Klepsi data processing agreement

1. Purpose and parties

This agreement governs the processing of personal data carried out by ALEOP SAS ("Aleop", processor) on behalf of the customer subscribed to Klepsi ("the Customer", controller), in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

It is attached to the Klepsi subscription terms and forms part of them. It is accepted together with them. In case of conflict on data protection, this agreement prevails.

2. Description of the processing

Aleop hosts, backs up, monitors, maintains and updates the Customer's Klepsi Instance, and handles support requests. The nature and purpose of the processing, the categories of data and data subjects and the duration are described in Annex 1.

3. Customer instructions

Aleop processes the data only on documented instructions from the Customer. The subscription terms, this agreement, the Instance settings and the Customer's written requests constitute these instructions.

If Aleop considers that an instruction infringes data protection law, it informs the Customer without delay. If Union or Member State law requires Aleop to carry out a processing, Aleop informs the Customer before doing so, unless the law prohibits it.

4. Confidentiality

Persons authorised by Aleop to access the data are bound by a contractual or statutory duty of confidentiality. Access is limited to what operations and support require.

5. Security

Aleop implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk. Aleop may change them, without ever lowering the level of protection.

The Customer remains responsible for the security of what it controls: management of its users and their rights, choice of its sign-in methods, confidentiality of credentials, connectors it enables to third-party services.

6. Sub-processors

The Customer authorises Aleop to use the sub-processors listed in Annex 3. Aleop imposes on them by contract data protection obligations equivalent to those of this agreement and remains liable for their performance.

Aleop informs the Customer by email at least thirty (30) days before adding or replacing a sub-processor. The Customer may object on data protection grounds. Failing agreement, it may terminate its subscription at no cost before the new sub-processor starts.

Third-party services that the Customer itself connects to its Instance (accounting tool, email, identity provider, instant messaging) are not Aleop's sub-processors. The Customer chooses them and contracts with them directly.

7. Location and transfers

Instance data and its backups are hosted in France. No data is transferred outside the European Union without the Customer's written consent, except in the cases stated in Annex 3. Any transfer is then covered by an adequacy decision or by the European Commission's standard contractual clauses.

8. Data subject rights

The Instance lets the Customer answer requests for access, rectification, erasure, restriction and portability itself: viewing and editing records, full export, deletion and purge of a person's data.

If a data subject contacts Aleop directly, Aleop forwards the request to the Customer without answering it, unless instructed otherwise. Aleop assists the Customer where the Instance is not enough.

9. Personal data breach

Aleop notifies the Customer of any personal data breach affecting the Instance within forty-eight (48) hours of becoming aware of it. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the contact at Aleop.

The Customer, as controller, notifies the supervisory authority and, where required, the data subjects. Aleop assists it in doing so.

10. Assistance to the Customer

Aleop provides the Customer with the information it reasonably needs to carry out a data protection impact assessment or to consult the supervisory authority, as far as Klepsi is concerned.

11. Return and deletion of data

At the end of the subscription, the Instance remains available in read-only mode for sixty (60) days so that the Customer can export its data, in the formats offered by the Instance. After this period, Aleop deletes the Instance and its database. Backup copies are erased at the end of their rotation cycle, no later than thirty-five (35) days after deletion. Until then, they are not used for any restore specific to the Customer. If a full restore of the host takes place during this period, the deleted Instance is deleted again straight away.

Aleop provides a deletion certificate on request. Aleop keeps no copy, except where required by law, in which case it informs the Customer.

12. Documentation and audit

Aleop makes available to the Customer the information needed to demonstrate compliance with this agreement, in particular the current description of security measures and the list of sub-processors.

The Customer may have an audit carried out, by itself or by an independent auditor bound by confidentiality and not a competitor of Aleop, at most once a year, with thirty (30) days' written notice. The audit covers Klepsi and is carried out without disrupting the service or giving access to other customers' data. Its costs are borne by the Customer, unless it reveals a significant breach by Aleop.

13. Records

Aleop keeps the record of categories of processing activities carried out on behalf of its customers, as provided for in Article 30(2) GDPR.

14. Term and liability

This agreement applies for the whole term of the subscription and until the data has been fully deleted. Each party's liability follows the subscription terms, without prejudice to the mandatory provisions of the GDPR.