Data processing agreement (DPA)
Version of 19 October 2026
This is a translation provided for convenience. The French version prevails in case of discrepancy. Read the French version
1. Parties and purpose
This agreement is entered into between the Customer, as controller, and EDJ XTECH LAW SCHOOL, S.L. (the “Processor”), publisher of Le Frac. It forms an integral part of the terms of sale and use and applies whenever the Processor processes personal data on behalf of the Customer as part of the Service.
In case of conflict, this agreement prevails over the terms of sale and use for all matters relating to personal data protection.
2. Description of the processing
| Item | Description |
|---|---|
| Subject matter and nature | Hosting, recording, organisation, consultation, transmission and erasure of data as part of the Service |
| Purposes | Issuing and receiving invoices, reminders, collection, cash flow monitoring, sending emails, text messages or letters at the Customer’s request, AI assistance features |
| Data subjects | The Customer’s customers, prospects and suppliers and their contacts; users of the Customer’s account |
| Categories of data | Identity and business contact details, company identifiers, invoicing and payment data (amounts, due dates, bank details), history of exchanges and reminders |
| Sensitive data | None expected; the Customer undertakes not to record any |
| Duration | Term of the subscription, then 30 days of reversibility, then erasure (see section 9) |
3. Customer instructions
The Processor processes data only on documented instructions from the Customer: these terms, the Service settings and actions taken in the Service constitute instructions. It immediately informs the Customer if an instruction appears to infringe data protection law.
If Union or Member State law requires processing, it informs the Customer before processing, unless that law prohibits it.
4. Confidentiality
Persons authorised to process the data are bound by confidentiality and access it only as far as necessary.
5. Security
The Processor implements the technical and organisational measures described in the “Security measures” annex below, appropriate to the risk, in accordance with Article 32 GDPR. It may change them without reducing the level of protection.
6. Sub-processors
The Customer gives general authorisation for the sub-processors listed in the privacy policy (section 5). The Processor informs the Customer of any addition or replacement at least 30 days in advance; the Customer may object on reasonable data protection grounds and, failing agreement, terminate free of charge.
The Processor imposes the same data protection obligations on each sub-processor and remains liable to the Customer for their performance.
7. Transfers outside the European Union
Any transfer outside the European Economic Area relies on an adequacy decision or on the European Commission’s standard contractual clauses (GDPR, Arts. 45 and 46), as described in the privacy policy (section 6).
8. Assistance to the Customer
- Data subject rights: the Service lets the Customer view, correct, export and delete data; the Processor forwards to the Customer, without answering it itself, any request it receives directly.
- Personal data breach: the Processor notifies the Customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information needed for notification to the supervisory authority.
- Impact assessment and prior consultation: the Processor provides the Customer with the information available to it.
9. End of processing
At the end of the Service, the Customer can export its data for 30 days. The Processor then deletes the data and its copies, unless required by law to keep them; database backups, managed by the database host (Supabase), are erased at the end of their rotation cycle.
10. Documentation and audits
The Processor makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR and allows audits, at most once a year except after a data breach, announced 30 days in advance, at the Customer’s expense, by an auditor bound by confidentiality.
11. Customer obligations
The Customer warrants that it has a legal basis for the data it entrusts to the Service and has informed the data subjects. It keeps its own record of processing activities.
Annex: security measures
- Encryption in transit (HTTPS / TLS) and encryption at rest provided by the database host.
- Data separated per company at database level (row-level access rules).
- Credentials for third-party services encrypted; API keys kept server-side only.
- User authentication; team access limited to what is necessary.
- Application data hosted in the European Union (Frankfurt); database backups provided by the database host (Supabase).
- AI features: only the data needed by the feature is sent, and nothing is retained by the Processor.