Data processing agreement

1. Purpose and definitions

The Agreement sets the conditions under which the Processor processes, on behalf of and on instruction from the Controller, the personal data entered, imported or generated in the Service (the “Data”). “Personal data”, “processing”, “data subject” and “personal data breach” have the GDPR meaning.

If the Agreement conflicts with the other contract documents on personal data processing, the Agreement prevails.

2. Description of the processing

3. Controller’s instructions

The Processor processes the Data only on the Controller’s documented instructions, including for transfers outside the Union. The contract, the Service documentation, the Customer’s settings and its actions in the Service are its instructions.

If the Processor believes an instruction infringes the GDPR or other data protection rules, it informs the Controller immediately and may suspend that instruction.

4. Staff confidentiality

The Processor ensures that persons authorised to process the Data are bound by confidentiality, by contract or statute, and access it only as needed for their role.

5. Security measures

The Processor implements appropriate technical and organisational measures, taking into account the state of the art, costs, the nature of the Data and the risks, including:

• hosting in France with a leading provider;
• encrypted communications (TLS) and per-establishment encryption of secrets and credentials;
• logical segregation of each Controller’s data;
• two-factor authentication available, revocable sessions, per-user rights management;
• internal access limited to what is strictly necessary and logged;
• regular backups and a restoration procedure;
• a security-incident management procedure.

The Processor reviews these measures periodically. The Controller remains responsible for securing its own access (credentials, devices, connected third-party accounts).

6. Sub-processors

The Controller gives general authorisation to use the following sub-processors, necessary for the Service:

Some of these services (messaging, calendar, payment) are activated and administered by the Controller itself, linking them to its own account; it is then directly bound by their terms.

Reading and recognition of images and documents (text extraction by optical character recognition) are provided by a service developed and operated by Séjoria within its own hosting infrastructure. These operations are not entrusted to any sub-processor: uploaded images and documents are not sent to any third party for analysis.

The Processor informs the Controller in writing of any intended addition or replacement at least thirty (30) days in advance. The Controller may object on reasoned grounds within that period; failing agreement it may terminate the affected part of the contract free of charge. The Processor imposes on each sub-processor obligations equivalent to this Agreement and remains liable to the Controller for their performance.

7. Data subject rights and assistance

Considering the nature of the processing, the Processor helps the Controller, by appropriate measures (export, rectification, deletion in the Service), to respond to data subject requests. It forwards without delay any request it receives directly, without replying itself.

It also assists, as far as it can and on reasonable request, with security of processing, impact assessments and prior consultations of the supervisory authority.

8. Personal data breach

The Processor notifies the Controller of any breach affecting it without undue delay after becoming aware, and no later than forty-eight (48) hours. The notice describes, as far as possible, the nature of the breach, categories and approximate number of persons and records, likely consequences and measures taken or proposed.

It cooperates with the Controller, who decides on notifying the supervisory authority and data subjects.

9. Transfers outside the European Union

Data is hosted in the European Union. A transfer outside the Union may only occur in compliance with Chapter V GDPR: an adequacy decision, or standard contractual clauses with supplementary measures where needed.

Where the Controller itself connects a third-party service established outside the Union (messaging, calendar, payment), the resulting transfer follows from its choice and instructions.

10. Audit and documentation

The Processor makes available the information necessary to demonstrate compliance. The Controller may, once a year and unless an incident is established, have an audit carried out, by itself or a third party bound by confidentiality and not a competitor of the Processor, on at least thirty (30) days’ written notice, during business hours and without disrupting operations.

The audit is limited to what is relevant to the Controller’s Data and excludes access to other customers’ data. Audit costs are borne by the Controller; Processor time beyond one day is billed on quote.

11. End of contract: return and deletion

At the end of the contract, the Controller has thirty (30) days to export the Data. After that, the Processor deletes the Data from its production systems, then from backups according to their rotation cycle, which does not exceed ninety (90) days, unless retention is required by law.

On written request, the Processor certifies deletion.

12. AI Concierge and allocation of roles

The Controller determines the purposes and means of the processing carried out by the AI Concierge: it chooses the capabilities enabled, their permission level (allowed, confirmation required, forbidden) and the channels. The Processor performs the processing within that scope.

The Controller informs data subjects, where the law requires, that they are interacting with an automated system.

13. Controller’s obligations

The Controller warrants that the Data was collected lawfully, that it has informed data subjects and has a legal basis, that its instructions comply with the GDPR, and that it keeps its own record of processing. It informs the Processor of any change in its instructions likely to affect the processing.

14. Liability, term and governing law

The parties’ liability under the Agreement is governed by the terms of sale, without prejudice to the rights data subjects hold under Article 82 GDPR. The Agreement takes effect on account activation and lasts as long as the Processor processes Data.

It is governed by French law. For any question about the Agreement: contact@sejoria.com.