Data Processing Agreement (DPA)

Translation

This document is a translation provided for information only. Only the French version is legally binding. To the French version.

Article 1 – Parties, purpose and scope

This agreement (the “DPA”) sets out the conditions under which HaiSoft processes personal data on behalf of its customers, in accordance with article 28 of Regulation (EU) 2016/679 (“GDPR”).

Between:

• HaiSoft SARL, with share capital of €250,000, RCS Orléans 451 475 651, registered office 7 rue Vieille Levée, 45100 Orléans, represented by Frédéric VAGNER, manager, acting both in its own name and under its trade names SG Autorépondeur and MailJump (hereinafter the “Processor”);
• the Customer, as identified in its customer area or on the order form (hereinafter the “Controller”).

Scope. The DPA applies to all HaiSoft services in the context of which HaiSoft hosts or processes personal data whose purposes and means are determined by the Customer: web hosting, managed dedicated and virtual servers, e-mail, backup, and the e-mailing service sold under the SG Autorépondeur and MailJump brands (hereinafter the “E-mailing Service”).

Formation of the contract. The DPA forms an integral part of the HaiSoft general terms of service (the “Terms”) and applies as soon as they are accepted. It may also be signed separately at the Customer’s request; the signed version then prevails over the online version.

Precedence. In the event of a conflict between the DPA and the Terms on a point relating to the protection of personal data, the DPA prevails.

Article 2 – Definitions and roles of the parties

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them by article 4 of the GDPR.

• Customer Data: the personal data that the Customer, its users or its own customers store, transmit or have processed via the HaiSoft services (hosted content, mailboxes, databases, contact lists of the E-mailing Service, etc.).
• Sub-processor: any third party to which HaiSoft entrusts all or part of the processing of Customer Data.

Allocation of roles. For Customer Data, the Customer is the controller and HaiSoft is the processor. The Customer warrants that it has a legal basis for each processing operation, that it has informed the data subjects and, for the E-mailing Service, that it has obtained their consent where the law requires it.

Out of scope. Data that HaiSoft processes on its own behalf (management of customer accounts, invoicing, support, abuse prevention, technical logs necessary for security) is governed by the HaiSoft privacy policy, HaiSoft then acting as controller.

Article 3 – Obligations of the processor

HaiSoft processes Customer Data only to provide the services ordered, in accordance with the Customer’s documented instructions.

1. Instructions. The Customer’s instructions consist of the Terms, this DPA, the configuration of the services carried out by the Customer and its written requests. If HaiSoft considers that an instruction infringes the GDPR, it informs the Customer without delay and may suspend its execution.
2. Legal obligation. If HaiSoft is required by law to process or disclose Customer Data (a court order, for example), it informs the Customer before the processing, unless the law prohibits it.
3. Non-use. HaiSoft does not use, sell, rent or disclose Customer Data for its own purposes, in particular commercial or advertising purposes.
4. Confidentiality. The persons authorised to access Customer Data are bound by a contractual or statutory duty of confidentiality. Access is limited to what is necessary to perform the services, to provide the support requested by the Customer and for security.
5. Security. HaiSoft implements the technical and organisational measures described in annex 2, in accordance with article 32 of the GDPR, and updates them in line with the state of the art. HaiSoft may change them provided that it does not reduce the overall level of protection.
6. Record. HaiSoft keeps the record of categories of processing activities carried out on behalf of its customers (article 30.2 of the GDPR).
7. Shared responsibilities. On non-managed services (server administered by the Customer, root access), the security of the operating system, applications and data is the Customer’s responsibility. HaiSoft remains responsible for physical security, the infrastructure and the network.

Article 4 – Sub-processors

The Customer gives HaiSoft a general authorisation to engage sub-processors, under the following conditions.

• List. The up-to-date list of sub-processors is set out in annex 3 and on the HaiSoft website.
• Prior information. HaiSoft informs the Customer by e-mail of any addition or replacement at least 30 days before it takes effect.
• Right to object. The Customer may object to the change on legitimate grounds relating to data protection, in writing, during this period. Failing agreement on an alternative solution, the Customer may terminate the service concerned free of charge before the change takes effect; sums paid in advance for the unused period are refunded to it.
• Same obligations. HaiSoft imposes on each sub-processor, by contract, data protection obligations at least equivalent to those of this DPA.
• Liability. HaiSoft remains fully liable to the Customer for the performance of its sub-processors’ obligations.

Article 5 – Data subject rights, data breaches and assistance

Data subject rights. The Customer itself responds to requests from data subjects (access, rectification, erasure, objection, portability, restriction), primarily using the tools in its customer area. If a person contacts HaiSoft directly, HaiSoft forwards the request to the Customer within 5 working days and does not respond to it itself, unless instructed by the Customer. For the E-mailing Service, unsubscribes made via the unsubscribe link are applied automatically.

Data breaches. HaiSoft notifies the Customer of any personal data breach affecting Customer Data within a maximum of 48 hours of becoming aware of it, at the e-mail address of the technical contact in the customer area. The notification contains, as far as possible:

• the nature of the breach, the categories and approximate number of persons and records concerned;
• the likely consequences;
• the measures taken or proposed to remedy it and limit its effects;
• the name and contact details of a contact person at HaiSoft.

The information may be provided in stages. It is for the Customer, as controller, to notify the CNIL (the French data protection authority) and, where applicable, the data subjects.

Assistance. HaiSoft provides the Customer with the information reasonably necessary to carry out a data protection impact assessment (DPIA) or a consultation of the CNIL. Assistance going beyond the mere provision of existing information may be charged at the rate in force, after acceptance of a quote.

Article 6 – Location and transfers

Customer Data is hosted and backed up exclusively in France. HaiSoft does not transfer any Customer Data outside the European Union without the Customer’s prior written agreement and without appropriate safeguards within the meaning of chapter V of the GDPR. Occasional access from abroad by the Customer itself is not a transfer carried out by HaiSoft.

Article 7 – End of the contract

At the end of the service, for whatever reason:

1. the Customer may recover its data using the export tools in its customer area for 60 days after the service is deactivated;
2. at the end of this period, HaiSoft deletes Customer Data from its production systems;
3. copies held in backups are erased as they rotate, at the latest 12 months after deletion; until then, they are used only to restore systems after an incident;
4. HaiSoft provides, on request, a certificate of deletion.

HaiSoft may retain Customer Data beyond these periods only if the law requires it, and only for that purpose.

Article 8 – Audits

HaiSoft makes available to the Customer the information necessary to demonstrate compliance with this DPA: description of the security measures, certificates, answers to a reasonable security questionnaire.

The Customer may, no more than once a year (and at any time in the event of a proven data breach), have an audit carried out by itself or by an independent auditor bound by confidentiality and not a competitor of HaiSoft. The audit is announced in writing 30 days in advance, takes place during working hours without disrupting the services or compromising the security or confidentiality of other customers’ data. Its costs are borne by the Customer, unless it reveals a significant breach by HaiSoft.

Article 9 – Liability and duration

Each party is liable for damage caused by its breaches of the GDPR and of this DPA, under the conditions of article 82 of the GDPR. Between businesses, the limitations of liability of the Terms apply to this DPA, except in the case of gross negligence or wilful misconduct.

The DPA applies for the entire duration of the services and until Customer Data has actually been deleted. It is governed by French law; disputes fall within the jurisdiction of the courts provided for in the Terms.

Annex 1 – Description of the processing

The Customer undertakes not to entrust HaiSoft with sensitive data within the meaning of article 9 of the GDPR via the E-mailing Service. For the other services, it informs HaiSoft beforehand so that the security measures can be adapted.

Annex 2 – Security measures

• Location: hosting and backups in France, in data centres with controlled physical access.
• Access: named accounts, principle of least privilege, strong authentication for administration access, revocation of access when a team member leaves.
• Network: firewalls, filtering and protection against denial-of-service attacks, encryption of data flows (TLS) for administration interfaces and exposed services.
• Systems: regular application of security patches to the components managed by HaiSoft, monitoring and logging of security events.
• Backups: regular backups of managed services, retained for 12 months at most, with restoration tests.
• Organisation: staff confidentiality obligation, incident and data breach management procedure, reporting address abuse@haisoft.net.
• E-mailing Service: logical separation of customer accounts, passwords stored in hashed form, automatic unsubscribe, control of sending volumes.

Annex 3 – Sub-processors

As at the date of this DPA, HaiSoft uses no sub-processor for any of its services, including the E-mailing Service. Any change will follow the procedure of article 4.