Data Processing Agreement (DPA)

Preamble

This Data Processing Agreement ("DPA") is entered into between the Client (hereinafter the "Data Controller") and the company CONSILIOWEB, SAS with a share capital of 1,000 euros, registered with the RCS Brive-la-Gaillarde under number B 892 889 858, with registered office at 13 Lestrade, 19200 Ussel (hereinafter the "Data Processor").

This DPA forms an integral part of the General Terms of Sale for the Orkelis service and applies to the extent that the Processor processes personal data on behalf of the Controller in connection with the provision of the Orkelis SaaS service.

This agreement is established in accordance with Article 28 of Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data (GDPR).

Article 1 -- Purpose and duration of processing

1.1. This DPA defines the conditions under which the Processor undertakes to carry out, on behalf of the Controller, the personal data processing operations necessary for the provision of the Orkelis service.

1.2. Processing begins on the date of the Controller's subscription to the Orkelis service and continues for the duration of the service contract. It ends upon expiration or termination of the contract, subject to the data return and deletion obligations set out in Article 8.

Article 2 -- Nature and purpose of processing

2.1. The Processor processes personal data exclusively in connection with the provision of the Orkelis SaaS service, an intelligent team scheduling and management platform.

2.2. Processing operations include: collection, recording, structuring, storage, adaptation, consultation, use, transmission, and erasure of data.

2.3. The purpose of processing is the generation, optimization, and management of the Controller's employee schedules, including consideration of legal constraints (labor law, collective agreements), availability, and staff skills.

Article 3 -- Types of personal data and categories of data subjects

3.1. Types of personal data processed:

-- Identification data: last name, first name

-- Professional contact details: email address, phone number

-- Professional activity data: working hours, availability slots, skills, qualifications, assignments

-- Usage data: login logs, schedule preferences, swap requests

3.2. Categories of data subjects:

-- Employees and workers of the Controller whose schedules are managed via the Orkelis service

-- Administrators and managers using the platform on behalf of the Controller

Article 4 -- Obligations of the Processor

4.1. Documented instructions -- The Processor undertakes to process personal data only on documented instructions from the Controller, including with regard to transfers of data to a third country.

4.2. Confidentiality -- The Processor ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3. Security measures -- The Processor implements appropriate technical and organizational measures pursuant to Article 32 of the GDPR, including:

-- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)

-- Strict role-based access control (RBAC) with multi-factor authentication for administrators

-- Daily automatic backups with 30-day retention, stored encrypted

-- Logging of access and operations on data

-- Regular security testing and security updates

-- Logical separation of data between clients (multi-tenant architecture)

4.4. Sub-processing -- The Processor shall not engage another processor without the prior specific or general written authorization of the Controller. The list of sub-processors is available at /sous-traitants.

4.5. Assistance for data subject rights -- The Processor assists the Controller in fulfilling its obligation to respond to data subject requests (access, rectification, erasure, portability, restriction, objection) pursuant to Articles 15 to 22 of the GDPR.

4.6. Assistance for security obligations -- The Processor assists the Controller in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR (security, breach notification, impact assessment).

Article 5 -- Obligations of the Controller

5.1. The Controller undertakes to provide the Processor with documented instructions regarding the processing of personal data.

5.2. The Controller guarantees the lawfulness of the processing entrusted to the Processor.

5.3. The Controller supervises the processing and remains responsible for compliance with the obligations under the GDPR.

Article 6 -- Sub-processors

6.1. As of the date of this agreement, the Processor uses the following sub-processors:

-- Infomaniak Network SA (Geneva, Switzerland) -- Purpose: hosting of application infrastructure and databases -- Location: Switzerland -- Certifications: ISO 27001, ISO 14001

-- Google Analytics 4 (if enabled) -- Provider: Google LLC, US -- Purpose: audience measurement -- Transfer outside EU: SCCs

-- Plausible Analytics (if enabled) -- Provider: Plausible Insights OU, Estonia (EU) -- Purpose: privacy-first audience measurement -- No transfer outside EU

-- LinkedIn Insight Tag (if enabled) -- Provider: LinkedIn Ireland, Ireland (EU) -- Purpose: advertising conversion measurement -- No transfer outside EU

-- Google Ads (if enabled) -- Provider: Google LLC, US -- Purpose: advertising conversion measurement -- Transfer outside EU: SCCs

6.2. The Processor imposes the same data protection obligations on its sub-processors as those set out in this DPA, pursuant to Article 28(4) of the GDPR.

6.3. The Processor remains fully liable to the Controller for the performance by its sub-processors of their obligations.

Article 7 -- Transfers outside the European Union

7.1. The Processor hosts data within the European Economic Area (EEA) and Switzerland.

7.2. Switzerland benefits from an adequacy decision of the European Commission, guaranteeing a level of data protection equivalent to that of the European Union.

7.3. No transfer of data to a third country without an adequacy decision shall be made without the Controller's prior consent and the implementation of appropriate safeguards (SCCs, binding corporate rules, or certification).

Article 8 -- Deletion and return of data

8.1. Upon termination of the service, the Processor undertakes, at the Controller's choice, to: return all personal data in a structured, commonly used, and machine-readable format (CSV, JSON export); or delete all personal data and existing copies, unless legally required to retain them.

8.2. The Controller has 30 days from the end of the contract to request the return of their data. After this period, the Processor shall permanently delete the data within 60 days.

8.3. The Processor shall certify in writing the effective deletion of data upon request from the Controller.

Article 9 -- Data breach notification

9.1. The Processor shall notify the Controller of any personal data breach without undue delay, and no later than 72 hours after becoming aware of it, pursuant to Article 33 of the GDPR.

9.2. This notification shall include at minimum: the nature of the breach, the contact point, the likely consequences, and the measures taken or proposed to remedy the breach.

Article 10 -- Audits and inspections

10.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and Article 28 of the GDPR.

10.2. The Processor shall allow and contribute to audits conducted by the Controller or an auditor mandated by the Controller, subject to 30 days' reasonable notice and confidentiality obligations.

10.3. Audit costs shall be borne by the Controller, unless the audit reveals a breach by the Processor of its obligations.

Contact

For any questions regarding this DPA or the protection of your data:

CONSILIOWEB -- Email: [email protected] -- Phone: +33 6 82 87 73 19

Last updated: March 2026.