FLOX Data Processing Addendum
Last updated: 14 November 2026. Effective from: 14 November 2026.
Version 1.0 | 14 November 2026
1. About this Addendum
1.1 This Data Processing Addendum forms part of the FLOX Platform Terms between VCL Trading Europe Limited ("VCL") and the business or other organisation contracting to use the FLOX Platform (the "Customer"). It takes effect when incorporated into that agreement through acceptance or its applicable variation procedure. No separate signature is required.
1.2 This Addendum applies only where VCL processes personal data on the Customer's behalf and on its documented instructions ("Customer Personal Data"). The relevant services include customer-directed Wingman account memory, operational assistance, inventory analysis, forecasting and other Platform functions that process personal data on that basis (the "Processing Services"). Schedule 1 describes the processing.
1.3 This Addendum does not govern processing for which VCL independently determines the purposes and essential means. This may include VCL's own account administration, contracting, billing, fraud prevention, regulatory compliance and platform security activities. VCL's controller processing is described in the FLOX Privacy Policy. The classification depends on the particular processing activity, not simply on where data is stored or which Platform function uses it. Nothing in this Addendum authorises VCL to repurpose Customer Personal Data for its own independent purposes.
1.4 In this Addendum:
- Data Protection Laws means the UK GDPR, the Data Protection Act 2018 and other applicable data protection legislation, including the EU GDPR where it applies to the processing, in each case as amended or replaced.
- UK GDPR means Regulation (EU) 2016/679 as it forms part of UK law. EU GDPR means Regulation (EU) 2016/679 as it applies in the European Union.
- Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data.
- Sub-processor means a third party engaged by VCL or another Sub-processor to process Customer Personal Data in providing the Processing Services.
The terms controller, processor, personal data, processing and data subject have their meanings under the applicable Data Protection Laws. Other capitalised terms have the meanings given in the Platform Terms.
2. Roles and documented instructions
2.1 The Customer is the controller and VCL is its processor. Where the Customer acts as a processor for another controller, VCL acts as the Customer's sub-processor. The Customer must have authority to give the instructions and authorisations in this Addendum and must pass relevant notices and information to that controller.
2.2 Each party will comply with the Data Protection Laws applicable to its activities. The Customer determines the purposes of the processing and the personal data submitted. VCL may determine the technical arrangements needed to provide the Processing Services without using Customer Personal Data for a different purpose.
2.3 VCL will process Customer Personal Data only on documented instructions, including instructions concerning international transfers. Those instructions comprise this Addendum, the applicable agreement, the Customer's authorised use and configuration of the Processing Services and any further written instructions consistent with their scope. An instruction requiring a change to the agreed services may require a separate agreement, but this will not restrict the Customer's statutory rights.
2.4 If VCL considers that an instruction infringes Data Protection Laws, it will inform the Customer immediately and suspend the affected processing until a lawful instruction is established.
2.5 Where processing beyond the Customer's instructions is required by UK law or, where the EU GDPR applies, EU or Member State law, VCL will inform the Customer of that legal requirement before processing unless that law prohibits notification on important grounds of public interest. Other overseas demands do not, by themselves, authorise disclosure contrary to Data Protection Laws or the applicable transfer safeguards.
3. VCL's obligations
3.1 Confidentiality and security
VCL will restrict access to people who need it to perform their duties and who are bound by contractual confidentiality obligations or an appropriate statutory duty of confidentiality. VCL will implement and maintain the technical and organisational measures in Schedule 2 and the measures required by Article 32 of the applicable GDPR. Measures may evolve, but VCL will not materially reduce the overall protection of Customer Personal Data.
3.2 Account separation and AI use
VCL will keep Customer Personal Data logically separated between Accounts. It will not disclose one Account's Customer Personal Data to another Account or combine identifiable data between Accounts for another customer's benefit. This does not prevent a specific exchange expressly instructed by the Customer as part of an agreed service.
VCL will neither use Customer Personal Data to train, fine-tune or improve AI models nor permit an AI provider to do so. Account-specific memory and retrieval used to provide the Customer's service are not model training and remain subject to this Addendum. VCL will send AI providers only the information needed for the relevant request and will apply the routing, retention and access restrictions in Schedule 2.
Z.ai is not an authorised recipient of Customer Personal Data. VCL will not send Customer Personal Data to Z.ai directly or through an intermediary, automated routing or fallback arrangement.
3.3 Assistance with individual rights and compliance
Taking account of the nature of the processing and the information available to it, VCL will provide appropriate technical and organisational assistance with the Customer's obligations concerning individual rights, security, breach notification, data protection impact assessments and prior consultation with supervisory authorities under Articles 32 to 36 of the applicable GDPR.
VCL will promptly forward requests from individuals concerning Customer Personal Data to the Customer. It will not substantively respond on the Customer's behalf without instructions unless legally required. It may acknowledge receipt or direct the individual to the Customer. VCL will provide assistance in time to enable the Customer to meet applicable statutory deadlines.
3.4 Personal Data Breaches
VCL will notify the Customer without undue delay and, in any event, within 48 hours after becoming aware of a Personal Data Breach. Notification will go to the Customer's nominated security contact or, if none is nominated, its registered Account administrator.
The initial notice will include the information then available about the nature of the breach, the affected data and individuals, likely consequences, containment or remedial measures and a contact for further information. VCL will not delay notification while investigating or awaiting complete information. It will provide further information in phases without undue delay, take reasonable steps to contain and remedy the breach and cooperate with the Customer's response.
The Customer remains responsible for its own notifications to regulators and individuals. This does not remove any notification obligation imposed directly on VCL by law.
3.5 Records, information and audits
VCL will maintain the processing records required by law and make available all information necessary to demonstrate compliance with Article 28 and this Addendum. VCL will allow and contribute to audits and inspections by the Customer or an independent auditor appointed by it.
For routine assurance, the parties will first use relevant documentation, security responses and any available independent reports. These do not replace an audit where they are insufficient. Routine audits may normally be conducted once in any 12-month period on at least 30 days' written notice, during business hours and subject to reasonable confidentiality and security arrangements.
Those frequency and notice restrictions do not apply where an additional or earlier audit is reasonably necessary following a Personal Data Breach, a substantiated compliance concern or a requirement of a supervisory authority or applicable law. Audits must avoid unnecessary disruption and protect other customers' information. No arrangement may prevent effective verification of compliance.
The Customer bears its external audit costs. VCL bears its own cooperation costs and the cost of correcting deficiencies for which it is responsible. These arrangements do not limit a supervisory authority's powers.
4. Sub-processors
4.1 The Customer gives general written authorisation for the Sub-processors in Schedule 3, to the extent relevant to the Processing Services it uses. VCL will maintain an accurate record of the entities, activities, processing locations and contractual chain involved and make that information available to the Customer on request.
4.2 Before allowing a Sub-processor to process Customer Personal Data, VCL will assess its suitability and ensure that a binding written agreement imposes equivalent data protection obligations, including appropriate security, confidentiality, assistance, deletion and restrictions on further subcontracting. These requirements apply throughout the processing chain. VCL remains responsible to the Customer for its Sub-processors' performance of those obligations.
4.3 Value Chain Lab Ltd may provide group technology services and administer AI provider accounts as VCL's Sub-processor. VCL will ensure that a written intra-group processing agreement is in place before the parent company processes Customer Personal Data on its behalf. Group membership does not remove these requirements.
4.4 VCL will give the Customer at least 30 days' advance notice of an intended addition or replacement of a Sub-processor or a material change to the countries in which Customer Personal Data is processed or accessed. Notice will be sent by email to the Account administrator or nominated contact and may also be displayed in the Platform. It will identify the change, processing activities, relevant countries and applicable transfer safeguards. These requirements also apply to relevant changes further down the processing chain.
4.5 The Customer may object during that period on reasonable data protection grounds. VCL will work with the Customer to resolve the objection. Until it is resolved, VCL will not make the affected Customer Personal Data available through the disputed arrangement. If no reasonable alternative is available, either party may terminate the affected Processing Service without an early termination charge. VCL will refund prepaid fees attributable to the unused period of that service. Unaffected services may continue.
4.6 A supplier's published list or a routing platform's catalogue does not, by itself, authorise new recipients or override the notice, objection and transfer requirements in this Addendum. VCL will suspend the affected processing rather than use an arrangement that cannot meet them.
5. International transfers
5.1 VCL will make or permit a restricted international transfer of Customer Personal Data only on documented instructions and with the protection required by Data Protection Laws. This includes relevant remote access from another country and onward transfers by Sub-processors.
5.2 For transfers subject to the UK GDPR, VCL will ensure that the transfer is covered by applicable UK adequacy regulations or a properly completed and binding UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses or another legally permitted Article 46 safeguard. Reliance on a recognised data protection framework is limited to recipients and processing actually covered by that framework.
5.3 Where appropriate safeguards rather than adequacy are used, VCL will complete and document the required transfer risk assessment, including the UK data protection test, before the transfer. It will assess relevant onward transfers and access risks, implement necessary supplementary measures and reassess when circumstances materially change. VCL will suspend a transfer if adequate protection cannot be maintained.
5.4 Where the EU GDPR applies, transfers from the European Economic Area to VCL in the United Kingdom may rely on an applicable European Commission adequacy decision for as long as it covers the transfer. For transfers not covered by adequacy and for relevant onward transfers, the parties will ensure that a valid Chapter V mechanism is in place, including the appropriate EU Standard Contractual Clauses where required, together with the necessary transfer assessment and supplementary measures. Processing will not continue in reliance on an invalid or inapplicable mechanism.
5.5 The exporter and importer in the actual contractual chain must be bound by the required safeguards. This Addendum does not itself execute an IDTA, UK Addendum or EU Standard Contractual Clauses. VCL will provide information about the safeguards and relevant assessments on request, subject to proportionate redaction of confidential information.
6. Customer obligations
6.1 The Customer will establish a lawful basis, give the required privacy information and obtain any necessary permissions for the processing it instructs. It will submit only data reasonably needed for the Processing Services, maintain appropriate accuracy and ensure that its Authorised Users follow its instructions and access policies.
6.2 The Processing Services are not intended to process special category personal data under Article 9 or criminal conviction and offence data under Article 10. The Customer must not submit such data. If either party discovers that it has been submitted, it will notify the other and cooperate in restricting, removing or returning it securely. This restriction does not remove VCL's obligations for data it actually receives.
6.3 The Customer will maintain current administrator and security contact details and promptly communicate requests or instructions requiring action by VCL. Where the Customer acts for another controller, it will obtain the necessary authorisations for VCL, the Sub-processors and international transfers covered by this Addendum.
7. Anonymisation and aggregated data
7.1 VCL may anonymise Customer Personal Data to carry out the Customer's documented instructions, including producing reports and statistics for that Customer. Anonymisation is itself processing and remains subject to this Addendum until effective anonymisation is achieved.
7.2 Data is anonymous only where individuals are no longer identifiable, directly or indirectly, taking account of the means reasonably likely to be used by VCL or another person. Removing names, substituting identifiers or aggregating records does not necessarily meet that standard. Pseudonymised information remains Customer Personal Data where it remains personal data under applicable law.
7.3 Once information is genuinely anonymous, VCL may use the resulting statistics as permitted by the Platform Terms and its confidentiality obligations. VCL will not attempt to re-identify individuals or disclose a Customer's identifiable confidential business information through those statistics.
7.4 This Addendum does not authorise independent analytics, marketing or model development using Customer Personal Data. Where VCL proposes processing for an independent controller purpose, including anonymisation for that purpose, it must first establish a lawful basis, provide the required transparency and satisfy the applicable controller obligations. A general licence to use data in the Platform Terms does not override this section or section 3.2.
8. Return, deletion and retention
8.1 When the relevant Processing Services end, the Account closes or the Customer gives an earlier lawful instruction, VCL will, at the Customer's choice, return or securely delete the affected Customer Personal Data without undue delay and within 90 days. Where the Customer chooses return, VCL will provide the data in a commonly used machine-readable format and delete its active-system copies within that same period. In the absence of a return instruction, VCL will delete the data. These time limits do not extend a shorter statutory deadline or delay assistance with an individual's rights.
8.2 Deletion covers source records, prompts, outputs, account memory, derived records, retrieval indexes and other copies containing Customer Personal Data within the affected processing. VCL will instruct relevant Sub-processors accordingly and provide written confirmation of completion on request.
8.3 Residual backup copies will be isolated from routine use and deleted or irreversibly overwritten on the next scheduled deletion cycle, no later than 180 days after deletion from active systems. Pending deletion, they remain protected by this Addendum and may be accessed only for necessary recovery or legal compliance. If a backup is restored, VCL will reapply the relevant deletion instructions before the restored data returns to routine use. Backup restoration must not restart the retention period.
8.4 Where applicable law requires continued storage, VCL will retain only the data required, restrict its use to that legal purpose and delete it when the requirement ends. VCL will inform the Customer of the legal basis and applicable retention period unless prohibited by law.
8.5 Records lawfully held by VCL as an independent controller are subject to the Privacy Policy and the applicable retention requirements for that separate purpose. VCL will not reclassify processor data merely to avoid a deletion instruction. This Addendum continues to protect Customer Personal Data until it is returned or deleted as required.
9. Liability, precedence and administration
9.1 The liability provisions of the Platform Terms apply to claims under this Addendum. Those claims count towards the applicable general aggregate liability cap rather than creating an additional cumulative cap. However, the cap applicable to VCL's liability for claims under this Addendum will be no less than £10,000, including where the Customer pays no FLOX fees. No general exclusion of liability will exclude all liability for failure to perform VCL's express obligations under this Addendum.
9.2 Nothing in this Addendum limits liability that cannot lawfully be limited, an individual's rights to compensation under Data Protection Laws, a supervisory authority's powers or any mandatory statutory right of contribution. The allocation of contractual liability between VCL and the Customer does not restrict VCL's obligations to comply with Data Protection Laws.
9.3 If this Addendum conflicts with the Platform Terms, it prevails for the processing of Customer Personal Data. Any mandatory terms of an applicable international transfer instrument prevail over both documents. The law of England and Wales and the dispute resolution provisions of the Platform Terms apply, subject to mandatory data protection rights and transfer provisions.
9.4 Requests, objections and notices under this Addendum may be sent to info@flox.is, identifying the Customer's Account and the nature of the request. VCL may require proportionate verification of the sender's authority. VCL's address is Marlborough House, 298 Regents Park Road, London, N3 2SZ, United Kingdom.
9.5 Changes to this Addendum take effect through the applicable contractual variation procedure, not merely by replacing the webpage. Changes to Sub-processors and processing locations are also subject to section 4. No amendment may remove a protection required by Data Protection Laws.
Schedule 1. Processing details
| Item | Description |
|---|---|
| Subject matter | The customer-directed Processing Services selected or enabled by the Customer. |
| Duration | For the period those services are provided and the limited return, deletion or legally required retention periods in section 8. |
| Nature and purpose | Receiving, storing, organising, analysing, summarising and retrieving customer records; maintaining account-specific memory; generating operational notifications, calculations, drafts and suggestions; and providing the support, security and deletion necessary for those services, on the Customer's behalf. |
| Types of personal data | Names and business contact details; delivery and collection addresses and contact names; records concerning orders, consignments and inventory that relate to identifiable people; identifiers, permissions and activity records required for the Processing Services; user instructions, submitted content and generated outputs that contain personal data; and account-specific preferences or derived memory about identifiable people. |
| Categories of individuals | The Customer's staff and Authorised Users; the Customer's customers, suppliers and consignees and their personnel; drivers and site contacts whose information the Customer is authorised to submit. |
| Special category and criminal offence data | Not permitted, as explained in section 6.2. |
| Frequency | As required by the Customer's use, configuration and documented instructions. |
| Customer rights and obligations | The rights to give lawful instructions, receive assistance and information, object to Sub-processors, audit compliance and choose return or deletion, together with the obligations set out in this Addendum. |
Schedule 2. Technical and organisational measures
VCL will implement and maintain the following measures for the Processing Services. These are contractual requirements, not a representation that VCL holds any particular security certification.
| Area | Required measures |
|---|---|
| Account separation | Logical separation of Accounts; account-scoped permissions and queries; controls against unauthorised cross-account access, retrieval or disclosure. |
| Access management | Least-privilege access; role-based permissions; individual staff identities; multi-factor authentication for staff access to production systems and databases; access review and prompt removal when no longer needed. |
| Encryption | Encryption of Customer Personal Data in transit over public networks and at rest in managed production stores and backups, using recognised encryption mechanisms; restricted access to keys and credentials. |
| Logging | Records sufficient to attribute material administrative access and data-changing actions to the relevant identity; protected logs and proportionate monitoring of suspicious activity. |
| Backup and recovery | Protected backups, controlled recovery procedures and periodic restoration testing proportionate to risk; documented retention and deletion consistent with section 8. |
| Vulnerability management | Security updates, vulnerability assessment, risk-based remediation and controlled changes to production systems; separation of development and production access. |
| AI processing | Data minimisation; approved providers and endpoints; contractual no-training restrictions; zero-data-retention settings where available for the selected feature; controlled access to prompts and outputs; and no routing or fallback to an unauthorised recipient. Non-zero retention must be necessary, documented and consistent with this Addendum. |
| Incident response | Documented procedures to identify, investigate, contain and remedy incidents; preservation of relevant evidence; escalation and Customer notification under section 3.4. |
| Personnel | Confidentiality obligations and proportionate data protection and information security training for personnel with relevant access. |
| Supplier assurance | Assessment of relevant Sub-processors, binding processing terms and transfer safeguards; review when services, risks or processing arrangements materially change. |
| Review and disposal | Regular assessment of the effectiveness of security measures; secure deletion and disposal; prompt correction of material control deficiencies. |
Schedule 3. Authorised Sub-processors
The following entities are authorised only to the extent that their services process Customer Personal Data for the Processing Services. Listing a provider does not mean that every Customer's data is sent to it. Self-hosted software does not make its developer a Sub-processor unless that developer actually receives or accesses Customer Personal Data.
The establishment locations below identify the suppliers, not a promise that all processing occurs in those countries. Hosting, support and downstream processing locations depend on the services used and are subject to sections 4 and 5. VCL will maintain and provide the service-specific location information required by section 4.1. This Addendum does not promise exclusively UK or EEA data residency.
| Entity | Authorised service | Establishment location |
|---|---|---|
| Value Chain Lab Ltd | Group technology services, platform maintenance and administration of AI provider arrangements on VCL's behalf. | United Kingdom |
| Google Cloud EMEA Limited | Cloud hosting, managed infrastructure and related technical support. | Ireland |
| Anthropic Ireland, Limited | Provision and administration of contracted AI services used by Wingman and other Processing Services. | Ireland |
| Anthropic, PBC | AI inference and associated service operations through authorised Anthropic arrangements. | United States |
| OpenRouter, Inc. | Routing AI requests to the approved model providers covered by this schedule or subsequently authorised under section 4. | United States |
| Inversoft, LLC, trading as FusionAuth | Identity and access management where its hosted service or authorised support receives Customer Personal Data. | United States |
| Noti-Fire Apps Ltd, trading as Novu | Notification infrastructure where its hosted service or authorised support receives Customer Personal Data. | Israel |
Supplier processing information
The following disclosures provide information about the suppliers' processing arrangements and downstream providers. They supplement this schedule but do not replace VCL's contractual obligations:
- Google Cloud: Cloud Data Processing Addendum and Google Cloud Sub-processors.
- Anthropic: Legal Centre and Trust Centre.
- OpenRouter: Enterprise agreement and Data Processing Addendum and Privacy Policy.
- FusionAuth: Customer Licence Agreement and Trust Centre.
- Novu: Data Processing Agreement and Trust Centre.
Authorisation extends only to downstream processors actually needed for the listed services and engaged in accordance with section 4. It does not authorise all models or providers available through OpenRouter, unrelated use of Customer Personal Data or transfers without the safeguards in section 5. Z.ai is excluded from this authorisation.