Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between BLOKOFY ("Processor") and the customer ("Controller") regarding the processing of Personal Data in connection with the use of BLOKOFY's services.

This DPA supplements the Terms of Service and Privacy Policy, and applies whenever BLOKOFY processes Personal Data on behalf of its customers.

For legal and administrative purposes, BLOKOFY is owned and operated by Romulo Medici.

BLOKOFY provides artificial intelligence automation services, workflow orchestration, system integrations, customer communication automation, and related cloud-based services.

When providing these Services, BLOKOFY processes Personal Data solely on behalf of the Controller and exclusively in accordance with documented instructions provided through the Services. BLOKOFY shall not process Personal Data for any purpose outside the scope defined in this DPA.

Depending on the Controller's implementation, Personal Data processed through the Services may include:

• ◆Full name, email address, and phone number
• ◆Company information and business records
• ◆CRM data and customer records
• ◆Support requests and communication history
• ◆Workflow inputs and automation outputs
• ◆AI processing inputs and generated outputs
• ◆Technical metadata and interaction logs

The Controller determines which categories of Personal Data are submitted to the Services.

Personal Data processed under this DPA may relate to the following categories of individuals:

• ◆Customers and prospective customers
• ◆Employees and contractors
• ◆Suppliers and business contacts
• ◆Website visitors and end users

BLOKOFY processes Personal Data exclusively for purposes necessary to deliver the Services, including:

• ◆Delivering contracted automation services and executing customer workflows
• ◆AI-assisted processing of inputs provided by the Controller
• ◆Customer support, system monitoring, and security operations
• ◆Backup, disaster recovery, and business continuity
• ◆Platform improvements and performance optimization
• ◆Compliance with applicable legal obligations

BLOKOFY shall not process Personal Data for any purpose unrelated to the delivery of the Services.

The Controller is solely responsible for:

• ◆Ensuring the lawful collection of Personal Data submitted to the Services
• ◆Obtaining all required legal permissions and consents from Data Subjects
• ◆Determining lawful purposes and legal bases for processing
• ◆Providing accurate and complete instructions to BLOKOFY
• ◆Informing Data Subjects of their rights where required by applicable law
• ◆Complying with all applicable privacy laws and regulations

BLOKOFY agrees to:

• ◆Process Personal Data only in accordance with documented Controller instructions
• ◆Implement appropriate technical and organizational security measures
• ◆Maintain strict confidentiality of all Personal Data processed
• ◆Restrict access to Personal Data to authorized personnel only
• ◆Notify the Controller of confirmed Personal Data breaches where legally required
• ◆Assist the Controller in fulfilling privacy obligations to the extent reasonably possible

BLOKOFY ensures that all personnel authorized to process Personal Data are subject to appropriate confidentiality obligations, whether by contract or by operation of law.

Access to Personal Data is strictly limited to individuals who require it for legitimate operational purposes directly related to the delivery of the Services.

BLOKOFY maintains reasonable administrative, technical, and organizational safeguards to protect Personal Data, including where applicable:

• ◆Encryption of data in transit (HTTPS/TLS)
• ◆Encryption at rest where technically supported
• ◆Access controls and authentication mechanisms
• ◆Infrastructure monitoring and activity logging
• ◆Network security controls and firewalls
• ◆Backup procedures and disaster recovery processes
• ◆Incident detection and response protocols

Security measures are periodically reviewed and updated to reflect evolving standards and risks.

BLOKOFY may engage trusted subprocessors to provide infrastructure and technical services necessary for delivering the Services. Subprocessors may include providers of:

• ◆Cloud infrastructure and hosting
• ◆Artificial intelligence and machine learning services
• ◆Database and storage services
• ◆Communication and email delivery platforms
• ◆Analytics and monitoring
• ◆Payment processing
• ◆Automation infrastructure (including n8n)

BLOKOFY requires all subprocessors to maintain appropriate contractual data protection obligations consistent with this DPA.

Personal Data may be transferred to countries outside the Controller's jurisdiction when necessary to provide the Services. Where such transfers occur, BLOKOFY implements appropriate safeguards, including:

• ◆Standard Contractual Clauses (SCCs) where applicable
• ◆Adequacy decisions recognized under relevant privacy frameworks
• ◆Technical safeguards to protect data integrity and confidentiality
• ◆Organizational safeguards governing subprocessor conduct

To the extent legally required and technically feasible, BLOKOFY shall reasonably assist the Controller in responding to Data Subject requests concerning:

• ◆Access — the right to obtain a copy of Personal Data held
• ◆Rectification — the right to correct inaccurate or incomplete data
• ◆Erasure — the right to request deletion of Personal Data
• ◆Restriction — the right to limit how data is processed
• ◆Portability — the right to receive data in a structured format
• ◆Objection — the right to object to certain processing activities
• ◆Withdrawal of Consent — where consent is the basis for processing

The Controller remains primarily responsible for receiving and responding to Data Subject requests.

In the event of a confirmed Personal Data breach affecting customer information, BLOKOFY shall notify the Controller without undue delay wherever such notification is required under applicable law.

Notifications may include, to the extent available at the time:

• ◆Nature and scope of the incident
• ◆Categories and approximate volume of affected data
• ◆Measures already taken to contain or mitigate the breach
• ◆Recommended mitigation steps for the Controller

Personal Data shall be retained only as long as necessary to:

• ◆Provide the contracted Services
• ◆Meet applicable legal and regulatory obligations
• ◆Resolve disputes and enforce agreements
• ◆Maintain platform security and audit trails

Upon termination of the Services, Personal Data may be securely deleted or anonymized unless retention is required by applicable law or regulatory authority.

Upon reasonable written request and where legally appropriate, BLOKOFY may provide information or documentation demonstrating compliance with applicable privacy and security obligations under this DPA.

Any audit requests must be reasonable in scope and frequency, provided with adequate advance notice, and must not compromise the security, confidentiality, or availability of services provided to other customers.

Nothing in this DPA expands either party's liability beyond the limitations established in the applicable Terms of Service, unless otherwise required by applicable law.

Each party's liability under this DPA shall be subject to the exclusions and caps set forth in the Terms of Service to the fullest extent permitted by law.

This DPA shall be interpreted in accordance with the applicable data protection laws governing the relationship between the parties, including where relevant: UK GDPR, EU GDPR, and the Brazilian LGPD.

Mandatory legal rights available to Data Subjects under applicable law remain unaffected by this DPA.

BLOKOFY may update this Data Processing Agreement periodically to reflect legal, technical, or operational changes. Updated versions become effective upon publication on this website unless otherwise required by applicable law.

We encourage you to review this page periodically. The Effective Date at the top of this document indicates the most recent revision.

Questions or requests regarding this Data Processing Agreement may be directed to: