Data Processing Agreement

1. Introduction

This Data Processing Agreement (hereinafter the “Agreement”) sets out the rules governing the use of the personal data of clients (hereinafter the “Client”) of Kaiporting SAS (hereinafter the “Processor” or “Kaiporting”) when using the services offered by Kaiporting (hereinafter the “Service”).

2. Definitions

The terms used in this Agreement follow the definitions of the GDPR (General Data Protection Regulation), in particular: “processing”, “processor”, “data breaches”, “controller”, “technical and organisational measures”, etc.

Other key definitions:

Agreement / DPA: annex to the contract governing the processing of the Client’s data under article 28 of the GDPR.
DPIA: Data Protection Impact Assessment to prevent risks related to processing.
Anonymisation: processing that irreversibly makes it impossible to identify the data subjects.
Client: person or company that has subscribed to Kaiporting’s Service.
Contract: main contract between the Client and Kaiporting for use of the Service.
Client personal data: any data relating to identified or identifiable persons processed by Kaiporting on behalf of the Client.
Sub-processor: any provider engaged by Kaiporting to process the Client’s data as part of the Service.
End users: persons whose personal data is processed on behalf of the Client.

3. Contractual relationship and duration

This Agreement forms an integral part of the Contract between the Client and Kaiporting.

In the event of conflict with the main Contract, the Agreement prevails for all GDPR-related matters.
It applies for the entire term of the Contract and may continue as long as data protection obligations remain.

4. Role of the Parties

Client: data controller.
Kaiporting : processor in accordance with article 28 of the GDPR.

Under no circumstances are the Parties considered joint controllers. If a change of role occurs, the Agreement will be updated to remain compliant with the regulations.

5. Instructions and commitments of the Processor

Kaiporting undertakes to:

Process data only on the Client’s documented instructions.
Immediately inform the Client if an instruction appears unlawful.
Comply with the GDPR, keep a record of processing activities and apply data protection by design and by default.
Guarantee data security and train its staff regularly.
Never use the Client’s data for any purpose other than providing the Service.

The Processor is not responsible for the Client’s breaches of the regulations.

6. Assistance with DPIAs

The Client carries out DPIAs. Kaiporting provides all the information needed to assist with this process but cannot carry them out on the Client’s behalf.

7. Assistance with data subject requests

Kaiporting forwards end users’ requests to the Client.
Kaiporting may carry out technical actions to help respond to requests.
Full handling of data subject requests by Kaiporting on the Client’s behalf is excluded.

8. Data security

Kaiporting provides all necessary information about the technical and organisational measures in place to protect the Client’s data.

9. Data breaches

Notification to the Client within 48 working hours of detection.
Kaiporting does not handle notifications to the supervisory authority or information to end users on the Client’s behalf.

10. Sub-processors

General authorisation given to the Processor to engage sub-processors.
The Client may object within 8 days of notification.
Kaiporting remains responsible for sub-processors for any GDPR breach.

11. Hosting and transfers outside the EU

Hosting: priority given to the European Union.
Transfers outside the EU: general authorisation if GDPR safeguards and an adequacy decision are in place. Otherwise, the Client’s prior agreement is required.

12. Retention period and deletion

Data retained only while the Service is used.
Irreversible deletion at the end of the Contract.
Anonymisation possible for analysis and improvement of the Service.
Return of data does not constitute reversibility to a new processor.

13. Audits

Annual written questionnaire to check compliance with the Agreement.
On-site audit possible in the event of a proven breach, with 30 days’ notice.
Kaiporting remedies any non-compliance found and proposes arbitration in case of dispute.

14. Cooperation with authorities

Kaiporting cooperates with the CNIL and informs the Client of any request relating to personal data.

15. Revisions

Kaiporting may amend the Agreement in the event of changes to the regulations or the Service. This English version is provided for information only; in case of discrepancy, the French version prevails.

Data Processing Agreement

1. Introduction

2. Definitions

3. Contractual relationship and duration

4. Role of the Parties

5. Instructions and commitments of the Processor

6. Assistance with DPIAs

7. Assistance with data subject requests

8. Data security

9. Data breaches

10. Sub-processors

11. Hosting and transfers outside the EU

12. Retention period and deletion

13. Audits

14. Cooperation with authorities

15. Revisions

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Shall we call you back to talk about your project?

We'll call you back to offer you the best salary.

Our team is available to give you the best advice for your situation.

Data Processing Agreement

1. Introduction

2. Definitions

3. Contractual relationship and duration

4. Role of the Parties

5. Instructions and commitments of the Processor

6. Assistance with DPIAs

7. Assistance with data subject requests

8. Data security

9. Data breaches

10. Sub-processors

11. Hosting and transfers outside the EU

12. Retention period and deletion

13. Audits

14. Cooperation with authorities

15. Revisions

Pour aller plus loin

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Get our exclusive white paper

Shall we call you back to talk about your project?

We'll call you back to offer you the best salary.

Our team is available to give you the best advice for your situation.