Data processing agreement

1. Parties and purpose

This agreement binds the Client, as controller, and Otus, as processor, for the personal data the Client manages in Otus. It is part of the terms and applies from the creation of the account, without a separate signature.

2. Description of the processing

3. Otus's commitments

• Process the data only on the Client's documented instructions, these terms and the Client's use of Otus being such instructions, and tell the Client if an instruction seems unlawful.
• Keep the data confidential: only the publisher and its providers reach it, as far as the service needs, and they are bound to secrecy.
• Apply the security measures described in section 6.
• Help the Client answer the requests of data subjects (the export and the editing of records allow it directly), ensure security and, where needed, carry out an impact assessment.
• Notify the Client of any personal data breach concerning it within 48 hours of becoming aware of it, with the useful information.
• Never use the data for its own purposes: no advertising, no resale, no training of artificial intelligence models.

4. Sub-processors

The Client authorises Otus to use the providers listed in the privacy policy (Supabase, Vercel, Resend, Stripe and, depending on the features used, DeepL and Brandfetch). If the Client turns e-invoicing on, Otus also sends its invoices and reports to the approved platform (Super PDP, published by SUPER G, in France), with which the Client contracts directly. Otus imposes on them obligations equivalent to this agreement and remains liable to the Client for their acts.

Otus announces any new provider at least 30 days in advance, by e-mail or in the app. The Client may object on legitimate grounds; failing agreement, it may cancel at no cost.

5. Transfers outside the European Union

Data is stored in the European Union. When a provider processes it outside the Union, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

6. Security measures

• Encryption of exchanges (HTTPS) and of data at rest at our database host.
• Isolation of each workspace in the database: every row can only be read and changed by the members of its workspace.
• Passwords never stored in clear, two-factor authentication available.
• Technical access limited to the publisher, service keys never exposed in the browser.
• A log of sensitive actions in every workspace.
• Backups made by our database host.

7. End of the processing

When the account is closed, the Client has 30 days to export its data (a full export in one click, in open formats). Otus then deletes the data and its copies, unless the law requires otherwise. Backups are erased on their own cycle.

8. Audit

Otus makes available to the Client the information needed to show compliance with this agreement. The Client may, at its own cost and with 30 days' notice, have an audit carried out by a third party bound to secrecy, at most once a year, without access to other users' data.

9. The Client's obligations

The Client ensures it has a legal basis for the data it enters, informs the data subjects (in particular its Buyers, through its Site's privacy page, which it completes if needed) and answers their requests, with Otus's help.