Accordo sul trattamento dei dati personali (articolo 28 del GDPR)

1. Parties and purpose

This data processing agreement (“DPA”) is entered into between the Customer, acting as controller, and Tyche Informatique, 7 rue du 19 mars, Celles-sur-Durolle 63250, SIREN 939118527, publisher of Socle, acting as processor (the “Publisher”). It forms an integral part of the Terms of Sale and is accepted together with them.

It sets out the conditions under which the Publisher processes, on behalf of the Customer, the personal data that the Customer and its members store in the service, in accordance with Article 28 of Regulation (EU) 2016/679 (the “GDPR”).

2. Description of the processing

• Nature and purpose: hosting, storage, synchronization, sharing and display of the Customer’s content (projects, documents, files, calendars, messages, mockups, models), solely to provide the service;
• Duration: the term of the subscription, then the deletion period set out in section 10;
• Categories of data subjects: members of the Customer’s organization, guests, the Customer’s clients with portal access, and any person whose data the Customer stores;
• Categories of data: users’ identification and contact data, and any data the Customer chooses to store in its content. The Customer undertakes not to store health data or other special categories of data within the meaning of Article 9 GDPR without the Publisher’s prior written consent.

A large part of the content is end-to-end encrypted: the Publisher stores such data in encrypted form that it cannot read.

3. Customer’s instructions

The Publisher processes data only on documented instructions from the Customer. The Terms of Sale, this DPA and the Customer’s use of the service’s features constitute those instructions. The Publisher informs the Customer if it considers that an instruction infringes the law; it may then suspend its execution.

The Customer warrants that it has a legal basis for the processing it entrusts, that it has informed the data subjects and that it complies with its own obligations as controller.

4. Confidentiality

The Publisher ensures that persons authorized to process the data are bound by confidentiality.

5. Security

The Publisher implements appropriate technical and organizational measures, taking into account the state of the art, costs and its size, including:

• end-to-end encryption of messages, calls, files and documents, with keys held by users;
• encryption of data in the database (AES-256-GCM) and of files on disk, HTTPS for all traffic;
• hashed passwords (Argon2id), two-factor authentication available, revocable sessions;
• rate limiting, security log, regular updates, backups.

The Customer is responsible for the security of its own devices and credentials and for the configuration of its shares.

6. Sub-processors

The Customer gives the Publisher general authorization to engage sub-processors. At the date of this DPA, they are: the host named in the legal notice (Tyche Service, 15b chemin du bray, Annecy-le-vieux 74940, 07.68.79.70.91) and browser notification services (Google, Mozilla, Apple, Microsoft), which only receive encrypted notifications without message content.

The Publisher informs the Customer of any addition or replacement at least fifteen (15) days in advance by updating this list or by message. The Customer may object on legitimate grounds by cancelling its subscription before the change takes effect, which is its sole remedy. The Publisher imposes equivalent data protection obligations on its sub-processors.

7. Transfers outside the European Union

Data is hosted in the European Union. Only encrypted push notifications pass through browser vendors’ services, which may be located outside the Union and are covered by the Data Privacy Framework or standard contractual clauses.

8. Assistance to the Customer

Taking into account the nature of the processing, the Publisher assists the Customer, insofar as possible, in responding to data subject requests, mainly through the service’s features (export, rectification, deletion). On request and within the limits of the information available to it, it provides information useful for a data protection impact assessment. Any assistance beyond these features or requiring significant work may be invoiced on a time basis.

9. Personal data breach

The Publisher notifies the Customer of any personal data breach affecting it without undue delay and no later than forty-eight (48) hours after becoming aware of it, with the information available. Notification to the supervisory authority and to data subjects is the Customer’s responsibility.

10. End of the contract

At the end of the contract, the Customer exports its data using the service’s features. The Publisher then deletes the data within thirty (30) days at most, unless the law requires it to be kept; backups are erased as they are normally rotated.

11. Audits

The Publisher makes available to the Customer the information needed to demonstrate compliance with this DPA, primarily in the form of documentation. The Customer may, at most once a year and with thirty (30) days’ prior written notice, have an audit carried out at its own expense by an independent auditor bound by confidentiality and not a competitor of the Publisher, during business hours and without disrupting the service; the audit may not cover other customers’ data. The Publisher’s time spent on the audit may be invoiced.

12. Liability

Each party is liable for its own breaches of the GDPR. The Publisher’s liability under this DPA is subject to the limitations and exclusions set out in the Terms of Sale.

13. Term and governing law

This DPA applies for the entire term of the subscription and for as long as the Publisher holds Customer data. It is governed by French law under the same conditions as the Terms of Sale. A signed copy can be provided on request to data@tyche-info.fr.