms of Service (the "Terms") and takes effect automatically when the Customer accepts the Terms by creating a Flok account or continuing to use the service. No separate signature is required.

1.2 This DPA governs every processing of personal data that Flok carries out on the Customer's behalf in providing the Flok platform.

1.3 Conflict rule. Where this DPA conflicts with the Terms of Service, this DPA prevails in respect of the processing of personal data. In all other respects the Terms continue to apply unchanged.

1.4 Applicable law. This DPA is governed by Swiss law, in particular the nDSG, and — where the Customer's processing falls within its territorial scope under Art. 3 GDPR — by Regulation (EU) 2016/679. The place of jurisdiction is the registered office of Leegwater GmbH in Jona, Switzerland, unless mandatory law provides otherwise.

2. Subject matter and duration

2.1 The subject matter is the provision of the Flok club-management platform: member administration, membership-fee invoicing and payment tracking, event organisation and ticketing, email newsletters, the membership application queue and signup form, the member directory, bookkeeping on paid plans ("Finanzen"), and the associated audit trail.

2.2 The duration corresponds to the term of the Terms of Service. This DPA ends when the underlying contract ends, subject to the deletion and return obligations in section 10.

3. Nature and purpose of the processing

Flok processes personal data on the Customer's behalf solely to:

• store, organise, retrieve, amend and display member and contact records;
• generate, dispatch and track membership invoices, and record payments against them;
• publish events, take registrations and ticket bookings, issue tickets and record attendance;
• compose and deliver newsletters and event communications to recipients the Customer selects;
• receive, hold and present membership applications until the Customer decides on them;
• keep the Customer's bookkeeping journal, chart of accounts and receipts where the Customer uses Finanzen;
• maintain an audit log of changes made within the Customer's account;
• provide the AI-assisted "Pilot" features the Customer has enabled, on the terms of the AI Data Addendum;
• provide support that the Customer requests;
• back up, secure and restore the data, and keep the service available.

Flok does not process Customer personal data for its own purposes, and specifically does not use it for advertising, for resale, or to train Flok's own models.

4. Categories of data subjects

• Members and former members of the Customer's organisation;
• the Customer's administrators, staff and volunteer users of the platform;
• persons who register for or book tickets to the Customer's events, including non-members;
• recipients of the Customer's newsletters and event messages;
• persons who use the public support assistant on the Customer's event or ticket pages;
• persons who ask to join a waitlist for a sold-out ticket;
• persons who apply for membership through the Customer's signup form, by email, or through a form service the Customer has connected;
• persons named in files or free-text fields the Customer uploads.

5. Categories of personal data

Category	Examples
Identity and contact data	Name, email address, postal address, telephone number
Membership data	Membership status (active / passive / honorary), join date, roles, tags
Customer-defined data	Any custom field the Customer creates, and its values
Financial data	Invoices, amounts due and paid, payment status and dates, payment reference
Event data	Registrations, ticket type and quantity, amount paid, attendance / check-in
Communication data	Newsletter and event-message delivery, open and click events
Support-assistant data	Messages typed into the public assistant and the replies, with email addresses, phone numbers, IBANs and card-shaped numbers stripped before storage
Waitlist data	Email address, the ticket waited for, confirmation status
Application data	The fields on the Customer's signup form, the consents given, the applicant's language, a salted hash of the IP address and the browser user-agent string, and — for emailed applications — the email as received, for 30 days
Directory data	What a member chooses to show in the member directory — headline, skills, photo, links — with the per-detail visibility choices, access requests and consent records
Bookkeeping data (Finanzen)	Journal entries, the chart of accounts, uploaded receipts and the date, vendor and amount read from them; member names appear through postings that come from invoices
Staff assistant data	Questions a staff user asks the Pilot assistant and its replies
Uploaded content	Logos, attachments and documents the Customer uploads
Audit data	Who changed which record, when, and the values before and after

5.1 The Customer decides which data it enters into custom fields. Where the Customer processes special categories of personal data within the meaning of Art. 9 GDPR through Flok, it does so on its own legal basis and remains responsible for the lawfulness of that processing. The Customer shall notify Flok in advance if it intends to process special-category data at material scale, so that Flok can assess whether additional measures are required.

6. Controller instructions

6.1 Flok processes personal data only on the documented instructions of the Customer. This DPA, the Terms, and the Customer's use of the platform's own configuration options together constitute those instructions.

6.2 Flok will inform the Customer without delay if, in its opinion, an instruction infringes the GDPR, the nDSG or other applicable data-protection law. Flok may suspend execution of that instruction until the Customer confirms or withdraws it.

6.3 Where Flok is required by Swiss or EU law to process personal data beyond the Customer's instructions, Flok will inform the Customer of that requirement before processing, unless the law prohibits such notification on important grounds of public interest.

6.4 Flok's personnel who process Customer personal data are bound by a duty of confidentiality that survives the end of their engagement.

7. Rights of data subjects

7.1 Taking into account the nature of the processing, Flok will assist the Customer by appropriate technical and organisational measures in fulfilling the Customer's obligation to respond to requests to exercise data-subject rights under Chapter III GDPR and the corresponding nDSG provisions.

7.2 In practice, the platform itself lets the Customer read, correct, export and delete member, event, invoice and newsletter records directly, without needing Flok's involvement. Flok's assistance obligation is therefore limited to cases the platform's own tooling does not cover.

7.3 If a data subject approaches Flok directly with a request concerning data Flok processes on the Customer's behalf, Flok will not act on it, will refer the data subject to the Customer, and will notify the Customer without undue delay.

7.4 Flok will not be able to identify which Customer a data subject belongs to from the request alone in every case; the Customer will assist Flok in that identification where needed.

8. Breach notification and assistance

8.1 Flok will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting personal data Flok processes on the Customer's behalf.

8.2 The notification will describe, to the extent known at the time and supplemented as more becomes known: the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information.

8.3 An incomplete picture is not a reason to delay the first notification. Flok will notify on what it knows and supplement afterwards.

8.4 Flok will, taking into account the nature of the processing and the information available to it, assist the Customer in complying with the Customer's own obligations under Art. 33 (notification to the supervisory authority), Art. 34 (communication to affected data subjects), Art. 32 (security of processing), Art. 35 (data protection impact assessments) and Art. 36 GDPR (prior consultation of the supervisory authority).

8.5 Flok will not notify affected data subjects on the Customer's behalf, or make any public statement identifying the Customer, without the Customer's prior agreement — except where Flok is itself legally required to do so.

8.6 Flok's security contact for breach matters is security@getflok.app.

9. Sub-processors

9.1 The Customer grants Flok general written authorisation to engage sub-processors for the provision of the service.

9.2 The sub-processors engaged at the date of this DPA are listed on our sub-processors page, which forms Annex 1 to and part of this DPA.

9.3 Flok will inform the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the account's registered contact and by updating the sub-processors page.

9.4 The Customer may object to a new sub-processor on reasonable data-protection grounds within that 30-day period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the service with effect from the date the sub-processor is engaged, and Flok will refund any fees paid in advance for the unused remainder of the term.

9.5 Flok will impose on each sub-processor data-protection obligations no less protective than those in this DPA, by written contract, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

10. Deletion and return at the end of the contract

10.1 On termination of the Terms of Service, Flok will, at the Customer's choice, delete or return all personal data processed on the Customer's behalf.

10.2 Flok makes Customer Data available for export in a structured, commonly used, machine-readable format for 30 days after termination. After that period the data is deleted, together with existing copies, unless Swiss or EU law requires continued retention.

10.3 Backups are not deleted individually on termination. Data contained in encrypted backups is removed by the ordinary expiry of the backup retention windows — at least 60 days for the long-retention encrypted archive and 7 days for the database provider's daily backups. Flok will not restore a terminated Customer's data from a backup other than to meet a legal obligation.

10.4 Flok will confirm the deletion in writing to the Customer's registered contact once it has been carried out.

10.5 The separate deletion regime for inactive free-plan accounts is set out in section 6 of the Terms of Service and is not governed by this section.

11. Technical and organisational measures

11.1 Flok implements and maintains the technical and organisational measures set out in Annex 2, which forms an integral part of this DPA.

11.2 Flok may change those measures, provided the level of protection is not reduced. Material changes will be published on our security page.

12. Audit rights

12.1 Flok will make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

12.2 The Customer may request evidence of compliance in writing at any time. Flok will respond within 30 days.

12.3 An on-site inspection at Flok's premises is possible subject to all of the following:

• at least four (4) weeks' advance written notice, during normal business hours, and without disrupting the operation of the service;
• not more than once per calendar year, except where a data protection authority requires it or a personal data breach affecting the Customer has occurred;
• at the Customer's cost;
• the auditor must not be a competitor of Flok, and must sign a confidentiality undertaking on terms acceptable to Flok before access is granted;
• the inspection must not extend to data, systems or premises of other Flok customers, and Flok may refuse or redact anything that would expose another customer's data.

12.4 Flok may discharge its obligations under this section 12 by providing a current certification, audit report or attestation — its own, or that of a sub-processor covering the relevant processing — where that evidence reasonably addresses the subject of the Customer's request. Where such evidence is provided and is reasonably adequate, the Customer's right to an on-site inspection under 12.3 does not arise in respect of the matters it covers.

13. Data transfers outside Switzerland and the EEA

13.1 Personal data processed on the Customer's behalf is stored in Zürich, Switzerland (primary database) and Frankfurt, Germany (static assets and encrypted backups). Email is delivered from Ireland.

13.2 Where a sub-processor processes personal data outside Switzerland and the EEA, Flok relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) together with the Swiss addendum recognised by the FDPIC, and on such supplementary measures as are appropriate.

13.3 The sub-processor list identifies which sub-processors involve such a transfer. The AI provider is the only one; see the AI Data Addendum.

14. EU representative

Not currently required. Flok operates in Switzerland only.

14.1 Flok does not currently offer the service to data subjects in the European Union. Where Flok begins to do so, it will appoint a representative in the Union in accordance with Art. 27 GDPR and publish that representative's name and address in its Imprint and Privacy Policy before the offering begins.

15. Liability

15.1 Liability under this DPA is governed by section 11 of the Terms of Service, except where mandatory law provides otherwise.

15.2 Nothing in this DPA limits either party's liability under Art. 82 GDPR toward data subjects, or a supervisory authority's power to impose administrative fines.

16. Miscellaneous

16.1 Amendments require written form. Flok will notify the Customer of a new version at least 30 days before it takes effect; the Customer's continued use after that date, or its explicit acceptance in the platform, constitutes acceptance of the new version.

16.2 Should any provision be or become invalid, the validity of the remaining provisions is unaffected. The parties will replace the invalid provision with a valid one that comes closest to its commercial and data-protection intent.