Subprocessor Change Communication Plan
| Owner | Flowdence Security and Legal |
| Applies to app | All Flowdence Marketplace cloud apps |
| Review cadence | Quarterly and whenever a subprocessor is added or replaced |
Purpose
Section titled “Purpose”Define how Flowdence notifies customers when subprocessors are added or replaced.
Baseline commitments
Section titled “Baseline commitments”- Maintain a public list of authorized subprocessors.
- Provide advance notice before material subprocessor changes.
- Provide a path for customer concerns and objections.
Notification timeline
Section titled “Notification timeline”- Target notice window: at least 30 days before a new subprocessor starts processing customer personal data.
Notification contents
Section titled “Notification contents”Each notice includes:
- Subprocessor legal name
- Processing location/region
- Service purpose and data categories
- Expected effective date
- Contact channel for questions or objections
Objection handling
Section titled “Objection handling”- Customers may raise concerns within 5 business days of notice.
- Flowdence will evaluate concerns in good faith and discuss reasonable mitigation options.
Publication and channels
Section titled “Publication and channels”- Public policy page on docs.flowdence.io
- Direct notice via support channel where required
Operational owner
Section titled “Operational owner”security@flowdence.io