Data processing agreement (DPA)

1. Purpose and scope

This data processing agreement (the “Agreement”) supplements the terms applicable to Zyllio Studio (the “Terms”). It applies when Zyllio processes personal data on behalf of the Customer as part of providing the Platform.

In this context, the Customer acts as the controller and Zyllio as the processor, within the meaning of Regulation (EU) 2016/679 (“GDPR”). This Agreement does not apply to processing for which Zyllio acts on its own behalf, in particular the management of accounts, invoicing, the commercial relationship and support, as described in Zyllio’s privacy policy.

2. Instructions, subject matter and duration of processing

Zyllio processes personal data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by European Union or French law; in that case, Zyllio informs the Customer before processing, unless prohibited by law.

The Customer’s initial instructions are those necessary for hosting, storing, displaying, technically processing, backing up and making available the projects and applications configured by the Customer in Zyllio Studio. The Customer may send additional instructions to contact@zyllio.com, provided they are lawful, feasible and compatible with the Terms.

Processing begins when the account is opened or when the Platform is made available to the Customer, whichever occurs first, and lasts until the data is deleted or returned in accordance with section 9 of this Agreement, unless retention is required by law.

3. Description of the processing

The Customer undertakes not to use the Platform to process special categories of data within the meaning of Article 9 of the GDPR, data relating to criminal offences or any other data subject to enhanced requirements, without Zyllio’s prior written consent and the implementation of appropriate safeguards.

4. Customer obligations

The Customer warrants that it has a valid legal basis for the processing it entrusts to Zyllio and that it provides data subjects with the information required by regulations. It remains responsible for the lawfulness of its instructions, its content, the configuration of its applications and the handling of data subject requests.

The Customer informs Zyllio without delay of any instruction likely to breach applicable regulations. It designates the people authorized to access its account and protects its login credentials.

5. Confidentiality and security

Zyllio ensures that the people authorized to process personal data are bound by a confidentiality obligation or an appropriate statutory obligation of confidentiality.

Zyllio implements appropriate technical and organizational measures, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to individuals. These measures include in particular encryption of exchanges in transit using TLS, access controls, backups, logging and security reviews.

6. Sub-processors

The Customer authorizes Zyllio to use the sub-processors necessary to provide the Platform, identified in the up-to-date list of sub-processors. Zyllio imposes on these sub-processors data protection obligations at least equivalent to those of this Agreement.

Zyllio informs the Customer of any intended addition or replacement of a sub-processor at least 30 days before it takes effect. The Customer may object on legitimate data protection grounds by sending a reasoned request to contact@zyllio.com within that period. The parties will then seek a reasonable solution. Failing a solution, the Customer may terminate the service concerned before the change takes effect, under the conditions to be specified in the Terms.

7. Transfers outside the European Economic Area

Data hosted in Zyllio Studio is stored in France with OVHcloud. Zyllio does not transfer this data outside the European Economic Area.

8. Assistance, data subject rights and data breaches

Taking into account the nature of the processing, Zyllio assists the Customer through appropriate technical and organizational measures, insofar as possible, to enable it to respond to requests from data subjects exercising their rights. If Zyllio directly receives such a request concerning the Customer’s data, it forwards it to the Customer without responding on the merits, unless instructed by the Customer or required by law.

Zyllio provides the Customer with the information reasonably necessary to help it comply with its obligations regarding security, impact assessments, prior consultations and data breach notification, taking into account the information available to Zyllio.

In the event of a personal data breach affecting data processed on behalf of the Customer, Zyllio notifies the Customer without undue delay after becoming aware of it and provides the available information enabling the Customer to meet its regulatory obligations. Zyllio does not notify data subjects or the supervisory authority directly on the Customer’s behalf, unless instructed in writing by the Customer or required by law.

9. Data at the end of the service

When the service ends, Zyllio deletes or anonymizes the personal data processed on behalf of the Customer, as well as any existing copies, no later than one month after the account is closed, unless retention is required by law or the Customer gives documented instructions to the contrary.

Upon reasonable request, Zyllio informs the Customer that this deletion has been carried out.

10. Information, audits and compliance

Zyllio makes available to the Customer the information reasonably necessary to demonstrate compliance with its obligations under Article 28 of the GDPR. To this end, the Customer may request relevant compliance information or documents at contact@zyllio.com.

Where this information does not reasonably allow the Customer to verify compliance, the Customer may request an audit, no more than once per twelve-month period, with at least 30 days’ written notice, during business hours and without unduly disrupting Zyllio’s business or compromising the security or confidentiality of other customers. The audit is carried out at the Customer’s expense by an independent auditor bound by a confidentiality undertaking.

11. Order of precedence and contact

In the event of a conflict between this Agreement and the Terms, this Agreement prevails for matters relating to the processing of personal data on behalf of the Customer.

For any question about this Agreement or to send documented instructions, the Customer can contact Zyllio at contact@zyllio.com.

Zyllio
SASU — SIREN 994 131 274
24 rue des Fleurs
91470 Limours, France