Data Processing Agreement

This agreement is entered into between the Professional, agency or white label client using Referaly (the "Client"), as controller, and Referaly OÜ, a company registered in Estonia under number 16957852, Tartu mnt 67/1-13b, 10115 Tallinn ("Referaly"), as processor.

It applies Article 28 of Regulation (EU) 2016/679 (GDPR) to the data that the Client manages in Referaly. It supplements the Terms of Use and enters into force together with them: acceptance of the Terms constitutes acceptance of this agreement. On request to hello@referaly.fr, we will send you a version for signature.

Referaly undertakes to:

• process the data only on documented instructions from the Client: the Terms, the settings the Client chooses in Referaly and its written instructions. If Referaly considers that an instruction infringes the GDPR, it immediately informs the Client;
• not use the data on its own behalf, not sell it and not contact the data subjects for its own prospecting;
• ensure that the persons authorised to process the data are bound by confidentiality;
• take the security measures required by Article 32 of the GDPR, described in the annex;
• assist the Client, insofar as possible, in responding to requests from data subjects to exercise their rights, by forwarding to it without delay any request received directly;
• assist the Client in complying with its obligations relating to security, breach notification, impact assessment and prior consultation of the authority, taking into account the information available to Referaly;
• make available to the Client the information necessary to demonstrate compliance with this agreement (article 9).

The Client authorises Referaly to use the sub-processors listed in article 5 of our Privacy Policy. Referaly imposes on them, by contract, data protection obligations equivalent to those of this agreement and remains liable to the Client for their compliance.

Referaly informs the Client by email at least 30 days before adding or replacing a sub-processor. The Client may object on legitimate grounds relating to data protection; if no agreement is reached, the Client may cancel its subscription at no cost before the change.

Referaly notifies the Client of any personal data breach concerning it as soon as possible, and no later than 48 hours after becoming aware of it. The notification describes the nature of the breach, the categories and approximate number of persons and data records concerned, its likely consequences and the measures taken or proposed. Any missing information is provided as soon as it becomes known.

• The Client has a legal basis for each processing operation it entrusts to Referaly.
• It informs the data subjects, in particular the people referred to it, at the latest at the time of its first contact with them (Article 14 of the GDPR).
• It only enters the data that is necessary, and no sensitive data.
• It responds to requests from data subjects to exercise their rights, with Referaly's assistance.
• It gives instructions that comply with the GDPR.

Referaly's servers and database are hosted in Paris. Where a sub-processor processes data outside the European Union, the transfer is based on an adequacy decision of the European Commission or on the standard contractual clauses it has adopted.

The agreement lasts for as long as the Client uses the Services. When its account is closed, the Client may request, within 30 days, an export of its data in a common format (CSV). Referaly then deletes the data and its copies, unless there is a legal obligation to retain them, and confirms this to the Client on request. Backup copies are erased at the end of their retention cycle.

Referaly answers the Client's written questions about compliance with this agreement within 30 days. If these answers are not sufficient, the Client may have an audit carried out by an auditor bound by confidentiality, no more than once a year, at its own expense, with 30 days' notice and without access to other clients' data. An audit requested by a supervisory authority is not subject to these limits.

The liability of each party is governed by the Terms of Use, without prejudice to Article 82 of the GDPR.

• Servers, database, files and backups hosted by Amazon Web Services, in Paris.
• Encrypted exchanges between devices and servers (TLS).
• Passwords stored in hashed form; connection tokens for third-party services encrypted at rest.
• Data segregation: each Client only sees its own network, referrals and agreements; a Referrer only sees their own referrals.
• Access by the Referaly team limited to authorised persons, with individual authentication.
• Daily database backup, tested by restoration.
• Technical logs kept for 90 days.