Schedule 2 to the Terms of Sale — Data Processing Agreement (DPA)

1. Purpose and articulation

This data processing agreement (the “Agreement” or “DPA”) is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (the “GDPR”). It constitutes Schedule 2 to the Terms of Sale and forms an integral part of them.

It governs the processing of personal data carried out by the Publisher on behalf of the Customer, where the Customer submits to the Service data for which it is the controller, in particular via the Factur-X tool.

It does not apply to the processing for which the Publisher is itself the controller (account management, billing, security), which falls under the Privacy Policy.

In the event of a conflict, this Agreement prevails over the Terms of Sale and the Terms of Use as regards the protection of data processed on behalf of the Customer.

2. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them by the GDPR.

• Customer (controller): the professional holding the Account, who determines the purposes and means of the processing of the data it submits to the Service.
• Publisher (processor): Maxence-Olivier Parlant, sole trader, identified in the Legal notice.
• Sub-processor: any third party engaged by the Publisher to carry out specific processing activities on behalf of the Customer.

3. Roles of the parties

The Customer acts as the controller (or as a processor of its own client). It warrants that it has a legal basis and the necessary rights over the data it submits, and that submitting it to the Service is lawful.

The Publisher acts as the processor. It processes the data only on the documented instructions of the Customer, under the terms of this Agreement, and does not determine the essential purposes or means beyond what is described here.

4. Description of the processing

5. Customer's instructions

The Publisher processes the data only on the basis of the Customer's documented instructions, which consist of the Terms of Use, the Terms of Sale, this Agreement and the use of the Tools as documented.

The Publisher informs the Customer if it considers that an instruction constitutes an infringement of the GDPR or of another applicable data protection provision. If the Publisher is required by Union or Member State law to carry out processing beyond the instructions, it informs the Customer before the processing, unless legally prohibited.

6. Confidentiality

The Publisher ensures that persons authorised to process the data are bound by an obligation of confidentiality. Access to the data is limited to persons who need it to perform the service.

7. Security of processing

Taking into account the state of the art and the risks, the Publisher implements appropriate technical and organisational measures, in particular:

• No retention of submitted documents: neither the incoming document nor its structured content is retained. Only a cryptographic hash of the input and the response issued, stored encrypted, are recorded in the audit log.
• Encryption at rest of the audit trails using a key specific to each account (envelope encryption, AES-256-GCM), with the master key kept outside the database.
• Encryption of communications in transit.
• Hashing and salting of authentication secrets (passwords, API keys, tokens), never stored in clear text.
• Append-only audit log chained by cryptographic hash, allowing any subsequent tampering to be detected.
• Minimisation: no audience-measurement tools, no third-party trackers and no third-party dependencies in the browser other than the payment provider.

The detail and limits of these measures are set out in Schedule 1 and in the Privacy Policy. The Customer acknowledges that the response may contain, in its anomaly messages, values extracted from the submitted document, encrypted at rest but transmitted in clear text to the Customer at the time of the response.

8. Sub-processors

The Customer authorises the Publisher to engage the following sub-processors:

The Publisher imposes on each sub-processor, by contract, data protection obligations substantially equivalent to those of this Agreement. The Publisher remains fully liable to the Customer for the performance by those sub-processors of their obligations.

In the event of a change (addition or replacement of a sub-processor), the Publisher informs the Customer by a reasonable means and in advance, giving the Customer the opportunity to raise a reasoned objection on grounds relating to data protection. Failing a solution, the Customer may terminate the Subscription concerned.

9. Duration and fate of the data

The submitted content is not retained beyond the processing of the request.

The audit trails are retained for ten (10) years (Article 6 of Schedule 1). Their erasure is carried out by destruction of the encryption key specific to the account, which renders the trails permanently undecryptable while preserving the integrity of the chain — a method accepted as equivalent to erasure.

At the end of the contractual relationship, and at the Customer's request, the Publisher erases the data processed on its behalf, subject to the legal retention obligations that apply to the Publisher. This operation is currently carried out manually.

10. Assistance to the Customer

Taking into account the nature of the processing, the Publisher assists the Customer, insofar as possible and by appropriate measures, in:

• responding to requests to exercise data subjects' rights (access, rectification, erasure, restriction, objection, portability);
• ensuring compliance with its obligations regarding security, breach notification and, where applicable, impact assessment and prior consultation (Articles 32 to 36 of the GDPR).

Where a data subject addresses a request directly to the Publisher concerning data processed on behalf of the Customer, the Publisher forwards that request to the Customer as soon as possible and does not respond to it itself, unless otherwise instructed by the Customer.

11. Personal data breach

The Publisher notifies the Customer of any personal data breach concerning the data processed on its behalf, as soon as possible after becoming aware of it, and provides it with the information reasonably available to enable it to meet its own notification obligations.

12. Transfers outside the European Union

The data is hosted in the European Union (Ireland) and in the United Kingdom (London, a country recognised as adequate by the European Commission). Any access from a third country is governed by the European Commission's standard contractual clauses and the safeguards specific to each sub-processor, under the conditions of §7 of the Privacy Policy.

13. Audit and provision of information

The Publisher makes available to the Customer the information reasonably necessary to demonstrate compliance with the obligations of this Agreement. The Customer may request, at most once a year and at its own expense, the disclosure of documentary evidence attesting to compliance, subject to reasonable notice, confidentiality and the preservation of the security of the Service and of other customers.

14. Liability

The Publisher's liability under this Agreement is subject to the limits and caps set out in §14 of the Terms of Use and §10 of the Terms of Sale, to the extent permitted by applicable law.

15. Duration of the Agreement

This Agreement applies throughout the duration of the provision of the Tools to the Customer and, as regards the retention and erasure of the audit trails, until the expiry of the periods provided for in Article 9.