Data Processing Agreement (DPA)

Preamble

This personal data processing agreement (the "DPA") constitutes a stand-alone contractual appendix to the Arkane Cloud General Terms of Service (the "GTS") and, where applicable, to the Specific Terms and the SLA applicable to the Covered Services.

It governs the processing of personal data carried out by Arkane Cloud on behalf of the Customer and is entered into in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR").

The Customer and Arkane Cloud are hereinafter referred to individually as a "Party" and together as the "Parties".

The Customer acts as controller and Arkane Cloud as processor for the processing operations described in this DPA.

Article 1: Purpose, Scope and Order of Precedence

1.1. This DPA applies to any processing of personal data carried out by Arkane Cloud on behalf of the Customer in connection with the Services.

1.2. The DPA prevails over the GTS, the SLA, the Specific Terms, the AUP and the Documentation for any matter relating to the protection of personal data. The provisions of those documents remain applicable to matters that do not specifically relate to data protection, in particular availability, Service Credits, prices and the general reversibility arrangements.

1.3. In the event of a conflict between this DPA and an instruction from the Customer, the DPA prevails, unless there is a written amendment or a documented instruction validly accepted by Arkane Cloud.

Article 2: Definitions

The terms "personal data", "processing", "controller", "processor", sub-processor, "data subject", "personal data breach", "health data", "transfer" and "supervisory authority" have the meaning given to them by the GDPR.

The terms "Covered Services", "Customer Content", "Reversibility", "Business Hours", "Security Incident", "Documentation", "Usage Data", "Exportable Data" and "Digital Assets" have the meaning defined in the GTS and the SLA, subject to the clarifications set out in this DPA.

Article 3: Roles and Responsibilities of the Parties

3.1. The Customer determines the purposes and the essential means of the processing and remains responsible for the lawfulness, fairness, transparency, minimization and accuracy of its processing, and for determining the retention periods applicable to it.

3.2. Arkane Cloud processes personal data exclusively on behalf of the Customer and in accordance with this DPA, the provisions of the applicable contractual documents and the documented instructions of the Customer.

3.3. The Customer is solely responsible for determining and documenting the legal basis of the processing, for informing data subjects, for responding to their requests, for carrying out the impact assessments incumbent upon it and for notifying breaches to the supervisory authority or to data subjects where those obligations apply to it.

3.4. The Customer does not submit to a Service any data falling within special categories or relating to criminal convictions and offenses, unless this possibility is expressly authorized in Appendix 1 and the necessary specific measures have been agreed between the Parties.

Article 4: Subject Matter, Duration, Nature and Purposes of the Processing

4.1. The purpose of the processing is to enable the provision, securing, supervision, maintenance, support and reversibility of the Covered Services.

4.2. The nature of the processing may include hosting, storage, making available, consultation, remote access, transmission, replication, backup, deletion, technical logging and migration assistance, to the extent necessary for the provision of the Services and for the Customer's instructions.

4.3. The purposes, categories of data, categories of data subjects, Services concerned and processing durations are specified in Appendix 1. The processing begins on the date on which the Service concerned is made available and continues for the term of the Agreement, extended by the Reversibility period and by the legally mandated retention periods.

4.4. The Customer may supplement or clarify the description of the processing by means of documented instructions, provided that such instructions remain compatible with the subscribed Services, the Documentation, the agreed technical and organizational measures and applicable law. Any instruction substantially modifying the nature, the purposes, the categories of data or the categories of data subjects must be formalized in writing and may require an adjustment of the Services, the security measures, the authorized sub-processors or the financial terms.

4.5. The Customer informs Arkane Cloud, before the start of the processing concerned, of any specific requirement applicable to its data or its sector, in particular with regard to health data, professional secrecy, location, archiving, retention, encryption, certification or regulated hosting.

Article 5: Documented Instructions of the Customer

5.1. Arkane Cloud processes personal data only on the documented instructions of the Customer. The GTS, the Specific Terms, the Service settings, support requests and written instructions transmitted by the Customer's authorized persons constitute documented instructions.

5.2. Arkane Cloud immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or any other mandatory provision applicable to the protection of personal data.

Article 6: Confidentiality and Authorized Persons

6.1. Arkane Cloud ensures that the persons authorized to process personal data are subject to an appropriate legal, statutory or contractual obligation of confidentiality and access the data only to the extent strictly necessary for the performance, supervision, security or support of the Covered Services.

6.2. Arkane Cloud implements reasonable measures for the control of authorizations, the revocation of access, the traceability of administrative access and the awareness training of authorized persons.

Article 7: Technical and Organizational Security Measures

7.1. Arkane Cloud implements technical and organizational measures appropriate to the risk, in accordance with Article 32 of the GDPR, the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.

7.2. The applicable measures are set out in Appendix 2. They include in particular, depending on the Service concerned, authorization management, logical separation of environments, encryption in transit and, where available or appropriate, at rest, logging of access and security events, vulnerability management, backup, continuity, disaster recovery, incident management and secure deletion.

7.3. The measures are adapted to the size of Arkane Cloud, to the actual architecture of the Services and to the sub-processing chain. Any certification or certification process is presented as such and does not constitute a certification obtained before the certificate has actually been issued.

Article 8: Sub-processors

8.1. The Customer grants a general authorization for the use of the Sub-processors identified in Appendix 3. Arkane Cloud informs the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days before the scheduled effective date.

8.2. The Customer may raise a reasoned objection within that period where there are serious grounds relating to data protection, security, location, the chain of control or compliance with contractual requirements. The Parties seek an alternative solution in good faith.

8.3. In the event of an unresolved legitimate objection, the Customer may terminate the affected Covered Service without penalty, in accordance with the applicable termination procedures, without prejudice to its other rights.

8.4. Arkane Cloud imposes on each Sub-processor, by written contract, data protection obligations at least equivalent to those of this DPA and remains liable to the Customer for the performance of the Sub-processor's obligations, within the limits of applicable law and of the Agreement.

8.5. Arkane Cloud makes available to the Customer the information reasonably necessary concerning the identity, function, location, categories of accessible data and guarantees of each Sub-processor.

8.6. Where the replacement or addition of a Sub-processor must take place urgently in order to prevent a security risk or to ensure the continuity of a Service, Arkane Cloud may reduce the prior notice period to the extent necessary, informs the Customer as soon as possible and allows it to exercise its right to object as soon as the relevant information is available.

Article 9: Location, Transfers and Requests from Authorities

The Customer's data hosted on the Covered Services, including their backups and replicas, are exclusively stored and processed in data centers located within the territory of the European Union or the European Economic Area.

Arkane Cloud's data centers are colocation data centers, and the complete list of sites and infrastructure providers is set out in Appendix 3.

Arkane Cloud informs the Customer, in advance and in writing, of any planned change to the location of the data. Any relocation outside the European Union is subject to the prior written consent of the Customer.

Arkane Cloud notifies the Customer without delay, unless prohibited by law, of any request for access to the Customer's data from an administrative or judicial authority, and complies with such a request only to the strict extent required by applicable law, after having exhausted reasonable means of challenge.

No transfer of personal data outside the European Economic Area is carried out without the prior instruction or consent of the Customer. Any authorized transfer is based on a valid transfer mechanism under Chapter V of the GDPR (adequacy decision, Standard Contractual Clauses (SCCs) supplemented, where applicable, by supplementary measures, or other appropriate safeguard), contractually documented and brought to the Customer's attention.

Article 10: Personal Data Breaches

10.1. Arkane Cloud notifies the Customer of any Personal Data Breach of which it becomes aware as soon as possible and no later than forty-eight (48) hours after becoming aware of it.

10.2. The notification includes, to the extent of the information available, the nature of the breach, the categories and approximate number of data subjects and of records concerned, the likely consequences, the measures taken or proposed to remedy the breach and the contact details of the relevant point of contact.

10.3. If not all of the information is available at the time of the initial notification, Arkane Cloud provides it progressively, documents the breach and cooperates with the Customer in order to enable it to fulfill its obligations to notify the supervisory authority and, where applicable, to inform the data subjects.

10.4. The notification of a breach does not constitute an admission of liability. Arkane Cloud retains the information necessary for the documentation and analysis of the breach in accordance with applicable law.

10.5. Notifications are sent to the point of contact indicated in Appendix 5 or, failing that, to the Customer's contact details shown in the Console. The Customer ensures that these contact details are kept up to date and designates a reachable contact.

Article 11: Assistance to the Customer

11.1. Taking into account the nature of the processing and the information available, Arkane Cloud assists the Customer through appropriate technical and organizational measures in order to enable it to respond to requests for the exercise of data subjects' rights.

11.2. Arkane Cloud also assists the Customer, to the extent reasonably necessary, with its obligations relating to the security of processing, the notification of breaches, data protection impact assessments and prior consultations with the supervisory authority.

11.3. Requests for assistance are sent in accordance with the procedures set out in Appendix 5. Except in the event of an emergency or a legal obligation, the Customer provides the necessary information and groups its requests in a proportionate manner.

Article 12: Rights of Data Subjects

Arkane Cloud does not respond directly to data subjects, except on the documented instructions of the Customer or where required by a legal obligation. It forwards to the Customer without delay any request received concerning the data processed on its behalf and provides it with the assistance reasonably necessary to respond to it.

Where a data subject sends a request directly to Arkane Cloud, Arkane Cloud does not respond on the merits, except on documented instructions or where required by a legal obligation, and forwards the request to the Customer as soon as possible together with the information in its possession.

Arkane Cloud makes available to the Customer the reasonably available technical means for searching, extracting, rectifying, deleting, restricting or exporting the personal data processed on its behalf, subject to the functionalities of the Service and to the Customer's instructions.

Article 13: Records, Cooperation and Information

13.1. Arkane Cloud maintains, where required, a record of the categories of processing activities carried out on behalf of the Customer and cooperates with the competent supervisory authority under the conditions provided for by the GDPR.

13.2. Arkane Cloud makes available to the Customer the information necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the GDPR, in particular the relevant policies, attestations, third-party audit reports and available security testing summaries.

13.3. Arkane Cloud informs the Customer of any inspection, request for information or order from a supervisory authority directly concerning the processing carried out on behalf of the Customer, unless prohibited by law. It cooperates with the authority to the extent required and informs the Customer of the relevant follow-up where it is legally permitted to do so.

Article 14: Audits and Inspections

14.1. The Customer may carry out an audit, or have one carried out, under the conditions defined in paragraphs 1 and 2 of Article 20 of the SLA.

14.2. Any audit is subject to a program specifying its scope, dates, contact persons, applicable security measures and expected deliverables. It may not give access to the data of other customers or require the disclosure of trade secrets that are not necessary. Arkane Cloud may propose an equivalent measure where the requested access is not compatible with the security of its infrastructure or with the obligations incumbent upon it towards third parties.

Article 15: Reversibility, Return and Deletion

15.1. At the end of the Agreement or of the Service concerned, or in the event of a change of provider or of porting of the Service concerned, the Controller chooses between the return and the deletion of the Personal Data, unless there is a legal obligation to retain them. Return, reversibility and deletion are carried out in accordance with Article 22 of the GTS, Article 21 of the SLA, Appendix D to the SLA and Appendix 4 to this DPA.

15.2. Return and deletion relate solely to the Personal Data processed on behalf of the Controller in respect of the Service concerned. Data, configurations or backups common to several Services may be retained where they remain necessary for the provision, security or continuity of another Service, or for compliance with a legal obligation.

During the applicable transition and recovery period, Arkane Cloud maintains read and export access to the Personal Data concerned, within the limits necessary for the security and proper functioning of the Services. In the absence of a different mandatory period, the recovery period is thirty (30) calendar days, which may be extended by sixty (60) days upon written request from the Controller.

15.3. Upon request, Arkane Cloud provides reasonable migration assistance under the conditions set out in Article 21 of the SLA. Such assistance is invoiced at the rate communicated to the Customer before it begins, except where it must be provided free of charge under an applicable mandatory provision.

15.4. At the end of the recovery period, Arkane Cloud securely and irreversibly deletes the Personal Data concerned from its production systems. Copies present in backups are deleted in accordance with the applicable rotation cycles.

Personal Data retained pursuant to a legal obligation remain isolated and protected and are processed only for the purpose imposed by that obligation. A certificate of deletion is provided upon request.

Article 16: Liability and No Transfer of Obligations

16.1. The purpose of this DPA is not to transfer to Arkane Cloud the obligations legally incumbent upon the Customer as controller, nor to transfer to the Customer the obligations legally incumbent upon Arkane Cloud as processor.

16.2. Each Party remains liable for the breaches attributable to it under this DPA. The rights of data subjects and the powers of the competent authorities are not affected by the provisions of this Article.

16.3. Without prejudice to applicable mandatory provisions, the total aggregate liability of Arkane Cloud arising from breaches of its obligations under this DPA is capped, for each twelve (12) month period, at two (2) times the total amount, excluding taxes, actually paid by the Customer for the directly concerned Services during the twelve (12) months preceding the event giving rise to liability.

Where several Services are used, the cap is calculated solely by reference to the Services directly affected by the breach. This specific cap replaces the general liability cap provided for in the GTS for the same facts and may not be cumulated with it.

16.4. Service Credits, refunds or other sums already paid to the Customer in respect of the same breach are offset against any compensation owed by Arkane Cloud. The Customer may not obtain double compensation for the same loss.

Article 17: Term, Amendment and Termination of the DPA

17.1. The DPA takes effect on the effective date of the Agreement and remains applicable for the entire duration of the processing carried out on behalf of the Customer, including during the Reversibility period and for as long as Arkane Cloud retains personal data pursuant to the law.

17.2. Any substantial amendment to the DPA made necessary by a mandatory change in data protection law applies as from the required date.

17.3. The termination of the Agreement does not release the Parties from their obligations of confidentiality, security, cooperation, documentation and deletion or return of data.

17.4. The Articles relating to instructions, confidentiality, security, breaches, assistance, audits, reversibility, deletion, liability and cooperation with the authorities survive the expiry or termination of the Agreement for as long as necessary to achieve their purpose.

Article 18: Governing Law and Jurisdiction

This DPA is governed by French law.

Any dispute relating to its validity, interpretation, performance or termination falls under Article 25 of the GTS, as may be supplemented by the Specific Terms, subject to mandatory rules of jurisdiction and to the powers of the competent supervisory authority.

Appendix 1: Description of the Processing

Controller: the Customer identified in the Agreement.

Processor: ARKANE, EURL, Lyon Trade and Companies Register (RCS) 888 755 766, 55 ter avenue René Cassin, Lyon.

Subject matter: provision of the Covered Services subscribed to by the Customer.

Duration: term of the Agreement, Reversibility period and applicable statutory retention periods.

Nature of the operations: collection or receipt on behalf of the Customer, hosting, storage, access, consultation, transmission, replication, backup where subscribed, technical logging, support, security, restoration, export, deletion and migration assistance.

Purposes: performance of the Services, securing and supervision, support, continuity, technical billing limited to the necessary metadata, reversibility and compliance with applicable legal obligations.

Categories of data: identification and contact data; professional data; connection data and logs; content, files, images, prompts, requests and outputs where they contain personal data; metadata and configurations; any other category determined by the Customer in its instructions.

Categories of data subjects: employees, customers, prospects, suppliers, end users, members, or other data subjects whose data are entered or generated by the Customer, in accordance with its instructions.

Sensitive data: the Customer does not submit data falling within the special categories within the meaning of Article 9 of the GDPR or data relating to criminal convictions, unless Arkane Cloud has given its prior written consent and specific measures agreed between the Parties have been put in place.

Appendix 2: Technical and Organizational Measures

The applicable measures are determined by the subscribed Service and the security documentation provided to the Customer.

They include, depending on the scope concerned: access and authorization control; strong authentication where available; logical separation of environments; encryption of data flows; encryption at rest of the storage media of the shared platforms; backups and restoration tests where subscribed; vulnerability and patch management; security testing; incident management; business continuity and disaster recovery; secure deletion; management of Sub-processors; and procedures for responding to requests from authorities.

Security and administration logs are kept distinct from inference content, prompts, requests and Outputs. Arkane Cloud retains inference content only for the period necessary for the documented purposes of the Service, subject to the zero-retention option where it is offered and subject to applicable legal or security obligations.

Appendix 3: Sub-processors and Location of Processing

Main data center: colocation site in Villeurbanne (69100), France, operated by the nLighten group (physical hosting, power, cooling, physical security, without logical access to the Customer's data).

Arkane Cloud's operations teams are located in France.

Appendix 4: Reversibility and Deletion Procedures

Personal data are exported together with the exportable input data, output data and metadata, in the formats and via the interfaces provided for the Service concerned. The formats, time limits, assistance arrangements, technical restrictions, costs and template certificate of deletion are specified in Appendix D to the SLA.

Appendix 5: Contacts and Notifications

Customer general contact: [To be completed].

Customer data protection contact: [To be completed].

Customer security contact: [To be completed].

Arkane Cloud general contact: [email protected]

Arkane Cloud data protection / Data Protection Officer (DPO) contact: [email protected]

Arkane Cloud security / incident contact: [email protected]

Changes to contact details are notified in accordance with the GTS and the SLA and take effect upon receipt.

Signature of the Parties