Last Updated November 3, 2026
This Data Protection Addendum (“DPA”) forms part of, and is incorporated by reference into, the applicable written agreement between the Parties that governs the provision of services or other offerings by Provider to the other party (the “Governing Agreement”).
This DPA applies only to the extent Provider processes Personal Data on behalf of the other Party in connection with the Governing Agreement.
Capitalized terms not defined in this DPA have the meanings set forth in the Governing Agreement or, if not defined there, under applicable Data Protection Laws.
“Data Protection Laws” means all applicable laws and regulations relating to the processing of Personal Data, including, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK GDPR, and implementing national laws, including French Law No. 78-17 of 6 January 1978 (Informatique et Libertés).
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” has the meaning given in Data Protection Laws, and “Process” and “Processed” shall be construed accordingly.
“Controller”, “Processor”, “Subprocessor”, and “Supervisory Authority” have the meanings given in Data Protection Laws.
To the extent Provider Processes Personal Data on behalf of the other Party under the Governing Agreement:
(a) The other Party acts as Controller; and Provider acts as Processor.
(b) Each Party shall comply with the obligations applicable to it under Data Protection Laws.
Provider shall Process Personal Data solely:
(a) to perform its obligations under the Governing Agreement, as described in the Annex;
(b) in accordance with the documented instructions of the Controller, including with regard to transfers, as reflected in the Governing Agreement and applicable Order Agreements; and
(c) as required by EU or EU Member State law, in which case Provider shall inform the Controller before Processing unless that law prohibits it.
Provider shall not use Personal Data for its own purposes, including to train or improve AI models, or combine it with other data.
Provider shall promptly inform the Controller if it believes an instruction violates Data Protection Laws.
Provider shall ensure that persons authorized to Process Personal Data are subject to confidentiality obligations no less protective than those set forth in the Governing Agreement.
Provider shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as required by Article 32 of the GDPR, including the measures in the Annex.
Such measures shall take into account the nature of the Processing, the risks to data subjects, the state of the art, and the CNIL’s personal data security guide.
Provider may engage the Subprocessors listed in the Annex to Process Personal Data, provided that:
(a) Provider remains fully liable to the Controller for each Subprocessor’s performance; and
(b) Subprocessors are bound by written agreements imposing the same data protection obligations as those set forth herein.
Provider shall give the Controller at least 30 days’ written notice of any new or replacement Subprocessor. The Controller may object on reasonable grounds within that period; if the objection is not resolved, the Controller may terminate the affected services and receive a refund of prepaid fees for them.
Provider shall, taking into account the nature of the Processing, assist the Controller by appropriate measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Data Protection Laws, including requests concerning deceased persons. Provider shall forward any such request it receives to the Controller without undue delay and shall not answer it directly.
Provider shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data Breach involving Personal Data Processed under this DPA. The notice shall include the information listed in Article 33(3) of the GDPR, updated as it becomes available, and any other information reasonably necessary for the Controller to comply with its notification obligations under Data Protection Laws.
Provider shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice and confidentiality.
Provider shall assist the Controller with data protection impact assessments and prior consultations, keep a record of its Processing under Article 30(2) of the GDPR, and cooperate with the CNIL on request.
Personal Data shall not be transferred outside the European Economic Area, including by remote access, unless the transfer is covered by an adequacy decision (including the EU-U.S. Data Privacy Framework, if Provider is certified) or by the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914, which are incorporated into this DPA as completed in the Annex. Provider has assessed the laws of each destination country and will provide that assessment to the Controller on request. Transfers from the United Kingdom or any other jurisdiction with transfer restrictions shall use a mechanism approved under its laws.
If a public authority requests Personal Data, Provider shall notify the Controller unless legally prohibited, challenge unlawful requests, and disclose only the minimum required. Provider shall notify the Controller without delay of any request for information for use as evidence in foreign proceedings, so the Controller can comply with French Law No. 68-678.
Upon termination or expiration of the services under the Governing Agreement, Provider shall, at the Controller’s option, return or delete Personal Data within 30 days and certify deletion on request, except to the extent EU or EU Member State law requires its storage.
The limitation of liability provisions set forth in the Governing Agreement apply to this DPA and all Processing of Personal Data, including any Personal Data Breach, except to the extent prohibited by applicable Data Protection Laws. They do not limit either Party’s liability to data subjects or under the Standard Contractual Clauses.
In the event of a conflict between this DPA and the Governing Agreement, this DPA shall control solely with respect to the Processing of Personal Data, and the Governing Agreement shall otherwise remain in full force and effect. The Standard Contractual Clauses prevail over this DPA.
Provider may update this DPA only to reflect changes in Data Protection Laws, regulatory guidance, or approved transfer mechanisms, on 30 days’ written notice. Updates apply prospectively. If an update materially harms the other Party, it may terminate the affected services without penalty.
This DPA, together with the Governing Agreement, constitutes the entire agreement between the Parties with respect to the Processing of Personal Data and supersedes all prior or contemporaneous understandings relating thereto.
| Item | Details |
|---|---|
| Subject matter and purpose | Processing of Personal Data as necessary to provide the services described in the applicable Statement(s) of Work (“SOW”) under the Governing Agreement. |
| Duration | For the term of the Governing Agreement and any SOW(s), plus any additional retention period required by Section 11 of this DPA or applicable law. |
| Nature of Processing | Processing activities as described in the applicable SOW(s), which may include (without limitation) hosting, storage, transmission, support, analysis, and deletion of Personal Data. |
| Personal Data | Categories of Personal Data as specified in the applicable SOW(s). If not otherwise specified in an SOW, this may include contact data, account identifiers, content submitted by or on behalf of the Customer, and log/usage data. |
| Data subjects | Categories of data subjects as specified in the applicable SOW(s). If not otherwise specified in an SOW, this may include the Customer’s users, employees, contractors, and customers. |
| Restricted data | As specified in the applicable SOW(s). If not specified, none. |
| Trackers | As specified in the applicable SOW(s). If not specified, none. |
| Subprocessors (name, function, location) | As listed in the applicable SOW(s) or in the Processor’s then-current subprocessor list (as made available to the Customer). |
| Processing and access locations | As specified in the applicable SOW(s). If not specified, locations from which the Processor and its authorized subprocessors provide the services. |
Encryption in transit and at rest; multi-factor authentication and least-privilege access; security logging and monitoring; vulnerability management and a yearly penetration test; tested backups and restoration; an incident response plan; staff confidentiality and training.
| Clause | Election |
|---|---|
| Module | Module Two (Controller to Processor) or Module Three (Processor to Processor), as applicable to the role of the other Party under the Governing Agreement and the relevant SOW(s). |
| Clause 7 (docking) | Not used. |
| Clause 9 (subprocessors) | Option 2: General written authorisation. The Processor shall inform the Controller of any intended changes to subprocessors with at least 30 days’ prior notice (or as otherwise specified in the applicable SOW). |
| Clause 11 (redress) | Optional language not used. |
| Clause 13 (supervision) | The Commission nationale de l’informatique et des libertés (CNIL) where the other Party is established in France; otherwise as Clause 13 provides. |
| Clauses 17 and 18 (governing law and courts) | The law of France and the courts of France. |
| Annexes I and II | Annex I (Description of Processing) is set out in Part A of this DPA (as supplemented by the applicable SOW(s)). Annex II (Technical and Organisational Measures) is set out in Part B of this DPA. The parties are those identified in the Governing Agreement. |