Data processing agreement (DPA)

Article 1 — Parties and purpose

This agreement is entered into between:

• the client organisation, which uses the BySince platform for its own needs, hereinafter “the controller”;
• [to be completed], [to be completed], whose registered office is at [to be completed], registered under number [to be completed], publisher of the platform, hereinafter “Since & Co” or “the processor”.

It sets out the conditions under which Since & Co processes personal data on behalf of the controller, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR). It forms an integral part of the contract entered into between the parties and of the terms of use. In matters of data protection, it prevails over any other document.

It does not cover the processing for which Since & Co is itself the controller, described in the privacy policy.

Article 2 — Description of the processing

Article 3 — Obligations of the controller

1. It determines the purposes and legal bases of the processing, and keeps its record of processing activities.
2. It informs the data subjects, including persons recorded in the field, and obtains their consent where it is required.
3. It complies with its own obligations, in particular under employment law: information and consultation of employee representatives, prior information of employees about assessment systems.
4. It documents its instructions in writing. The configuration of the platform by its administrators constitutes an instruction: creation of accounts, granting of rights, enabling of AI, registration of API keys, enabling of capture encryption, sharing.
5. It carries out, where appropriate, the data protection impact assessment.
6. It ensures the security of its own access: choice of administrators, removal of the accounts of persons who have left, confidentiality of credentials and keys.

Article 4 — Processing on instruction

Since & Co processes the data only on documented instructions from the controller, including with regard to transfers outside the European Union, unless required to do otherwise by law; in that case it informs the controller, unless the law prohibits it from doing so.

If Since & Co considers that an instruction infringes the GDPR or another data protection rule, it immediately informs the controller.

Since & Co does not use the data for its own purposes. It does not sell the data, does not disclose it to other clients and does not use it to train artificial intelligence models.

Article 5 — Confidentiality

Since & Co ensures that the persons authorised to process the data are bound by an obligation of confidentiality, receive the necessary training and access the data only to the extent necessary for their duties: operations, maintenance, security, support.

Authorised members of Since & Co's staff hold roles that allow them to access the space of any organisation. They access it only for the purposes of the service or at the controller's request.

Article 6 — Security

Since & Co implements the technical and organisational measures described in Annex 1, in order to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. It may change them, without lowering their overall level.

Article 7 — Sub-processors

1. General authorisation. The controller authorises Since & Co to engage the sub-processors listed in Annex 2.
2. Changes. Since & Co informs the controller of any addition or replacement at least thirty days in advance, by publishing a new version of this agreement and by a notice sent to the contact designated by the controller. The controller may object in writing, on legitimate grounds relating to data protection, during that period. If no solution is found, it may terminate the service concerned.
3. Same obligations. Since & Co imposes on its sub-processors, by contract, obligations equivalent to those of this agreement. It remains liable to the controller for their performance.

Article 8 — Artificial intelligence

The AI features and the data they transmit are described in Articles 11 to 24 of the terms of use. Three situations must be distinguished.

8.1. Call made with an API key of the organisation

The organisation registers a key obtained from an AI provider with which it has itself contracted. The provider then processes the data on the organisation's account and under the organisation's contract. It is not a sub-processor of Since & Co: it is a processor, or a recipient, chosen by the controller. The controller checks the provider's terms: location, transfers, retention periods, use for model training. Registration of the key constitutes an instruction given to Since & Co to transmit the data to that provider when an authorised user triggers the feature.

8.2. Call made with a user's personal key

The platform allows a user to register their own key, which takes precedence over the organisation's key. The data is then processed on that user's personal account with the provider. The administrator sees neither these keys nor the corresponding calls. It is for the controller to authorise, regulate or prohibit this practice through its internal rules. If it wishes to rule it out, it may disable AI for its organisation.

8.3. Processing carried out with Since & Co's resources

At the controller's request, Since & Co may launch, in the course of operations, AI processing on the controller's content: AI review of sheets, knowledge review, glossary, description, keywords, conversion of transcriptions. It then uses its own accounts with the providers, including by means of the “Claude Code” and “Codex” tools, which transmit the data to the provider. These providers are sub-processors of Since & Co and are listed in Annex 2.

Since & Co launches such processing only at the request or with the agreement of the controller, and never for an organisation that has disabled AI.

8.4. Common safeguards

• no call to a third-party provider is made for a user without an available key, without that user's active consent, or if AI is disabled for the organisation;
• local processing (skill suggestion, local transcription) transmits nothing to any third party;
• AI outputs are proposals subject to human validation; no automated individual decision is taken;
• API keys are encrypted, never displayed again, never exported; the usage log contains no request, no response and no key.

Article 9 — Transfers outside the European Union

The data is hosted at the following location: [to be completed]. Since & Co does not transfer data outside the European Union, except:

• to Switzerland, for the remote storage of backups, on the basis of the European Commission's adequacy decision;
• to AI providers, where those features are used on the controller's instruction. In the case of Article 8.3, Since & Co satisfies itself that an appropriate safeguard exists (adequacy decision or standard contractual clauses) and keeps it available to the controller. In the cases of Articles 8.1 and 8.2, the transfer falls under the key holder's contract.

Article 10 — Rights of data subjects

Since & Co assists the controller, by appropriate measures and in so far as possible, in responding to requests from data subjects to exercise their rights. The platform allows the administrator to view and correct the data of its users, and to deactivate or delete their accounts. A structured export (JSON) exists for the data of an attached entity; for any other extraction, Since & Co acts on request.

If a person sends their request directly to Since & Co, Since & Co forwards it without delay to the controller and does not respond to it itself, unless instructed otherwise.

Article 11 — Personal data breach

Since & Co notifies the controller of any personal data breach concerning it as soon as possible, and no later than forty-eight hours after becoming aware of it. The notification describes the nature of the breach, the categories and approximate number of persons and records concerned, its likely consequences, the measures taken or proposed, and the contact point. The information may be provided in phases.

The controller notifies, where appropriate, the supervisory authority and the data subjects. Since & Co assists it in doing so.

Article 12 — Assistance with compliance

Since & Co assists the controller, taking into account the nature of the processing and the information available to it, with carrying out impact assessments, with prior consultation of the supervisory authority and with compliance with its security obligations. The registers of AI features and of processors kept by Since & Co are provided on request.

Article 13 — Fate of the data at the end of the contract

1. At the end of the contract, and at the controller's choice, Since & Co returns the controller's data to it in a commonly used format and then deletes it, or deletes it directly.
2. API keys are deleted and are never returned or exported.
3. Copies held in backups are deleted when the backups expire, at the latest twelve months after deletion. They are not used in the meantime.
4. The fate of the public verification pages of badges issued is decided by the controller.
5. Since & Co may retain the data that the law requires it to retain, and the data for which it is itself the controller.
6. On request, Since & Co certifies the deletion in writing.

Article 14 — Documentation and audit

Since & Co makes available to the controller the information necessary to demonstrate compliance with Article 28 of the GDPR.

The controller may carry out an audit, or have one carried out, no more than once a year save in the event of a data breach or a request from an authority, subject to thirty days' notice, during working hours, without disrupting the service or accessing other clients' data. The auditor must not be a competitor of Since & Co and undertakes to maintain confidentiality. The costs of the audit are borne by the controller, unless a serious breach is found.

Article 15 — Record and contact

Since & Co keeps a record of the categories of processing activities carried out on behalf of its clients. Data protection contact: [to be completed].

Article 16 — Liability, term, governing law

Each party is liable for the damage caused by its breaches of the GDPR and of this agreement, under the conditions of Article 82 of the GDPR and within the limits provided for in the contract, which do not apply to the rights of data subjects.

The agreement applies for the entire duration of the processing of the data by Since & Co. It is governed by French law; disputes fall within the jurisdiction of the courts designated by the terms of use.

Annex 1 — Security measures

Annex 2 — Sub-processors

AI sub-processors

These providers act as sub-processors of Since & Co only in the case of Article 8.3, that is to say for processing launched by Since & Co with its own accounts, at the controller's request.

The following are not sub-processors, since they do not receive personal data entrusted by the controller: Hugging Face (downloading of models run locally), the image libraries, MyMemory, DiceBear, Lorem Picsum and the public “Recherche d'entreprises” API. They are described in the privacy policy.

Publisher's contact details: see the legal notice.