Data processing agreement (DPA)

1. Subject matter, nature and purpose

Provision of a cybersecurity platform: protection, inventory, updating and monitoring of the Controller's devices, incident detection and response, compliance reports and, depending on the options, email security.

2. Categories of data and data subjects

• Data subjects: employees, managers and users of the Controller's devices; email correspondents for K-Mail.
• Data: identifiers and user names, device names and characteristics, software inventory, DNS logs, security events, fingerprints and, with explicit consent, file samples, metadata and content of analysed emails (K-Mail).
• No special categories of data are sought; their incidental presence in analysed content is handled with the same safeguards.

3. Duration

The agreement applies for the entire duration of the subscription and until the data is deleted at its end.

4. Processor's obligations

• process the data only on documented instructions from the Controller, including with regard to transfers, unless required to do so by Union or Member State law, in which case it informs the Controller beforehand;
• ensure the confidentiality of the persons authorized to process the data;
• implement the security measures described in article 5;
• assist the Controller in responding to requests to exercise rights and in meeting its obligations under articles 32 to 36 of the GDPR, including its impact assessments and prior consultation of the supervisory authority;
• remain fully liable to the Controller for the performance of the obligations of its subprocessors;
• immediately inform the Controller if an instruction appears to it to infringe the regulations.

5. Security measures

• hosting of customer data in the European Union [À VALIDER : nom de l'hébergeur];
• encryption in transit (TLS 1.3) and at rest, with keys specific to each customer;
• customer isolation through systematic filtering and row-level security rules in the database;
• mutual authentication of agents, signed commands and updates, replay protection;
• strong authentication, least privilege and an audit log of internal access;
• retention periods applied automatically; encrypted backups.

6. Sub-processors

The Controller gives general authorisation for the use of the sub-processors listed on the Sub-processors page. The Processor informs the Controller of any addition or replacement at least 30 days in advance; the Controller may object on legitimate grounds and, failing agreement, terminate without penalty. Each sub-processor is subject to equivalent obligations.

7. Data breaches

The Processor notifies the Controller of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information needed for the Controller's own notification to the supervisory authority. [À VALIDER : délai]

8. Audits

The Processor makes available the information necessary to demonstrate compliance with this agreement and allows audits, at most once a year unless there is an incident, with reasonable notice and with respect for the confidentiality of other customers.

9. End of contract

At the end of the subscription, the Processor allows data export for 30 days and then, at the Controller's choice, returns the data to it or deletes it, together with any copies, unless retention is required by law.

10. Transfers

Customer data is intended to be hosted in the European Union. Only the subprocessors identified as established outside the EU on the Subprocessors page (sending of transactional emails and, if enabled, optional services such as Kayzen Copilot) may receive data, under the safeguards of articles 45 or 46 of the GDPR (adequacy decision or standard contractual clauses).