Data processing agreement

• The Customer, as controller, decides the purposes and means of the processing of the data of its Contacts, Buyers and Students, and of the members it invites as regards their activity in its Workspace.
• ABEERY (Bastien REYTIER, sole trader, 80 Impasse du Lanna, 40180 Heugas, France, Dax Trade and Companies Register 109 930 743), as processor, processes this data on behalf of the Customer and on its instructions.

For the data of the ABEERY accounts themselves (owner, members, billing), ABEERY is the controller and the privacy policy applies; this agreement does not cover them.

Subject matter: providing the Customer with the platform described in the Terms — sales follow-up (CRM), forms and public pages, appointments, emails, automations, Messages, publishing on social networks, offers, sales and collections, training courses and student portal, artificial intelligence assistant.

Nature of the operations: collection through the Customer's pages, forms and integrations; recording; hosting; consultation; sending the emails and messages the Customer triggers; transmission to the services the Customer connects; analysis at its request; deletion.

Duration: that of the Customer's use of the platform, then until the data is deleted under the conditions of article 9.

The Customer undertakes not to upload to the platform special categories of data within the meaning of article 9 of the GDPR, nor data relating to offences, unless the law allows it to do so and it alone bears the consequences.

ABEERY processes the data only on the Customer's documented instructions. The Terms, this agreement, the settings the Customer chooses in the platform and the actions it triggers there constitute its instructions.

If ABEERY considers that an instruction infringes the GDPR or another data protection rule, it informs the Customer.

The persons authorised to access the data for ABEERY are bound by confidentiality. Any access by the ABEERY team to a Workspace's data goes through a tool that requires a reason and records its author, the reason and the date in a log that can neither be changed nor erased.

ABEERY implements the following measures, actually applied by the platform at the date of this agreement:

• Workspace isolation: every business record carries the identifier of its Workspace, and the database refuses, row by row, any read or write outside the user's Workspace (row-level security);
• server-side rights checks: roles and plan rights are checked by the server, never by the display alone;
• encryption of the authorisations issued by connected platforms (AES-256-GCM), with a key kept outside the database;
• encryption of exchanges (HTTPS, security headers including HSTS and a content security policy);
• authentication of notifications received from third-party services (signature or secret checked for Stripe, Meta, Brevo, Bunny and AssemblyAI);
• rate limiting of public entry points;
• signed, time-limited links for playing training videos;
• no direct anonymous write to the database: every public submission goes through the server.

The Customer remains responsible for the security of its credentials, for the roles it gives its members and for what it publishes.

The Customer authorises ABEERY to use the following sub-processors:

The social networks (Meta, X, LinkedIn and, when this feature is available, TikTok) and Google Calendar, when this feature is available, that the Customer connects to its Workspace are not sub-processors of ABEERY: the Customer chooses to send them its posts, replies and appointments, and contracts with them directly. YouTube is only contacted by ABEERY's server, with the address of a video, without any personal data.

ABEERY imposes on each sub-processor data protection obligations equivalent to those of this agreement, through the contractual terms that this sub-processor offers.

Change of sub-processor. ABEERY informs the Customer of any addition or replacement of a sub-processor at least thirty days before the change, by email to the Customer's account address. During this period, the Customer may object to the change by writing to contact@abeery.com. Failing agreement between the parties, the Customer may terminate its subscription.

• Requested deletion: the Workspace owner can request its deletion from Settings; it is carried out thirty days after the request, which can be cancelled during that period.
• End of the subscription: the Workspace is paused; its data is kept for twelve months so that the Customer can resume, then deleted. The Customer is notified by email one month before.
• Export: before the deletion, the Customer can export its contacts, sales and payments, appointments, content and Students from Settings.
• What the deletion erases: the Workspace's data in the database, its files, its videos at Bunny, the addresses of the recipients of its emails at Brevo, and the student accounts that only serve this Workspace. Buyers' waivers are erased with the Workspace, never before.
• What is kept: the log of the ABEERY team's accesses, which cannot be erased, and the record of ABEERY's billing events. Data already sent to the platforms the Customer connected (posts, messages sent) and data held by Stripe on the Customer's account remain subject to the rules of those services.

Data subjects' rights. When a data subject contacts ABEERY, ABEERY tells them to contact the Customer and, where it can, forwards the request to the Customer. The Customer answers itself using the platform's features (viewing, changing, exporting and deleting contacts; removing a student's access). For what these features do not allow, the Customer writes to contact@abeery.com and ABEERY helps it within a reasonable time.

Waivers. On simple request by the Customer to contact@abeery.com, ABEERY sends it the waivers recorded in its Workspace.

Data breach. ABEERY notifies the Customer of any personal data breach concerning it without undue delay after becoming aware of it, by email to the Workspace owner, with the information it has, so that the Customer can meet its own obligations.

Impact assessment and supervisory authority. ABEERY provides the Customer, on request, with the information it has about the processing carried out for it.

ABEERY makes available to the Customer, on written request to contact@abeery.com, the information needed to demonstrate compliance with this agreement.

Audit. The Customer may request an audit at most once a year, by written request to contact@abeery.com with thirty days' notice. The audit is at the Customer's expense. ABEERY answers first with its documentation and the certifications of its providers; an on-site audit only takes place if these are not sufficient to demonstrate compliance with this agreement. It is agreed in writing in advance and takes place without access to other Customers' data.

ABEERY's demo workspace only contains fictitious data; it is no Customer's Workspace and this agreement does not apply to it. Anyone who enters real data there does so in breach of the Terms.

This agreement lasts as long as ABEERY processes data on behalf of the Customer. In the event of a contradiction between this agreement and the Terms on data protection, this agreement prevails.