Data processing agreement

1. Definitions

• Controller: the entity that determines the purposes and means of the processing of personal data.
• Processor: the entity that processes personal data on behalf of the controller.
• Data subject: any identified or identifiable natural person whose personal data is processed.
• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data (collection, storage, use, disclosure, erasure).
• Sub-processor: any third party appointed by the Processor to process personal data on behalf of the Customer.

2. Roles and responsibilities

The Customer acts as controller for the personal data of its own customers processed through the Software: it determines the legal basis for the processing and ensures that it complies with applicable laws. ARETA acts as processor and processes this data on behalf of the Customer, in accordance with this DPA and with the Customer's instructions.

3. Types of personal data processed

• End-user data: names, email addresses, reviews, feedback, video testimonials and other information submitted through review requests or landing pages.
• Customer data: names, email addresses, contact details, login credentials and other business-related data.
• Usage data: IP addresses, device information and data relating to the use of the Software.

4. Purpose of processing

• Aggregating reviews from third-party platforms (Google, Facebook, etc.).
• Replying to reviews using artificial intelligence, on behalf of the Customer.
• Sending review request campaigns and processing feedback.
• Sharing reviews through widgets and social media platforms.
• Running analytics to track and improve reputation management.
• Automating processes such as sending review requests.

5. Duration of processing

Processing continues for the entire term of the Agreement, unless a legal obligation requires otherwise or the Customer requests deletion.

6. Processor obligations

ARETA undertakes to:

• Process the data only on documented instructions from the Customer, to the extent necessary to provide the Software.
• Bind every person involved in the processing to a duty of confidentiality.
• Implement appropriate technical and organisational measures to protect the data against unauthorised access, loss, alteration or disclosure.
• Assist the Customer in meeting its obligations towards data subjects (access, rectification, erasure, portability) and in carrying out impact assessments where required.
• Notify the Customer without undue delay in the event of a personal data breach, and provide the necessary information and assistance.

7. Customer obligations

• Ensure that all instructions given to ARETA are lawful and comply with applicable laws.
• Inform data subjects and obtain the required consents, where applicable.
• Ensure that there is a valid legal basis for the processing (consent, legitimate interest, performance of a contract).
• Handle requests from data subjects, with ARETA's assistance on request.

8. Sub-processors

ARETA may use sub-processors to process personal data on behalf of the Customer, in particular for hosting (Cloudflare) and payment processing. ARETA ensures that each sub-processor offers a level of protection equivalent to that required by this DPA, informs the Customer of any intended change and remains fully liable for their performance. The full list of sub-processors can be provided on request at [email protected].

9. International data transfers

If personal data is transferred outside the European Economic Area, ARETA ensures that the transfer is covered by appropriate safeguards, such as the standard contractual clauses of the European Commission or an equivalent legal mechanism.

10. Security measures

• Encryption of personal data in transit.
• Access controls to prevent unauthorised access.
• Regular security assessments and audits.
• An incident response plan to handle data breaches.

11. Data retention and deletion

Upon termination or expiry of the Agreement, ARETA returns or deletes, at the Customer's request, all personal data processed on its behalf, unless a legal obligation requires it to be retained.

12. Right to audit

The Customer may request an audit of ARETA's processing activities to verify compliance with this DPA, at its own expense, with reasonable notice and minimal disruption to our operations.

13. Governing law

This DPA is governed by French law.

Contact

For any question about this agreement, write to us through the contact form or at [email protected].