Agreement on the Protection
of Personal Data

Under this agreement, the Processor, Nemorius, has access to and processes personal data on behalf of the Client, who is considered the “Data Controller.” As such, the Processor undertakes to comply with applicable laws and regulations regarding the protection of personal data, in particular EU Regulation No. 2016/679 of April 27, 2016, known as “GDPR,” and Law No. 78-17 of January 6, 1978, known as the “Data Protection Act,” as amended, in accordance with the terms set forth below.

Article 1. Specific Definitions

“Personal Data”: means any information relating to an identified or identifiable natural person (hereinafter referred to as the “Data Subject”); an “identifiable natural person” is deemed to be a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific factors specific to the natural person’s physical, physiological, genetic, mental, economic, cultural, or social identity. 

“Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. 

“Data controller”: the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller may be designated or the specific criteria applicable to its designation may be laid down by Union law or by the law of a Member State. 

“Processor”: a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. 

“Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data transmitted, stored, or otherwise processed. 

“Applicable Laws and Regulations”: refers to all laws and regulations relating to the protection of personal data and privacy, including Law No. 78-17 on Information Technology, Data Files, and Civil Liberties of January 6, 1978, as amended, and European Regulation No. 2016/679 of April 27, 2016, known as the “General Data Protection Regulation” (GDPR), effective as of its entry into force. Within the framework of their contractual relationship, the Parties undertake to comply with the regulations in force applicable to the processing of personal data and, in particular, Regulation (EU) 2016/679 of April 27, 2016 (hereinafter, the “GDPR”) and the amended French Data Protection Act of January 6, 1978.

Article 2. General Principles

Within the framework of their contractual relationship, the Parties agree to comply with the applicable laws and regulations regarding the protection of Personal Data.

The Processor shall act solely on the instructions of the Data Controller, for the purpose of processing Personal Data on its behalf. As such, the Processor undertakes to process the Personal Data falling under the responsibility of the Data Controller exclusively for the purpose of performing the services arising from the terms of the main contract to which this clause relates.

Article 3. General Obligations of the Data Processor

In performing its duties, the Processor undertakes to:

1. Process Personal Data solely for the purposes covered by the subcontracting arrangement, as described below;
2. Immediately inform the Data Controller if it considers that an instruction constitutes a violation of Applicable Laws and Regulations or any other provision of European Union law or the law of Member States relating to the protection of Personal Data;
3. Ensure the confidentiality, integrity, and availability of the Personal Data processed;
4. Ensure that personnel authorized to process Personal Data are subject to an appropriate confidentiality obligation and receive the necessary training in Personal Data protection;
5. Take into account, with respect to its services, the principles of data protection by design and by default;
6. Not to transfer Personal Data outside the European Union without the prior and express consent of the Data Controller and to provide appropriate safeguards in connection with such transfer, including a standard notice to be provided to the data subjects affected by the processing. If the Processor is required to transfer Personal Data to a third country or an international organization pursuant to European Union law or the law of the Member State to which it is subject, it shall inform the Data Controller of this legal obligation prior to the commencement of the processing, unless the applicable law prohibits such notification for compelling reasons of public interest;
7. Assist the Data Controller in fulfilling its data security obligations, taking into account the nature of the processing and the information at its disposal;
8. Take all appropriate technical and organizational measures to ensure a level of security appropriate to the risks involved, in order to prevent any destruction, loss, alteration, disclosure, or unauthorized access—whether accidental or intentional—as well as any other form of unlawful processing of Personal Data. The Processor undertakes, in particular, to implement all security measures as described below;
   1. Access Management 
   2. User authentication 
   3. Connection logging
   4. Auditability of logs 
   5. Physical and Hardware Security Measures 
   6. Physical Access Security for Servers 
   7. Security of logical access to servers and applications 
   8. Internal computer network security
   9. Data encryption/pseudonymization
   10. Vulnerability management and backups
   11. Implementation of physical, technical, and organizational security measures in compliance with the ISO 27001 standard—Nemorius is certified. 
9. Maintain a written record of all processing activities carried out on behalf of the Data Controller, in accordance with Applicable Laws and Regulations;
10. Make available to the Data Controller the documentation necessary to demonstrate compliance with all its obligations and to enable the conduct of audits, including inspections, by the Data Controller or any other auditor it has appointed, and cooperate with such audits. The Processor further undertakes to ensure full transparency regarding the security policy and/or the organizational and technical measures implemented to secure the Personal Data processed on behalf of the Data Controller. In particular, the Processor undertakes to provide, as soon as possible, any information regarding this policy and these measures upon request by the Data Controller.
     

Article 4. Obligations of the Processor in the Event of Subprocessing

In the event of engaging subsequent subprocessors, the Processor shall impose on them the same obligations as those described in this clause and shall ensure that they provide all the safeguards required by Applicable Laws and Regulations.

The Processor shall notify the Data Controller in advance of any use of a new subprocessor. The Data Controller shall have 14 business days to object.

The Processor shall make available to the Data Controller a comprehensive and up-to-date list of its subprocessors. This list is available in Appendix 2 of this agreement.  

Article 5. Obligations of Assistance and Cooperation

1. Personal
   
   Data Breach The Processor shall notify the Data Controller of any Personal Data Breach within a maximum of 24 hours after becoming aware of it, using the email address provided to the Data Controller in the main contract.
   
   The notification must describe the nature of the Personal Data Breach, including the categories and number of data subjects, the name of the person in charge of the relevant processing, the consequences of the breach for the data subjects, the measures taken to remedy it, and the estimated timeline for implementing those measures to limit the impact on data subjects and prevent recurrence. This notification shall be accompanied by all relevant documentation to enable the Data Controller to report this Personal Data Breach to the competent supervisory authority and, where applicable, to the data subjects.
   
   The Processor further undertakes to investigate the cause of the Personal Data Breach and to implement all corrective measures necessary to resolve it and to limit its consequences and prevent its recurrence.
   
   The Processor also undertakes to assist the Data Controller in making any necessary notifications to the competent authorities and/or the data subjects.
    
2. Information and Management of Data
   
   Subjects’ Requests to Exercise Their Rights The Data Controller shall provide data subjects with information regarding the purposes and characteristics of the processing of Personal Data covered by this agreement at the time of collection.
   
   Upon specific written instruction from the Data Controller, the Processor may, however, be entrusted with the responsibility of providing this information. In this case, the content of the information and the manner in which it is provided shall be determined by the Data Controller. The Processor undertakes to provide the Data Controller with proof of the provision of the information, by any means.
   
   Data subjects must exercise their rights of access, rectification, erasure, restriction, and objection to processing, as well as the right to data portability, directly with the Data Controller’s departments.
   
   To the extent possible, the Processor must assist the Data Controller in fulfilling its obligation to respond to requests from data subjects to exercise their rights, in particular by implementing all relevant technical and organizational measures to ensure the effective implementation of such requests.
   
   When data subjects submit requests to the Processor to exercise their rights, the Processor must forward these requests upon receipt via email to the address specified in the main contract or to gdpr@nemorius.com.
    

3. Impact Assessments and Relations with the Supervisory
   
   Authority The Processor undertakes to cooperate with and assist the Data Controller in fulfilling its obligations. More specifically, the Processor shall assist the Data Controller in conducting data protection impact assessments, either before or after the implementation of a processing operation, by providing all necessary information regarding the processing. The Processor shall provide this same assistance in connection with the mandatory prior consultation with the CNIL in cases where the impact assessment reveals high residual risks.

   In the event of an inspection and/or a request from a supervisory authority, the Processor shall cooperate with and assist the Data Controller by providing all documentation required to demonstrate compliance with applicable Laws and Regulations.
    

Article 6. Portability of Personal Data

Upon termination of the contract, the Processor must return to the Data Controller, via a secure means, all Personal Data processed, in a usable format. Upon acknowledgment of receipt, the Processor must destroy all existing copies of the Personal Data from its information system and, where applicable, from the systems of its subsequent subprocessors. The Processor certifies in writing that the Personal Data has been destroyed, subject to any legal and regulatory retention obligations to which it is subject.

Article 7. Obligations of the Data Controller

The Data Controller undertakes to:

1. Provide the Processor with access to the Personal Data covered by this Agreement;
2. Document in writing any instructions regarding the processing of Personal Data in which the Processor is involved;
3. Ensure, in advance and throughout the duration of the processing, that the Processor complies with the obligations set forth in the GDPR;
4. Supervise the processing, including conducting audits and inspections of the Processor.
    

Article 8. Judicial or Administrative Orders

The Processor undertakes to notify the Data Controller of any request for the disclosure or inspection of Personal Data issued by a judicial or administrative authority within 24 hours of said request, prior to providing any response.

Article 9. Relations with Supervisory Authorities 

The Processor undertakes to immediately inform the Data Controller of any request or audit issued by a Supervisory Authority.

Article 10. Automatic Termination for Breach 

The Data Controller declares that the provisions relating to Personal Data constitute essential obligations of this agreement, without which it would not have entered into this agreement with the Processor

Consequently, the Data Controller may invoke any established breach of these provisions or any Personal Data Breach, which shall then constitute grounds for termination by operation of law.

The obligations regarding the protection of Personal Data arising from this Agreement shall survive the termination of the main contract to which these clauses are attached.

Appendix 1. Table of Processing Activities

This contract, including the clauses set forth above, constitutes the Data Controller’s instructions regarding the processing operations that the Processor must carry out on behalf of the Data Controller (to be duplicated as needed).

A. Table Applicable to the Processing Carried Out for the “Link Shortening and QR Code” Service

B. Table applicable to the processing carried out for the “Forms” service

Appendix 2. List of Subsequent Processors

For the URL shortener and QR codes:

• Matomo, published by InnoCraft Limited (InnoCraft), located at the following address: HLB Mann Judd, Level 8, 57 Symonds Street, Grafton, Auckland 1010, New Zealand. New Zealand is an adequate country. Transfers of personal data to these countries do not require a transfer framework.
   
• AMAZON WEB SERVICES EMEA SARL, whose global headquarters is located at 440 Terry Avenue North, WA 98109, Seattle, United States. The United States benefits from a partial adequacy decision. Amazon Web Services is certified under the Data Privacy Framework. In addition to this assurance, Standard Contractual Clauses govern the relationship between the Data Controller and the Data Processor in connection with Amazon Web Services’ services.
   
• Scaleway SAS, whose registered office is located at 8 rue de la Ville-l'Évêque, 75008 Paris, France. The data is hosted in data centers located in the European Union. Data processing is therefore subject to Regulation (EU) 2016/679 (GDPR).

No further subprocessors

For forms:

• AMAZON WEB SERVICES EMEA SARL, whose global headquarters is located at 440 Terry Avenue North, WA 98109, Seattle, United States. The United States benefits from a partial adequacy decision. Amazon Web Services is certified under the Data Privacy Framework. In addition to this assurance, Standard Contractual Clauses govern the relationship between the Data Controller and the Data Processor in the context of Amazon Web Services’ services.
   
• Scaleway SAS, whose registered office is located at 8 rue de la Ville-l’Évêque, 75008 Paris, France. The data is hosted in data centers located in the European Union. Data processing is therefore subject to Regulation (EU) 2016/679 (GDPR).

There are no further subprocessors.

Last updated: July 27, 2026