Data processing agreement

1. Parties and purpose

This agreement (the "Agreement") is entered into between the Customer, as controller, and Ahmed BECHIR EI (individual entrepreneur), trading as DELQUOR, registered with the Trade and Companies Register under number 992 562 728 R.C.S. Vienne, whose establishment is located at 36 Rue Antonio Meucci, 38090 Villefontaine, France (the "Processor"). Capitalised terms have the meaning given in the terms of use; other terms have the meaning of Regulation (EU) 2016/679 (the "GDPR").

The Agreement forms part of the terms of use and, for paid subscriptions, of the terms of sale. It is accepted on the Customer's behalf by the User who creates a Workspace or takes out a subscription. It governs the processing of personal data the Processor carries out on the Customer's behalf as part of the Service.

Where the Customer itself acts as a processor for its own customers, in particular through an MSSP Account, the Processor acts as a sub-processor: the Customer warrants that its instructions comply with those of its own controller, and the Agreement applies on the same terms.

2. Description of the processing

3. The Customer's instructions

The Processor processes the data only on the Customer's documented instructions. These instructions are: the Agreement, the applicable terms and the Customer's use of the Service's features and settings. The Customer may give additional instructions in writing, if they are compatible with how the Service works.

Transfers of data to a third country take place only within these instructions, that is with the authorised sub-processors, or where Union or Member State law requires it; in the latter case, the Processor informs the Customer before processing, unless the law forbids it. The Processor immediately informs the Customer if it considers that an instruction infringes the GDPR or other data protection rules.

4. Confidentiality

Persons authorised to process the data on the Processor's behalf are bound by a statutory or contractual duty of confidentiality. They access it only as far as necessary for support requested by the Customer, the security of the Service or compliance with a legal obligation.

5. Security

The Processor implements the technical and organisational measures described in the annex to ensure a level of security appropriate to the risk, in accordance with article 32 of the GDPR, and reviews them as the Service changes.

6. Sub-processors

The Customer gives a general authorisation for the sub-processors in the published list. The Processor informs the Customer of any addition or replacement at least 30 days in advance, by e-mail to the owner of the Workspace and by updating the list.

The Customer may object to the change within that period on reasonable data protection grounds. If no solution is found, the Customer may stop using the Service before the change takes effect, without fee, and obtain a refund of the part of the price paid for the remaining period.

The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those of the Agreement, in particular sufficient security guarantees. It remains fully liable to the Customer for the performance of their obligations.

7. Assistance to the Customer

The Service lets the Customer view, correct, export and delete most of the data itself: editing the inventory and watches, removing members, CSV exports, deleting the Account. For the rest, the Processor helps the Customer, on request, to answer requests from data subjects exercising their rights.

If a person contacts the Processor directly about data processed for the Customer, the Processor forwards the request to the Customer as soon as possible and does not answer it on the merits without the Customer's instruction.

Taking into account the nature of the processing and the information available to it, the Processor helps the Customer meet its obligations regarding security, breach notification, impact assessments and prior consultation of the supervisory authority.

8. Personal data breaches

The Processor notifies the Customer of any personal data breach affecting Customer Data without undue delay after becoming aware of it, by e-mail to the owner and administrators of the Workspace. The notice describes, as far as this information is known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed; it is completed as information becomes available.

It is for the Customer, as controller, to notify the breach to the supervisory authority and, where applicable, to the data subjects. The Processor does not do so on its behalf unless instructed in writing.

9. End of processing: return and deletion

When the Service ends, the Customer retrieves its data through the exports, or through a complete copy provided on request under the terms of sale. A Workspace's data is erased immediately when it is deleted together with its owner's Account; otherwise, the Processor erases it on the Customer's written request, no later than thirty days after that request.

Erased data may remain in database backups until those are destroyed, no later than 90 days after they were made, and in the e-mail provider's delivery logs for 30 days; it is no longer used there. The Processor keeps only the data the law requires it to keep.

10. Information and audits

The Processor makes available to the Customer the information needed to demonstrate compliance with its obligations: this Agreement and its security annex, the list of sub-processors and its written answers to the Customer's questions. Patcharo holds no security certification.

The Customer may have an audit of compliance with the Agreement carried out, at its own expense, by itself or by an independent auditor bound by confidentiality, at most once a year except after a data breach or at an authority's request, with 30 days' notice. The audit first covers documentation; it is organised so as not to disrupt the Service or compromise the security or data of other customers.

11. Liability and term

Each party's liability is governed by the applicable terms, in compliance with article 82 of the GDPR. The Agreement applies as long as the Processor processes data on the Customer's behalf; in case of conflict with other contractual documents, it prevails as regards personal data.

12. Annex: security measures implemented

• Customer isolation: each Workspace is isolated by security rules the database applies to every row; all writes go through functions that check the User's role; automated isolation tests run before every release to production.
• Authentication: passwords of at least 15 characters, kept by the authentication provider in a non-reversible form; two-factor authentication offered to everyone and mandatory for the administration console; a recent re-authentication required for sensitive operations; session ends after 2 hours of inactivity; devices remembered for 30 days at most, of which only the token's fingerprint is kept; attempt limits.
• Administration: access restricted to dedicated accounts with mandatory two-factor authentication, role-based permissions, time-limited sessions, an administration log that cannot be altered, personal data masked unless a dedicated permission is held, viewing of a Workspace read-only, time-limited and recorded in its audit log.
• Encryption: encrypted communications (HTTPS enforced, including on subdomains); database encrypted at rest by its hosting provider (AES-256 according to Supabase).
• Application protection: security headers, a strict content security policy on the administration console, origin checks on requests that change data, outgoing requests limited to the public internet, signed incoming webhooks.
• Minimisation: no IP address or full browser string kept for Users' sessions (only browser, system and device families and the country); technical logs without IP address, cookie or parameter; e-mail log without address or content; invitation tokens kept as fingerprints; no Customer Data sent to the machine translation service.
• Secrets: service keys never exposed to the browser; automated search for secrets in the code and published files before every release.
• Backups: encrypted logical backups of the database made before significant updates, with a restore test.

Limits to be aware of: the database host's current plan gives access neither to automatic backups nor to point-in-time recovery; inventory fields are not subject to additional application-level encryption; two-factor authentication is not imposed on customers' Users. The Customer is invited to enable two-factor authentication for all its members, to give each one the most restricted sufficient role, not to enter unnecessary personal data in free-text fields and to export regularly the data it wishes to keep.

For any question about the Agreement: contact@patcharo.com; to report a security incident: security@patcharo.com.