Personal data processing agreement (Article 28 GDPR)

Template to be reviewed by a lawyer. This agreement forms an integral part of the OK-GRC terms and conditions. It applies automatically to every subscription; a signed version can be provided on request. In case of discrepancy, the French version prevails.

This agreement is entered into between the Customer, acting as controller (the “Customer”), and ESERENIT, SAS, 16 rue Cuvier, 69006 Lyon, France, RCS Lyon 909 937 948, acting as processor (“ESERENIT”), in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Purpose

This agreement sets out the conditions under which ESERENIT processes, on behalf of the Customer, the personal data contained in the data the Customer and its users put into the OK-GRC platform (the “Service”).

2. Description of the processing

3. ESERENIT’s obligations

ESERENIT undertakes to:

1. process the data only on the Customer’s documented instructions, consisting of the terms and conditions, this agreement and the use of the Service’s features; ESERENIT immediately informs the Customer if an instruction appears to infringe the law;
2. ensure that persons authorised to process the data are bound by confidentiality and trained in data protection;
3. implement the security measures described in Annex 2, appropriate to the risk (Article 32 GDPR);
4. comply with the conditions for engaging sub-processors (Article 5);
5. assist the Customer in responding to data subject requests, in particular through the Service’s export, rectification and deletion features;
6. assist the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breaches, impact assessments, prior consultation), taking into account the information available to ESERENIT;
7. notify the Customer of any personal data breach without undue delay and at the latest forty-eight (48) hours after becoming aware of it, with the information available (nature, approximate categories and volume, likely consequences, measures taken or proposed);
8. at the end of the Service, enable export, then delete the data under Article 6;
9. make available to the Customer the information necessary to demonstrate compliance with this agreement and allow the audits provided for in Article 7;
10. keep a record of the processing carried out on behalf of its customers (Article 30(2) GDPR).

4. Customer’s obligations

The Customer undertakes to have a lawful basis for the processing it entrusts, to inform data subjects, to upload only necessary data, to manage the access of its users and partners, and to choose the AI assistant settings suited to its data (provider, masking of personal data, deactivation).

5. Sub-processors

5.1. The Customer authorises ESERENIT to engage the sub-processors listed on the Sub-processors page.

5.2. ESERENIT informs the Customer of any addition or replacement of a sub-processor at least thirty (30) days in advance. The Customer may object on legitimate data protection grounds; failing a solution, it may terminate the Service without penalty.

5.3. ESERENIT imposes on each sub-processor obligations equivalent to those of this agreement and remains liable for their performance.

5.4. The AI sub-processor Anthropic is only used if the Customer chooses that provider; the Customer can at any time turn the AI off or choose the model hosted by ESERENIT.

6. Return and deletion of data

During the subscription and for ninety (90) days after its end, the Customer can export its data. After that period, ESERENIT permanently deletes it, unless required by law to keep it; backups are erased according to their rotation cycle, of a maximum duration of [[To complete: backup retention period]]. On request, ESERENIT confirms the deletion in writing.

7. Audits

The Customer may request the information demonstrating compliance with this agreement (security policies, available audit reports or certifications). It may also have an audit carried out, at its own expense and at most once a year, by an independent auditor bound by confidentiality, with thirty (30) days’ notice and under arrangements agreed so as not to disrupt the Service or compromise the security of other customers.

8. Transfers outside the European Union

Customer data is hosted in the European Union. Any transfer to a third country by a sub-processor relies on a Chapter V GDPR mechanism (adequacy decision or standard contractual clauses, supplemented by additional measures where necessary).

9. Liability and term

This agreement follows the terms and conditions. The limitations of liability of the terms and conditions apply, within the limits permitted by the GDPR.

Annex 1 — Contact details

• Processor: ESERENIT, 16 rue Cuvier, 69006 Lyon, France — contact: [[To complete: contact email address]].
• Controller: the Customer, as identified in its Account.

Annex 2 — Technical and organisational measures

• Hosting in the European Union; encrypted backups ([[To complete: backup frequency and location]]).
• Encryption: TLS for all connections; files encrypted at rest; customer secrets sealed with AES-256-GCM; passwords hashed with Argon2id.
• Isolation: database row-level security (forced PostgreSQL Row Level Security) on every customer table, composite foreign keys preventing any cross-customer link, separate database roles.
• Access control: roles and permissions per organisation, two-factor authentication, passkeys, enterprise SSO; support access only with the Customer’s authorisation, time-boxed and traced.
• Traceability: tamper-proof activity log of every change, audit log of ESERENIT staff actions.
• Files: format allow-list, content verification, antivirus scan, downloads through short-lived signed links.
• Secure development: OWASP ASVS level 2, code review, automated tests, dependency monitoring.
• Organisation: staff bound by confidentiality, incident management and notification procedure, continuity plan ([[To complete: RTO/RPO recovery objectives]]).

Annex 3 — Sub-processors

See the up-to-date list on the Sub-processors page.