Data Processing Agreement (DPA)

This Data Processing Agreement (hereinafter “the DPA”) governs the processing of personal data carried out by SLEEDE SASU, the publisher of the Ubikly software, on behalf of its customers within the framework of Ubikly SaaS.

This DPA forms an integral part of the General Terms and Conditions of Sale (GTC) and the Customer’s quotation or purchase order. Acceptance of the latter constitutes full and unconditional acceptance of this DPA.

1. Identity and role of the parties

Data Controller:
The Customer who has subscribed to an Ubikly SaaS offer, as identified in the quotation or order.
The Client acts as the data controller or, where applicable, as a data processor on behalf of its own controller, and warrants that it has the necessary authorisation to entrust SLEEDE with all or part of the processing operations concerned.

Contractual basis for processing:
The data processing carried out by SLEEDE on behalf of the Customer is based on the performance of the contract for the provision of the Ubikly service, in accordance with Article 6.1.b of the GDPR.

Respective roles:

• SLEEDE acts as a Data Processor within the meaning of Article 28 of the GDPR for data hosted in the Ubikly SaaS instances operated on behalf of the Client.
• SLEEDE acts as a Data Controller for the data it collects via its website, its CRM, its forms, or its internal tools, in accordance with its Privacy Policy.

Scope:
This DPA applies exclusively to data processing carried out within the scope of the Ubikly SaaS offering. Ubikly On-Premise installations are the sole responsibility of the Client; SLEEDE exercises no control over data processing in this context.

Governing law:
This agreement is governed by Regulation (EU) 2016/679 and by French law on the protection of personal data.

Contractual integration:
This DPA constitutes an addendum to SLEEDE’s General Terms and Conditions of Sale and shall prevail over them in the event of any conflict concerning data protection.

2. Definitions

For the purposes of this Agreement, the following terms shall have the meanings assigned to them by Regulation (EU) 2016/679 of 27 April 2016 (hereinafter the “GDPR”), supplemented where applicable by the amended French Law No. 78-17 of 6 January 1978 (known as the “Data Protection Act”):

• Personal data: any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Processing: any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, interconnection, restriction, erasure or destruction.
• Data controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processor: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.
• Sub-processor: any service provider engaged by SLEEDE to carry out all or part of the processing operations entrusted to it by the Customer.
• Client Data: all data, including personal data, hosted, stored, transmitted or processed via the Ubikly SaaS service on behalf of the Client and under the Client’s responsibility.
• Ubikly SaaS: the online services provided by SLEEDE on a Software as a Service basis, enabling the Client to manage their spaces, resources, bookings, users and activities via the Ubikly platform hosted by SLEEDE.
• Personal Data Breach: any breach of security leading, accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data transmitted, stored or otherwise processed.
• Applicable data protection laws: Regulation (EU) 2016/679 (GDPR), the amended French Data Protection Act, and any applicable European or national regulations concerning the protection of personal data.

Supervisory authority: the CNIL or any other competent authority within the meaning of the GDPR.

3. Purpose and duration

The purpose of this agreement is to define the conditions under which SLEEDE processes, on behalf of the Client, the personal data necessary for the provision, operation and maintenance of the Ubikly software in SaaS (Software as a Service) mode.

The processing carried out by SLEEDE is intended solely for the provision of Ubikly SaaS, in accordance with the contract concluded between the Parties, and includes, in particular, the following operations:

• hosting, storage and backup of the Client’s data;
• implementation of the platform’s application features;
• technical and corrective management of the service (support, maintenance, updates);
• usage monitoring and logging for security and traceability purposes.

This processing is carried out solely for the performance of the service contract concluded between the Parties, in accordance with Article 6(1)(b) of the GDPR.
SLEEDE never acts for its own purposes or on behalf of a third party.
This agreement shall enter into force on the date of signature of the quotation, purchase order or any other contractual document relating to the Ubikly SaaS offer, which shall constitute express acceptance of this DPA, accessible online at any time.
This DPA shall remain in force:

• for the entire duration of the provision of Ubikly SaaS,
• as well as for the period necessary for the return or complete deletion of the Client’s data, in accordance with Article 12 of this agreement.

SLEEDE may retain certain technical data or logs for security, evidence or legal compliance purposes, for the periods provided for by applicable regulations.

4. Description of the processing

• Purpose of the processing
  Hosting, storage, operation and maintenance of the Ubikly software on behalf of the Customer, in connection with the operation of their space(s) and activities.
• Duration of processing
  For the entire duration of the Ubikly SaaS service contract and until the Client’s data has been completely deleted, in accordance with Article 12 of this agreement.
• Nature of the operations
  Collection, recording, hosting, backup, display, access, transmission, consultation, modification and deletion of personal data.
• Purposes
  Provision, management and operation of the Ubikly software, and performance of the functions provided for in the subscribed service, in particular:
  – management of bookings, subscriptions, memberships and transactions;
  – management of training courses, events and projects;
  – administration of users, spaces and resources;
  – usage monitoring, logging and platform security.
• Types of data processed
  – identification data: surname, first name, email, telephone number, usernames, roles, permissions;
  – contractual and billing data: subscriptions, transactions, invoices;
  – data relating to bookings, activities or interactions on the platform;
  – browsing or usage data (logs, IP addresses, technical fingerprints, metadata);
  – data exchanged via forms, messaging services or tools integrated into the service.
• Categories of data subjects
  The categories of data subjects whose data may be processed include:
  – end users and members registered by the Client;
  – employees, speakers, trainers, partners or trainees;
  – visitors or event participants;
  – administrators and managers of the Client’s platform.

These categories may vary depending on the configuration, the modules activated and the uses determined by the Client.

5. Obligations of the Processor (SLEEDE)

SLEEDE undertakes to comply with the legal obligations applicable to processors as defined by Regulation (EU) 2016/679 (“GDPR”) and, more generally, to ensure the confidentiality, integrity and security of personal data processed on behalf of the Client.

5.1. Processing on the Client’s instructions

SLEEDE shall process personal data only on the basis of written, documented and lawful instructions from the Client, and solely for the purposes set out in Article 4 of this Agreement.
If SLEEDE considers that an instruction constitutes a breach of the GDPR or any other provision of Union law or the law of a Member State, it shall immediately inform the Client.
In the event of a legal obligation requiring the processing or transfer of data contrary to the Client’s instructions, SLEEDE shall inform the Client thereof, unless prohibited by law.

5.2. Confidentiality and supervision of staff

SLEEDE shall ensure that any person it authorises to process personal data (employees, service providers or contractors):

• is subject to a legal duty of confidentiality;
• has been made aware of best practices regarding security and data protection in the course of their duties
• only accesses data in accordance with their role and for the period strictly necessary to carry out their duties.

5.3. Security of processing

LEEDE implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Article 9 of this agreement. These measures are designed in particular to prevent any loss, alteration, destruction or unauthorised access to data, as well as to ensure its traceability, availability and resilience.

5.4. Assistance to the Client

SLEEDE shall assist the Client, to the extent possible, to enable the Client to meet its legal obligations regarding data protection, in particular with regard to:

• the management of requests from data subjects to exercise their rights (access, rectification, erasure, etc.);
• the potential carrying out of data protection impact assessments (DPIA), by providing, where necessary, relevant technical information regarding the security and architecture of the Service;
• notifying the supervisory authority or data subjects of data breaches, where required by law;
• and, where applicable, prior consultation with the CNIL, in cases where the Customer must seek its opinion prior to the implementation of high-risk processing.

This assistance is provided on reasonable technical and financial terms, within the limits of the Ubikly Service’s capabilities and the information actually held by SLEEDE.

Any specific assistance or intervention falling outside the normal scope of technical support — in particular the production of documents, analyses, expert reports, proof of compliance or technical reports — will be invoiced separately on the basis of SLEEDE’s reasonable commercial costs, in accordance with the price list or quotation applicable at the time of the request.

The Customer undertakes to reimburse SLEEDE for any reasonable costs incurred in providing any additional assistance at the Customer’s request under this clause.

5.5. Record of processing activities

SLEEDE shall maintain a written record of the categories of processing activities carried out on behalf of its Clients, in accordance with Article 30(2) of the GDPR.

5.6. Sub-processors (general authorisation)

The Customer expressly authorises SLEEDE to engage sub-processors to carry out all or part of the processing necessary for the provision of the Ubikly SaaS Service, in particular for hosting, backup, maintenance, support, security, or infrastructure management.

SLEEDE undertakes to:

• select only service providers offering sufficient guarantees of compliance and security within the meaning of Article 28 of the GDPR;
• remain responsible for the performance of the obligations imposed on it by this agreement in accordance with Article 28(4) of the GDPR.

Given the nature of the Service, the Customer acknowledges that certain sub-processors provide standardised shared services and that the Customer may not demand the replacement of a sub-processor without a legitimate reason relating to the protection of personal data.

List of authorised sub-processors, their role and location:

SLEEDE may amend or supplement the list of its sub-processors. The Customer shall be notified of any significant addition or replacement of a sub-processor by electronic means, via the compliance documentation or by any other appropriate means, within a reasonable period of time before or after the change takes effect, where reasonably possible.

The Customer has a period of thirty (30) days from the date of such notification to raise a written objection, stating reasons and based on legitimate grounds relating to the protection of personal data and directly linked to the processing carried out on its behalf. In the absence of an objection within this period, the change shall be deemed to have been accepted.

An unsubstantiated or manifestly unfounded objection may only result in the termination of the service free of charge if the change of processor is likely to result in an increased risk to the rights and freedoms of data subjects. In the event of a legitimate objection, the Parties shall endeavour to find a reasonable solution to enable the continued performance of the Service. In the absence of an agreement, either Party may terminate the Contract or the relevant Service in accordance with the applicable contractual provisions.

5.7. Notification of data breaches

SLEEDE shall notify the Client of any personal data breach as soon as possible and, where feasible, within a maximum of 48 hours of becoming aware of it.
This notification shall describe the nature of the incident, the likely consequences and the corrective measures taken or envisaged.
SLEEDE shall provide all relevant documentation to enable the Client, if necessary, to notify the incident to the CNIL and the data subjects.

5.8. Documentation, audits and verifications

SLEEDE shall make available to the Client the information and documentation reasonably necessary to demonstrate compliance with the obligations set out in this agreement and in Article 28 of the GDPR.

This obligation is fulfilled in particular by the provision of compliance documents such as a description of the technical and organisational measures, the list of sub-processors, the processor’s record of processing activities, the applicable security policies or any other relevant documentation.

An on-site or remote audit may only be requested by the Client where such elements are manifestly insufficient to demonstrate SLEEDE’s compliance with its obligations under the GDPR and this agreement.

The Client may then, at its own expense and subject to at least thirty (30) days’ written notice, carry out a compliance audit or appoint an independent auditor subject to a strict duty of confidentiality. SLEEDE may object to the appointment of an auditor where there is a legitimate risk of a conflict of interest, in particular where such auditor carries out activities that compete with those of SLEEDE.

Such an audit may only be carried out once (1) per twenty-four (24)-month period and per Client, unless otherwise required by a legal obligation or a request from a competent supervisory authority. It shall be carried out during working hours, subject to at least thirty (30) days’ written notice, and under conditions that do not disrupt SLEEDE’s operations or compromise the security, availability or confidentiality of data or services provided to other clients.

Prior to any audit, the Parties shall agree in writing on its scope, duration, practical arrangements and applicable security measures. SLEEDE may limit the audit to those elements strictly necessary for verifying the relevant obligations, taking into account the information and documents already provided to the Client.

SLEEDE shall cooperate in good faith with the Client and, where applicable, with the competent supervisory authorities (such as the CNIL) in the event of an inspection, request or prior consultation, within the limits of its legal obligations and reasonable means.

5.9. Data transfers outside the EU

SLEEDE does not transfer any personal data outside the European Economic Area, except where such transfer is governed by a mechanism recognised by the GDPR, such as an adequacy decision by the European Commission, Standard Contractual Clauses adopted by the European Commission or any other mechanism authorised by the applicable regulations. Any such transfers are described in Article 10 of this agreement.

6. Obligations of the Customer (Data Controller)

The Customer, in its capacity as Data Controller within the meaning of Article 4.7 of the GDPR, remains solely responsible for the lawfulness of the data processing it carries out via the Ubikly SaaS Service.
The Customer undertakes to comply with all obligations incumbent upon them under the applicable regulations on the protection of personal data, and in particular to:

• determining the purpose, nature and legal basis of the data processing carried out within their Ubikly space;
• inform data subjects of the processing carried out, in accordance with Articles 12 to 14 of the GDPR, and obtain their consent where required by law;
• provide SLEEDE only with data that is adequate, relevant and strictly necessary for the provision of the Service;
• ensuring the quality, accuracy and up-to-date nature of the data transmitted or collected via the Service;
• ensure the security and confidentiality of their usernames, passwords and means of accessing the platform;
• manage the authorisations and access rights of its own users within Ubikly, and monitor the use made thereof;
• notify SLEEDE without delay of any organisational, legal or technical changes likely to affect the processing or security of the data;
• respond directly to requests to exercise rights made by data subjects (access, rectification, erasure, etc.), with SLEEDE providing technical support only where necessary in accordance with clause 5.4 of this agreement.

The Customer acknowledges that it remains solely responsible for the content and data hosted on its Ubikly interface, as well as for the processing it carries out under its own responsibility, including in the event of unauthorised access or use resulting from misconfiguration, negligence or the actions of its users.

SLEEDE shall not be held liable for any breach by the Customer of its own legal obligations, nor for any unlawful or non-compliant processing carried out by the Customer using the Ubikly SaaS Service.

7. Data subjects’ rights and assistance

Within the Ubikly Service, the Customer has access to features enabling them to exercise the rights of data subjects, in particular to:
– access, rectify or erase its users’ data;
– respond to requests for access, objection, erasure, restriction or portability in accordance with Articles 15 to 22 of the GDPR.

Upon request to support, the Customer may request an export of a member’s data.

If a request relating to the exercise of these rights is addressed directly to SLEEDE, the latter undertakes to forward it without delay to the Customer, who is solely responsible for processing the request and providing a response.

SLEEDE shall, upon written request from the Customer, provide all reasonable assistance necessary to enable the Customer to fulfil its legal obligations, within the limits of the Service’s technical capabilities.
Any specific assistance falling outside the standard scope of support may be subject to additional charges, in accordance with the current pricing terms.

The Customer remains solely responsible for fulfilling its obligations towards data subjects and for the lawfulness of its data processing via Ubikly.

8. Data security and confidentiality

SLEEDE implements, and undertakes to maintain throughout the contractual relationship, appropriate technical and organisational measures within the meaning of Article 32 of the GDPR, aimed at ensuring a level of security appropriate to the risks presented by the processing and the nature of the data concerned.

These measures take into account the state of the art, the costs of implementation, the context of the processing, as well as the likelihood and severity of the risks to the rights and freedoms of natural persons.

They include, in particular, but are not limited to:
– encryption of data in transit (TLS 1.3) and at rest (AES-256);
– logical partitioning of data by tenant;
– a private network between application servers and the database (Scaleway Private Network);
– access management and strong authentication (SSO, 2FA);
– logging and continuous monitoring of access;
– automatic daily backups that are encrypted, replicated and tested to enable data recovery in the event of an incident;
– web application firewall (WAF) and DDoS protection (Cloudflare);
– regular vulnerability assessments and application of security updates;
– awareness-raising and supervision of staff authorised to access data.

SLEEDE undertakes to maintain, adapt and improve these measures throughout the term of the contract to take account of evolving risks, technical standards and best security practices.

The Client acknowledges that it is also required to implement, within its own environment, appropriate measures to ensure the security and confidentiality of the processing operations for which it is responsible, in particular the management of access rights, the protection of endpoints and the security of user access.

9. Personal data breaches

SLEEDE undertakes to notify the Client, as soon as possible and no later than forty-eight (48) working hours after becoming aware of it, of any personal data breach within the meaning of Article 4.12 of the GDPR.

The notification shall specify, to the extent that the information is available at that time, the nature of the incident, its potential impact and the main measures taken or envisaged to remedy it.
Where certain information cannot be provided immediately, it will be communicated at a later date as it becomes available.

SLEEDE shall actively cooperate with the Client to enable the Client, where applicable, to make the required notifications to the CNIL and, if necessary, to inform the data subjects.
This cooperation shall take place under reasonable technical and financial conditions, without prejudice to SLEEDE’s security or confidentiality obligations.

10. International transfers

• The production data for the Ubikly SaaS Service is hosted within the European Union, primarily in France on Scaleway’s infrastructure.
• Where service providers located outside the European Union are used, particularly in connection with certain technical or security services provided by sub-processors, SLEEDE ensures that any transfer of personal data is governed by a recognised legal mechanism, in accordance with Articles 45 to 49 of the GDPR.
• These safeguards may include:
  – an adequacy decision by the European Commission (e.g. the United States via the Data Privacy Framework – DPF);
  – the signing of Standard Contractual Clauses (SCCs) adopted by the European Commission; or
  – any other measure or mechanism authorised by the applicable regulations to ensure a level of protection in line with the requirements of the GDPR.
• SLEEDE only uses service providers offering sufficient safeguards in terms of security, confidentiality and GDPR compliance. The updated list of sub-processors is made available to the Client upon request.
• The list of sub-processors and any international transfers is subject to change in accordance with the provisions of Article 5.6 of this agreement.

11. Deletion, return and retention of data

Upon termination of the contract or upon written request from the Client, SLEEDE shall return or delete the personal data processed on its behalf, in accordance with Article 28.3.g of the GDPR.

The Client may, up to the date of termination of service, request that SLEEDE return all of its data in a standard, structured and commonly used format (JSON, CSV or SQL).
This operation is carried out upon the Customer’s written request and may, where applicable, give rise to a specific invoice covering the technical costs of preparation and transfer.

In the absence of an express request from the Customer within thirty (30) days of the termination or expiry of the contract, all the Customer’s data will be deleted from the production environments.

Automatic backups are retained for 180 days, then securely and irreversibly destroyed.

SLEEDE may retain, beyond these time limits:
– data strictly necessary to comply with its legal obligations (accounting, tax or security);
– anonymised or aggregated information for the sole purposes of statistics, analysis or service improvement.

Upon completion of the full deletion, SLEEDE shall provide the Customer, upon request, with written confirmation of the effective destruction of the data concerned.

12. Liability and applicable law

SLEEDE is bound by a heightened duty of care, in line with the state of the art, regarding the security and confidentiality of personal data.

In the event of a breach, SLEEDE’s liability is strictly limited to the limits and exclusions set out in the General Terms and Conditions of Sale (GTC).

In the event of any conflict between this DPA and the GTC, the DPA shall prevail solely in respect of the processing of personal data.

This agreement is governed by French law. Any dispute relating to its interpretation or performance falls within the exclusive jurisdiction of the Commercial Court of Grenoble (France), unless otherwise required by mandatory provisions.

13. Contact and Data Protection Officer

For any questions or requests regarding the protection of personal data, the Customer may contact SLEEDE’s Data Protection Officer:

SLEEDE SASU – Ubikly Publisher
93 cours Berriat, 38000 Grenoble, France
dpo@sleede.com