1. Purpose and parties
This agreement (the "Agreement") specifies the conditions under which Gestiway SAS (à compléter) (the "Subprocessor") processes personal data on behalf of the professional client user of Gestiway (the "Data Controller"), in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR").
The Agreement forms an integral part of the General Terms. It is accepted upon creation of the space and applies for the entire duration of service usage. In case of conflict, the Agreement prevails regarding data protection.
2. Description of the data processing
| Element | Description |
|---|---|
| Nature and purposes | Hosting and processing of data necessary for the commercial management of the Data Controller: management of prospects and clients, pipeline, quotes, contracts and electronic signature, invoicing and payment tracking, event scheduling, equipment, email and follow-ups, client portal, feedback collection, dashboards. |
| Persons concerned | Prospects and clients of the Data Controller (individuals and professional contacts), on-site contacts during events, authorized users of the Data Controller. |
| Categories of data | Identity and contact information (name, email, phone, address, SIREN, VAT number), event information (date, location, number of guests, questionnaire responses), contractual and financial data (amounts, invoices, payments), electronic signature data (name, email, IP address, browser, timestamp, signature image, document fingerprint), email content, reviews and notes. |
| Sensitive data | No sensitive data as defined in Article 9 of the GDPR is expected; the Data Controller commits to not processing such data except in cases of imperative necessity and under its own responsibility. |
| Duration | Duration of service usage, followed by return and deletion according to the « Data Exit » article. |
| Location | European Union. |
3. Subprocessor obligations
The Subprocessor commits to:
- processing the data exclusively for the purposes described and upon documented instructions from the Data Controller, the use of the service and its configurations constituting instructions; it immediately notifies the Data Controller if it deems an instruction violates the regulation.
- ensuring the confidentiality of the data and ensuring that authorized individuals handling the data are bound by confidentiality obligations and trained in data protection.
- implementing the security measures described in the « Security » article.
- Do not use the data for own benefit, do not sell it or disclose it to any third parties outside of authorized subsequent sub-processors;
- Maintain a record of all processing activities carried out on behalf of the Data Controller (Article 30.2 of the GDPR).
4. Assistance to the Data Controller
The service provides the Data Controller with tools enabling him to respond to requests from individuals concerned: consultation and correction of personal files, export of a contact's data (portability), anonymization (right to erasure, while preserving documents subject to legal obligation of retention), tracking of consent for prospecting, and automatic purging of inactive prospects.
If a concerned individual addresses the sub-contractor directly, the sub-contractor shall immediately forward the request to the Data Controller and shall not respond directly to the individual, unless otherwise instructed.
The sub-contractor provides, upon request, the information necessary for carrying out impact assessments and for consultation with the supervisory authority.
5. Sub-contractors subsequent to the main one
The Data Controller generally authorizes the use of the subsequent sub-contractors listed on the page Sub-contractors.
The sub-contractor informs the Data Controller of any addition or replacement at least 30 days in advance. The Data Controller may object for reasonable data protection-related reasons; in the absence of agreement, the sub-contractor may terminate the service without charge.
The sub-contractor imposes on each subsequent sub-contractor obligations of data protection equivalent to those set out in this Agreement and remains responsible for their compliance.
6. Security
The sub-contractor implements appropriate technical and organizational measures, including:
| Domain | Measures |
|---|---|
| Client isolation | Shared database with row-level security enforced by PostgreSQL Row Level Security policies, partitioned by line (PostgreSQL Row Level Security) on all business tables; each query executes within the context of a single company, with a non-privileged role. |
| Encryption | HTTPS/TLS for all exchanges; secrets (double authentication, re-displayable links) encrypted with AES-256-GCM; public tokens stored as SHA-256 fingerprints; data at rest encrypted by the hosting provider. |
| Authentication | Hashed passwords (bcrypt), two-factor authentication (TOTP), account lockout after repeated failed attempts, rate limiting on login attempts, revocable sessions. |
| Access control | Roles and permissions by space (owner, administrator, member, accountant); editor staff access limited to strictly necessary functions. |
| Traceability | Audit journal for sensitive actions (logins, exports, anonymizations, invoice issuances, signatures). |
| Integrity | Invoices issued locked in the database and hashed with a digital fingerprint; proof dossier for each electronic signature. |
| Application | Security headers (CSP, HSTS, protection against clickjacking), native CSRF protection, systematic input validation. |
| Continuity | Regular encrypted backups hosted in the European Union, with a recovery procedure. |
7. Data breaches
The Subprocessor must notify the Data Controller of any personal data breach as soon as possible and no later than 48 hours after becoming aware of it, to allow the Controller to meet its own 72-hour notification deadline to the CNIL (Article 33 of the GDPR).
The notification must, as far as possible, specify the nature of the breach, the categories and the approximate number of affected individuals and records, the probable consequences, and the measures taken or proposed. The Subprocessor documents the breach and supports the Data Controller in its obligations to inform.
8. Transfers outside the European Union
Data is hosted and processed within the European Union. No transfer to a third country takes place without appropriate safeguards (adequacy decision, standard contractual clauses) and prior notification to the Data Controller.
9. Data exit at contract end
The Data Controller may export the full dataset at any time (complete export in JSON, CSV exports, PDF documents, and Factur-X). After subscription ends, the space remains accessible in read-only mode to facilitate data recovery.
Upon request for space deletion, data is permanently deleted after a 30-day retention period, then removed from backups at the end of their rotation cycle, no later than 90 days after. The Subprocessor retains only the data required by a legal obligation to preserve.
The data controller remains responsible for the retention of its own obligations (notably 10 years for invoices).
10. Documentation and audits
The processor provides the necessary documentation to demonstrate compliance with its obligations. The data controller may, at its own expense and at most once per year, have an independent auditor conduct an audit, under strict confidentiality, with a 30-day prior notice, without disrupting services or compromising the confidentiality of data from other clients.
11. Obligations of the data controller
- Have a legal basis for each processing activity and inform the affected individuals (the provided contract template includes a dedicated clause);
- Only collect the necessary data and define their retention periods;
- document their instructions and ensure compliance with the GDPR by their users;
- Manage user accounts and permissions, and enable two-factor authentication when appropriate.
12. Contact
Data protection officer or data protection representative: dpo@gestiway.example.