Data Processing Agreement

The roles, and why the order matters

You are the CONTROLLER of your customers' data: you decided to collect it and for what purpose. the operator of this installation is the PROCESSOR: it handles that data only to deliver the service, following your instruction.

Swapping those roles is the most common and the most expensive mistake. That is why the documents the law requires name you, not the software — the software decides nothing about your customers' data.

Subject matter and duration

Processing covers contacts, conversations, deals and files exchanged on the connected channels, for as long as the subscription is active, and for the retention period stated in the Privacy Policy thereafter.

Processor obligations

• process data only on your instruction, and flag an instruction that appears unlawful;
• maintain the security measures described on the Security page;
• bind to confidentiality anyone with access to the data;
• help you answer a data subject request — access, correction, portability, erasure — using the system's own tools;
• notify you without undue delay of an incident affecting personal data;
• delete or return the data at the end of the contract, as you choose.

Controller obligations

It is on you to have a lawful basis for the data you load here, to inform your customers about that processing, and not to use the system for a purpose other than the one that prompted collection.

Sub-processors and international transfer

You authorise the sub-processors listed on the corresponding page, and you are notified before any addition. Some of them operate outside your country; transfer relies on the vendor's own standard contractual clauses and on the requirements of applicable law.

Audit

On reasonable request, the operator of this installation provides the information needed to demonstrate compliance with these obligations. There is no independent audit report to present today — see the caveat on the Security page.