Data processing addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between you ("Customer") and Enflow B.V., Wilhelminalaan 2, 2405 ED Alphen aan den Rijn, the Netherlands ("Enflow", "we", "us"), the operator of redirect.pizza. It applies to all plans, including the Free plan, when Enflow processes Customer Personal Data on your behalf. It is agreed electronically as part of the Agreement; no separate handwritten signature is required.
If there is a conflict between this DPA and the Agreement on a data-protection topic, this DPA prevails.
1. Roles
For Customer Personal Data processed to provide the Services, Customer is the controller (or a processor acting for a third-party controller) and Enflow is the processor (or subprocessor, as applicable).
For Account Data (for example registration details, billing information, and support correspondence about your account), Enflow acts as an independent controller. That processing is described in our Privacy Policy and is outside the scope of this DPA.
2. Definitions
Capitalized terms not defined here have the meaning in the Agreement or in the GDPR. In this DPA:
- Applicable Data Protection Law means the GDPR and any other data-protection law that applies to the processing under this DPA.
- Customer Personal Data means Personal Data that Enflow processes on Customer's behalf in providing the Services.
- GDPR means Regulation (EU) 2016/679.
- Personal Data, controller, processor, data subject, processing, personal data breach and supervisory authority have the meanings in the GDPR.
- Services means the redirect.pizza services under the Agreement, including URL redirects, analytics, email forwarding and related features Customer enables.
- Subprocessor means a third party engaged by Enflow to process Customer Personal Data in connection with the Services.
3. Subject matter, duration, nature and purpose
Enflow processes Customer Personal Data to provide, secure, maintain and support the Services, and to follow Customer's documented instructions.
Processing lasts for the term of the Agreement and any period afterward during which Enflow retains Customer Personal Data as described in Section 11 or required by law.
Details of the processing are set out in Annex 1.
4. Customer's instructions
Customer instructs Enflow to process Customer Personal Data as needed to provide the Services, as described in the Agreement, this DPA, Customer's configuration of the Services, and any other documented instructions Customer gives that Enflow accepts in writing (including email).
Enflow will process Customer Personal Data only on those instructions, including in relation to international transfers, unless Union or Member State law requires otherwise. If that happens, Enflow will tell Customer before processing, unless the law forbids that notice.
If Enflow believes an instruction infringes Applicable Data Protection Law, it will tell Customer promptly and may pause that instruction until the parties resolve the issue.
Customer determines the purposes of the processing and is responsible for lawful instructions, appropriate legal bases and required notices to data subjects. If Customer acts as a processor, it must have the relevant controller's authorization to engage Enflow.
5. Confidentiality
Enflow ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations, by contract or by law.
6. Security
Enflow implements appropriate technical and organizational measures to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction or damage, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing, as well as the risks to data subjects.
Those measures include encryption in transit and at rest, access controls, logging, network protection, periodic security assessments, and staff access limited to what their work requires. A summary of our security posture, certifications and policies is available on our security and compliance page and in our trust center.
Customer is responsible for securing its own account credentials, API tokens and systems used to access the Services.
7. Subprocessors
Customer grants Enflow general written authorization to engage Subprocessors to provide the Services, including those listed at /support/subprocessors. Enflow remains responsible to Customer for each Subprocessor's performance of its data-protection obligations.
Enflow will publish its current Subprocessor list and notify Customer at the email address associated with its account at least 30 days before adding or replacing a Subprocessor that processes Customer Personal Data. Customer may object in writing within that period on reasonable data-protection grounds. The parties will work in good faith to address the objection. If it cannot be resolved before the change takes effect, either party may terminate the affected Services before Customer Personal Data is provided to the proposed Subprocessor.
Enflow will impose on each Subprocessor data-protection obligations providing at least the same level of protection as this DPA, as required by Article 28(4) GDPR.
8. International transfers
Customer Personal Data is primarily processed and stored in the European Economic Area (EEA). Some Subprocessors are located outside the EEA. Customer authorizes transfers needed to provide the Services, subject to the safeguards in this section. Where a transfer is not covered by an adequacy decision under Article 45 GDPR, Enflow will ensure an applicable lawful transfer mechanism under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required.
9. Assistance with data subject rights
Taking into account the nature of the processing, Enflow will assist Customer with appropriate technical and organizational measures, insofar as possible, so Customer can respond to requests from data subjects to exercise their rights under Applicable Data Protection Law.
If Enflow receives a request that relates to Customer Personal Data and identifies Customer, Enflow will forward it to Customer and will not respond itself except on Customer's documented instructions or as required by law.
10. Personal data breaches
Enflow will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include information Enflow can reasonably provide to help Customer meet its own notification obligations, including the nature of the breach, likely consequences, and measures taken or proposed to address it.
Enflow will reasonably cooperate with Customer in investigating and remediating the breach. Notification under this section is not an admission of fault or liability.
11. Deletion and return
During the term of the Agreement, Customer can export or delete Customer Personal Data through the Services where those features are available, including the team data export described in our support documentation.
At the end of the Services, Enflow will, at Customer's choice, return or securely delete Customer Personal Data and delete existing copies, unless Union or Member State law requires retention. Customer can request a return of data in a commonly used format before termination; if Customer does not make that request, Customer instructs Enflow to delete it. Enflow will complete deletion without undue delay after termination or the requested return. Residual copies in backups will be protected from ordinary use and deleted through Enflow's normal backup rotation, unless retention is required by law.
12. Audits and information
Enflow will make available information necessary to demonstrate compliance with Article 28 GDPR and this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer. Existing security documentation and relevant ISO 27001 and SOC 2 Type 2 materials, available through our trust center or on reasonable request, will ordinarily be the first means of verification.
Where further verification is reasonably necessary, audits will normally be limited to once per twelve months, on thirty days' written notice, during normal business hours, and subject to reasonable security, confidentiality and operational safeguards. These limits do not prevent additional verification reasonably required following a significant security incident, credible evidence of non-compliance, or a regulatory requirement. Customer bears its own audit costs; Enflow may charge reasonable costs for assistance beyond providing existing documentation. Any independent auditor must be bound by confidentiality and must not be a competitor of Enflow.
13. Assistance with compliance
Taking into account the nature of processing and the information available to Enflow, Enflow will assist Customer with Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), insofar as they relate to Enflow's processing of Customer Personal Data.
14. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent Applicable Data Protection Law does not allow that limitation.
15. Changes
Enflow may make non-material administrative updates that do not reduce the protection of Customer Personal Data. Enflow will directly notify Customer of proposed material changes before they take effect. Changes affecting the parties' material data-protection rights or obligations require Customer's agreement, which may be recorded electronically through the Services or otherwise in writing; publication on the website alone does not constitute acceptance.
16. Governing law
This DPA is governed by the laws of the Netherlands, without regard to conflict-of-law rules. The courts of the Netherlands have exclusive jurisdiction, unless Applicable Data Protection Law requires otherwise for a data subject's rights.
Annex 1. Details of processing
Subject matter
Provision of the redirect.pizza Services to Customer.
Duration
The term of the Agreement, plus any retention period in Section 11 or required by law.
Nature and purpose of processing
Hosting and operating Customer's redirects and related features; recording and presenting analytics Customer enables; processing email forwards Customer configures; securing, logging, troubleshooting and supporting the Services; and following Customer's documented instructions.
Categories of data subjects
- Visitors and end users of Customer's hostnames and redirects
- Senders and recipients of email handled through Customer's email forwards
- Customer's team members and other users Customer invites to the Services, to the extent their data is processed on Customer's behalf in the Service configuration
Types of personal data
- Request data related to redirects and hostnames: timestamps, requested URLs and paths (including query strings), destination URLs, HTTP referrers, IP addresses (which may be truncated in stored analytics), approximate geolocation derived from IP, user agents, and similar technical metadata. When Customer disables tracking, Enflow records only the date and full URL to count hits. URLs may themselves contain Personal Data.
- Configuration data Customer stores in the Services that may contain Personal Data (for example paths, destinations, notes or tags)
- Email forwarding data: message metadata and content processed to deliver forwards Customer configures, and related delivery logs
- Other Personal Data Customer chooses to submit to the Services
The Services are not designed for the intentional processing of special categories of Personal Data under Article 9 GDPR. Customer must not configure the Services for such processing unless the parties agree otherwise in writing. Email forwards and URLs may nevertheless incidentally contain such information.
Subprocessors
As listed at Subprocessors, as updated from time to time.