This Data Processing Agreement (the “DPA”) forms an integral part of the Agreement between ELXAO SASU (the “Processor”) and the client (the “Controller”) and implements Article 28 of Regulation (EU) 2016/679 (the “GDPR”) and the French Data Protection Act (Loi n° 78-17 of 6 January 1978 as amended). It applies whenever ELXAO processes personal data on the Controller’s behalf in the course of providing the Services.
Definitions
The terms “personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject”, “special category data” and “personal data breach” have the meanings given in Article 4 of the GDPR. The terms of the Agreement apply to this DPA except where this DPA expressly overrides them.
Subject matter, duration & nature of processing
| Item | Description |
|---|---|
| Subject matter | Provision of marketing operations services (websites, SEO, paid media, analytics, CRM/email, branding, social media, localization, PM/events) on the Controller’s behalf. |
| Duration | Duration of the Engagement, plus the retention periods set out below. |
| Nature & purpose | Storage, organisation, analysis, transfer, hosting and deletion of personal data as required to deliver the Services. |
| Categories of data subjects | Controller’s end-users, prospects, customers, subscribers, employees, suppliers and event attendees. |
| Categories of personal data | Identification data (name, title), contact data (email, phone, postal address), professional data (company, role), online identifiers (IP, cookies, device IDs), behavioural data (clicks, sessions, conversions), commercial data (orders, billing), event data (registrations, attendance, badges, recordings). |
| Special category data | Not processed by default. Any exception requires a written instruction and additional safeguards. |
Roles & instructions
The Controller determines the purposes and means of processing. ELXAO processes personal data solely on the Controller’s documented instructions, which are formalised by the Agreement, the orders, the SLAs, the Privacy Policy of the Controller and any specific written instructions sent thereafter. ELXAO will inform the Controller without undue delay if it considers an instruction to infringe data-protection law.
Confidentiality of personnel
ELXAO ensures that every individual authorised to process personal data is bound by an enforceable confidentiality obligation (employment contract, freelance contract or NDA) and has received training in personal-data protection appropriate to their role.
Security measures
ELXAO implements appropriate technical and organisational measures (Article 32 GDPR), including:
- TLS 1.2+ encryption in transit and AES-256 encryption at rest for production data stores.
- Role-based access control with the principle of least privilege; mandatory multi-factor authentication for all administrators.
- Hardened, EU-hosted infrastructure with regular vulnerability scanning and patching.
- Code review, secrets management, secure SDLC and separation of production/staging environments.
- Centralised, integrity-protected logging; alerting on suspicious authentication and data-export events.
- Encrypted, geographically separated backups with documented restoration tests.
- Personnel onboarding/offboarding procedures, password manager, secure laptops with full-disk encryption.
- Business continuity and incident-response plans reviewed at least annually.
Sub-processing
The Controller grants ELXAO a general authorisation to engage sub-processors for the performance of specific processing activities (hosting, email delivery, analytics, ad platforms, customer support tools, event-management platforms). ELXAO maintains a current list of sub-processors, available on request at [email protected], and will give at least thirty (30) days’ prior notice of any intended addition or replacement, during which the Controller may object on reasonable data-protection grounds. ELXAO imposes on each sub-processor data-protection obligations no less protective than those set out in this DPA.
International transfers
Personal data is processed primarily within the European Economic Area (EEA). Where processing involves a transfer outside the EEA to a country without an adequacy decision, ELXAO relies on appropriate safeguards under Article 46 GDPR, principally the European Commission’s Standard Contractual Clauses (SCCs) of 4 June 2021, supplemented by any additional measures required by the transfer impact assessment.
Assistance to the Controller
ELXAO assists the Controller, by appropriate technical and organisational measures, in fulfilling its obligations to respond to data-subject requests (Articles 12–22 GDPR) and in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation). Standard assistance is included in the Services; substantial work in excess of one (1) Working Day per request may be billed at ELXAO’s then-current professional rates after written notice.
Personal data breach
ELXAO notifies the Controller without undue delay and in any event within seventy-two (72) hours after becoming aware of a personal data breach affecting the Controller’s data. The notification includes the nature of the breach, categories and approximate volumes affected, likely consequences and the measures taken or proposed to address it.
Audits
ELXAO makes available to the Controller, on reasonable request and no more than once per year (except following a breach), the information necessary to demonstrate compliance with this DPA, including ISO 27001 / SOC 2 type reports from sub-processors when available. On-site audits may be conducted by the Controller or a mutually approved third-party auditor bound by confidentiality, at the Controller’s expense, with reasonable prior notice and during business hours, in a manner that does not unreasonably disrupt ELXAO’s operations.
Return or deletion of data
Upon termination of the Agreement, ELXAO will, at the Controller’s choice expressed within thirty (30) days, either return all personal data in a structured, commonly used and machine-readable format, or delete it from all production and operational systems. Backup copies are deleted on the standard rotation cycle (up to ninety (90) days) and may be retained beyond that period only where required by applicable law, in which case they remain subject to the security and confidentiality obligations of this DPA.
Liability
The liability provisions of the MSA apply to claims arising under this DPA. Each party remains liable to data subjects and supervisory authorities in accordance with Article 82 GDPR.
Contact
For any data-protection question, request or notice under this DPA, contact ELXAO at [email protected].