Book a demoSee a demo

Article 28 GDPR

Data Processing Agreement

1. Introduction

The Data Processing Agreement (hereinafter the "Agreement") is intended to govern the use of Personal Data of customers (hereinafter the "Customer") of Nown SAS (hereinafter the "Processor" or "Nown SAS") when they use the Nown Control service (hereinafter the "Service").

2. Definitions

The terms "adequacy decision," "technical and organizational measures," "data subjects," "privacy by design," "privacy by default," "record," "joint controller(s)," "controller," "processor," "processing," and "personal data breach" as used in this Agreement have the meanings set forth in Articles 4 and following of the GDPR.

The other terms are defined below:

3. Contractual Relationships and Terms

The Agreement is an indivisible annex to the Contract signed between the Client and the Processor for the use of the Service.

In the event of any conflict between the Contract entered into for the use of the Service and this Agreement, the obligations set forth in this Agreement shall prevail over the Contract with respect to the GDPR as a whole.

The Agreement is applicable for the entire duration of the Contract entered into in connection with the use of the Service and may continue beyond that period as long as all obligations set forth herein remain applicable.

4. Roles of the Parties and Scope of Application

Under the Agreement, the Customer acts as the data controller and Nown SAS acts as the data processor within the meaning of Article 28 of the GDPR.

Under no circumstances may the Parties be considered jointly liable in connection with the Service. However, the Parties agree that in the event of an error or change in their status, the Parties shall meet as soon as possible to amend the Agreement and take all necessary measures to address such a situation in order to comply with the requirements of applicable data protection regulations.

The Agreement governs exclusively the processing of the Client’s Personal Data carried out within the scope of the Service as a Processor within the meaning of Article 28 of the GDPR, to the exclusion of processing carried out as a Data Controller by Nown SAS, which is governed by the Contract.

5. Instructions and Commitments

The Processor undertakes to use the Client’s Personal Data in connection with the use of the Service only in accordance with the instructions documented in the annex to this Agreement. The Processor shall immediately inform the Client if it considers that an instruction provided by the Client is unlawful under applicable data protection regulations. The Processor shall not be held liable in the event that, despite the Processor’s notification regarding the illegality of the instruction, the Client maintains and implements said instruction through the Service.

The Processor undertakes to comply with the provisions of the GDPR and, in particular, to maintain a record of processing activities specific to the Service and to develop its Service in accordance with the principles of “Data Protection by Design” and “Data Protection by Default.”

The Processor never undertakes to transfer the Client’s Personal Data for any purpose other than the provision of the Service and undertakes never to use the Client’s Personal Data for its own benefit, in its capacity as data controller.

The Processor declares that all internal or external personnel involved in processing the Client’s Personal Data are bound by one or more binding legal agreements and regularly undergo training and awareness programs.

The Processor undertakes to ensure the security of the Customer’s Personal Data and to implement all necessary technical and organizational measures for its Service, the details of which are set forth in the annex to this Agreement.

However, the Processor is never liable for the Client’s breaches of applicable data protection regulations when the Client uses the Service as a data controller.

The Processor specifies that it may be required to process special categories of data as provided for in Article 9 of the GDPR upon the Client’s instructions. The Processor is not responsible for verifying the compliance of the Client’s processing of such data; the Client must ensure full compliance with the applicable legislation in its jurisdiction.

6. Assistance with the Preparation of Data Protection Impact Assessments

Data Protection Impact Assessments (DPIAs) must be conducted by the Client in accordance with the provisions of the GDPR. Nevertheless, the Processor undertakes to provide, upon written request from the Client, all necessary and required information to enable the Client to conduct a DPIA.

The Processor is not, however, required to carry out the DPIA on behalf of or for the Client. Any request beyond the provision of information may be refused.

7. Assistance with Data Subject Requests

Data Subject Requests submitted by End Users are forwarded to the Client as soon as possible. The Processor is not required to maintain a record of Data Subject Requests on behalf of the Client and is not liable for the Client’s failures in managing such requests.

Upon written request from the Client, the Processor shall perform the technical actions necessary to enable the Client to fulfill its obligation to respond to requests from data subjects.

The Client acknowledges and understands that the Processor is not required to handle data subject requests made in connection with the Service on behalf of the Client. Any additional request seeking to ensure such handling will be denied.

Data Subject Requests sent to the Processor in its capacity as data controller are processed exclusively by the Processor and are not transferred to the Client.

8. Assistance with Security Measures

The Processor undertakes to provide all necessary and required information regarding the technical and organizational security measures to be implemented to ensure the security of the Client’s Personal Data in connection with the provision of the Service.

9. Personal Data Breaches

The Processor undertakes to notify the Client, as soon as possible and no later than 48 business hours after becoming aware of it, of any personal data breach related to the Service that may affect the Client’s Personal Data, as well as all necessary and required information in its possession to mitigate the effects of the personal data breach. The Client agrees and acknowledges that the 72-hour period applicable to it begins only upon becoming aware of the personal data breach and, as such, the 48-business-hour period complies with the GDPR.

The Processor is not authorized to handle notifications of personal data breaches to the Supervisory Authority or to inform End Users on behalf of the Client. Any request to that effect from the Client will be refused.

10. Sub-processors

The Client grants the Processor general authorization to engage Subprocessors, provided that the Client is informed of any changes regarding such Subprocessors as soon as possible to allow the Client to raise objections. The Client agrees and acknowledges that specific authorization, for a SaaS tool, is not applicable and could lead to a blockage of the Service.

If the Client does not raise any objections within eight (8) days of notification, the new Subcontractor is definitively engaged without the Client being able to object, claim damages, or request termination of the Contract. If the objection raised within the time limit is deemed admissible by the Subcontractor, the Subcontractor may propose one of the following solutions to the Client: i) the withdrawal of the subsequent Subcontractor, ii) the implementation of additional measures to ensure the security of the Client’s Personal Data, iii) the termination of the Service without the Client being entitled to claim damages.

To be considered valid by the Subprocessor, objections must be objective and serious and must be duly substantiated. The Parties agree that the following situations shall, by default, be considered valid: i) the proposed Subprocessor is a direct competitor of the Client, ii) the Subprocessor is involved in a legal dispute with the Client, iii) the Sub-processor has been sanctioned by a Supervisory Authority within the 12 months preceding its engagement, and iv) the Sub-processor does not comply, where applicable, with the applicable rules governing transfers outside the European Union.

The Subprocessor undertakes to engage only Sub-subprocessors who, upon review, provide the necessary and sufficient safeguards to ensure the security and confidentiality of the Client’s Personal Data. The relationship between the Subprocessor and the Sub-subprocessor must be governed by an agreement containing obligations similar to those in this Agreement.

The Processor remains liable, within the limits of liability set forth in the Contract, for any breaches of the GDPR that may be committed by its Sub-processors in connection with the Service.

11. Hosting and Transfers Outside the European Union

a) Data Hosting

The Processor undertakes to take all necessary steps to host the Client’s Personal Data exclusively within a Member State of the European Union. The Client authorizes the Processor to select the Member State of the European Union of its choice. In the event that Personal Data is hosted in a country located outside the European Union, the Processor undertakes to obtain the Client’s prior authorization and to implement all necessary mechanisms to govern such a transfer, such as entering into Standard Contractual Clauses and, where applicable, implementing additional technical measures to enhance the security of the Client’s Personal Data.

b) Data Transfers

The Client grants the Processor general authorization for transfers outside the European Union provided that, cumulatively, i) the transfers are made exclusively to sub-processors compliant with the GDPR and ii) the transfers are made exclusively to a country benefiting from an adequacy decision or are governed by appropriate safeguards, such as, in particular, Standard Contractual Clauses. If these conditions are not met, transfers outside the European Union are permitted only with the Client’s prior consent. Additional technical security measures aimed at strengthening the security of the Client’s Personal Data must be implemented in the event that Personal Data is transferred to a non-democratic country.

12. Retention periods and disposition of the Client’s Personal Data

The Processor undertakes to retain the Client’s Personal Data only for the duration of the Service’s use, in accordance with the instructions detailed in the appendix, and to delete it at the end of the Agreement. The Processor shall, upon written request, certify the deletion of the Personal Data and all existing copies.

The Client is informed that they must retrieve their Personal Data before the end of the Agreement. Otherwise, the Client will no longer be able to retrieve their Personal Data, as the deletion of Personal Data is irreversible and final. The Processor shall not be held liable for any loss of Personal Data after its deletion, with the Client assuming full responsibility. The Client agrees that the complete, irreversible, and definitive anonymization of the Client’s Personal Data may be used as a method of deletion and that the Processor may retain the anonymized data for the purpose of improving the Service, as is accepted by the Supervisory Authorities.

The Processor informs the Client that the return of Personal Data provided for in the GDPR does not constitute the transfer of data to a new processor and that any request to that effect will always be refused by the Processor.

13. Audits

The Client has the right to conduct an audit in the form of a written questionnaire once a year to verify compliance with this Agreement. The questionnaire has the force of a sworn statement binding on the Processor. The questionnaire may be provided to the Processor in any form, and the Processor undertakes to respond as soon as possible upon receipt.

The Client also has the right to conduct, once a year and at its own expense, an on-site audit, if necessary at the Subcontractor’s premises, in the event of a data breach resulting from a proven and demonstrated breach by the Subcontractor that has caused duly justified harm to the Client. An audit at the Subcontractor’s premises may be conducted either by the Client or by an independent third party designated by the Client and must be notified in writing to the Subcontractor at least thirty (30) days prior to the audit. The Subcontractor has the right to object to the choice of the independent third party if the latter is (i) a direct or indirect competitor of the Subcontractor, (ii) in a conflict of interest with the Subcontractor (e.g., an advisor to a competitor of the Subcontractor), or (iii) involved in pre-litigation or litigation with the Subcontractor. In such a case, the Client agrees to select a new independent third party to conduct the audit. The Subcontractor may deny access to certain areas for reasons of confidentiality or security. In such a case, the Subcontractor shall conduct the audit in those areas and report the results to the Client.

In the event of a non-compliance identified during the audit, the Subcontractor agrees to implement, without delay and at its own expense, the necessary measures to ensure compliance with this Agreement. Non-conformities may only relate to the applicable regulations regarding the Client’s Personal Data and shall not concern internal procedures or measures implemented by the Client on a specific basis. Non-conformities must be duly demonstrated, justified, and documented.

In the event that the Processor disputes the identified discrepancies, the Processor may, at its discretion and subject to the Client’s prior written consent, propose to i) meet to find an amicable solution and a compromise, ii) refer the matter to the Supervisory Authority to obtain arbitration on the dispute, and iii) refer the matter to an independent expert to arbitrate the dispute.

14. Cooperation with authorities

The Subcontractor agrees to cooperate with the CNIL, the competent supervisory authority, in the event of an audit concerning the processing activities carried out in connection with the Service, and agrees to notify the Client as soon as possible in the event of requests concerning its Personal Data made by the supervisory authority or by an administrative, judicial, or law enforcement authority.

15. Contact

The Client and the Processor shall each designate a contact person responsible for this Agreement, who shall be the recipient of the various notifications and communications required under the Agreement.

The Processor informs the Client that it has appointed Dipeeo SAS as its Data Protection Officer, who may be contacted at the following address:

16. Revisions

The Processor reserves the right to amend this Agreement in the event of changes to applicable rules regarding the protection of Personal Data or in the event of changes to the Service that would result in the modification of any of its provisions.