Data Processing Addendum
Last updated: October 12, 2026
Customer and Greenflow responsibilities for processing personal data to issue and manage NFS-e.
1. Scope and relationship with the Terms
This Addendum forms part of the Terms of Service where Greenflow Desenvolvimento de Software LTDA, CNPJ 61.469.487/0001-40, processes personal data on the customer’s behalf through Corvo. It covers processing needed to issue and manage NFS-e. For that processing, this Addendum prevails over conflicting general Terms. Data Greenflow processes as an independent controller is described in the Privacy Notice.
2. Roles and instructions
The customer acts as controller or represents that the controller has authorized it to provide data and instructions. Greenflow acts as processor and processes data to provide, protect and support the Service under the contract, workspace settings and lawful documented instructions. If an instruction appears incompatible with data-protection law, Greenflow will notify the customer and may suspend the affected operation while the issue is clarified.
3. Data categories and subjects
Processing may involve workspace representatives and members, service providers and customers, contacts and other people identified in fiscal documents. Data includes names, CPF or CNPJ tax identifiers, registrations, addresses, emails, service descriptions, amounts, taxes, fiscal identifiers and statuses, XML, PDF, webhook configurations and events and operational records. Certificates and passwords submitted for signing are also processed to execute authorized operations. Customers must limit submissions to necessary data and avoid sensitive personal data without an appropriate need and lawful basis.
4. Purpose, operations and duration
Operations include receipt, validation, signing, transmission to fiscal systems, result queries, document storage and access, delivery by email and webhook and operational support. Processing continues during the Service and afterwards only while there is a lawful basis for retention or to complete applicable return or deletion. Test environment data should be fictitious wherever possible.
5. Customer duties
The customer is responsible for the lawful basis, transparency to data subjects, authority to act for issuer companies and accuracy of submitted data. It must configure permissions, protect credentials, verify email and webhook destinations and respond to data-subject requests under its responsibility. If acting for another controller, it must ensure its instructions and this engagement are authorized by that controller.
6. Confidentiality and security
Greenflow will limit access to those who need to process data to provide the Service and require confidentiality duties. It will maintain technical and organizational measures appropriate to the processing, including access controls, workspace and environment separation, API-key hashes, encryption of stored certificates and signed webhooks. Customers must also secure their own integrations.
7. Subprocessors and recipients
The customer authorizes providers needed for infrastructure, storage, email, monitoring and support, subject to data-protection obligations appropriate to the service provided. Information about these providers may be requested through the privacy contact. Material changes affecting processing will be communicated where applicable, and the customer may submit a reasoned objection for assessment. Tax authorities receive data for their statutory responsibilities; they are not automatically Greenflow’s subprocessors. Customers define email and webhook destinations.
8. Assistance and incidents
Considering the nature of processing and available information, Greenflow will provide reasonable assistance with data-subject rights, risk assessment and data-protection obligations. Upon becoming aware of an incident affecting personal data processed on the customer’s behalf, it will notify the customer without undue delay with available information and necessary updates. The controller remains responsible for assessing and making notifications to the authority and data subjects within statutory deadlines, without excluding Greenflow’s own obligations.
9. Return, deletion and retention
Upon Service termination, the customer may request access, export or deletion of personal data under its responsibility through the privacy contact. Greenflow will comply with lawful instructions under contracted conditions and applicable law. Data requiring retention on a lawful basis will have access restricted to the corresponding purpose; backup deletion will follow the maintenance cycle and applicable obligations. The customer must retain copies of fiscal documents required for its activity. Account closure does not cancel documents with the tax authority.
10. International transfers and contact
Where processing involves an international transfer, the parties must follow the mechanisms and safeguards required by the LGPD and applicable regulations. This Addendum alone does not replace standard contractual clauses or another instrument required for a specific transfer. Send requests about instructions, providers, security measures or transfers to legal@corvo.tech.