Data Processing Agreement (DPA)
This agreement (the "DPA") forms part of the TOONAH Platform Usage Contract (the "Contract") entered into between the Customer (controller) and TOONAH SAS (processor). It implements Article 28 of Regulation (EU) 2016/679 (GDPR). Terms defined in the Contract or in the GDPR have the same meaning here.
1. Subject matter and duration
1.1. TOONAH processes personal data on behalf of the Customer for the sole purpose of providing the platform and the services under the Contract. The processing is described in Annex 1.
1.2. The DPA applies for the term of the Contract and until the deletion or return of all personal data processed for the Customer.
2. Customer's instructions
2.1. TOONAH processes the data only on the documented instructions of the Customer. The following constitute instructions: the Contract, the DPA, the configuration of the space by its Administrators (users, roles, integrations, AI settings, learning) and the Customer's written requests.
2.2. TOONAH immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or applicable law.
2.3. If Union or Member State law requires TOONAH to carry out processing, TOONAH informs the Customer before the processing, unless prohibited by law.
3. Customer's obligations
The Customer determines the purposes and legal bases of the processing, informs the data subjects, ensures that it introduces only necessary and lawful data, manages its users' access rights and chooses, in full knowledge of the facts, the AI providers activated for its space (Annex 2).
4. Confidentiality
TOONAH ensures that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access the data only to the extent necessary for their assignment.
5. Security
TOONAH implements the technical and organisational measures in Annex 3, appropriate to the risk (Article 32 GDPR). It may change them without reducing the overall level of protection.
6. Sub-processors
6.1. The Customer gives TOONAH general authorisation to engage the sub-processors listed in Annex 2.
6.2. TOONAH informs the Customer of any addition or replacement of a sub-processor at least [TO BE COMPLETED: 30] days in advance, by e-mail to the Administrators and on the platform. The Customer may object within that period on reasonable grounds relating to data protection; failing agreement, it may terminate the service concerned [TO BE COMPLETED: terms, pro rata refund].
6.3. AI providers whose use depends on activation by the Customer (Annex 2, Part B) process the data of the space only after such activation by an Administrator, which constitutes an instruction.
6.4. TOONAH imposes on each sub-processor, by contract, data protection obligations equivalent to those of the DPA, and remains liable to the Customer for their performance.
7. Transfers outside the European Economic Area
7.1. The data is hosted in France. TOONAH transfers data outside the EEA only in the cases set out in Annex 2, and with an appropriate safeguard within the meaning of Chapter V GDPR: an adequacy decision (including the EU–US Data Privacy Framework for certified entities) or the European Commission's standard contractual clauses (Decision (EU) 2021/914, Module 3 between TOONAH and the sub-processor), supplemented where necessary by additional measures.
7.2. [TO BE COMPLETED: transfer impact assessments (TIAs) for Anthropic, Google Cloud, Stripe and OpenAI where applicable; made available on request.]
8. Assistance to the Customer
8.1. Data subject requests. TOONAH forwards to the Customer without delay any request to exercise rights received directly and does not respond itself, unless instructed to do so. The platform enables the Customer to view, rectify, export and delete the data in its space; TOONAH assists it beyond that [TO BE COMPLETED: conditions, possibly chargeable].
8.2. Impact assessments and prior consultation. TOONAH provides the Customer with the information necessary for its data protection impact assessments (Article 35 GDPR) and, where applicable, for the consultation of the supervisory authority.
9. Personal data breaches
9.1. TOONAH notifies the Customer of any personal data breach affecting it without undue delay after becoming aware of it, and at the latest within [TO BE COMPLETED: number of hours, for example 48] hours, at the address of its Administrators.
9.2. The notification describes, as far as possible: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. The information may be provided in phases.
9.3. It is for the Customer, as controller, to notify the supervisory authority and, where applicable, the data subjects.
10. Fate of the data at the end of the Contract
At the end of the Contract, TOONAH returns the data to the Customer in a standard format, at its request, for [TO BE COMPLETED: period], then deletes it, including copies, unless there is a legal obligation to retain it. Deletion from backups occurs at the end of their rotation (Annex 3). TOONAH confirms the deletion in writing on request.
11. Audits
11.1. TOONAH makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR: this DPA and its annexes, [TO BE COMPLETED: available audit or penetration test reports, any certifications — no certification is claimed to date].
11.2. The Customer may have an audit carried out, at its own expense, by itself or by an independent auditor bound by confidentiality, no more than once a year except in the event of a data breach, with [TO BE COMPLETED: 30] days' notice, during business hours and without access to other customers' data. [TO BE COMPLETED: terms, allocation of costs.]
12. Records
TOONAH maintains a record of the categories of processing activities carried out on behalf of its customers (Article 30(2) GDPR).
13. Liability
The parties' liability under the DPA is governed by the Contract, without prejudice to Article 82 GDPR.
Annex 1 — Description of the processing
| Item | Description |
|---|---|
| Nature of the processing | Hosting, storage, organisation, consultation, calculation, search, analysis by AI models, content generation, transmission to services connected by the Customer, backup, deletion |
| Purposes | Providing the Customer with a governance, risk management, compliance, internal control, audit and strategic diagnosis platform, with an AI assistant; support |
| Data subjects | Customer's Users; employees, directors and officers, agents, auditors, service providers, customers or other third parties mentioned in the content entered or imported by the Customer |
| Categories of data | Identity and business contact details; job title and reporting line; roles and access rights; governance, risk and compliance content (risks, controls, findings, evidence, documents, incidents); data imported by integrations (directory, two-factor authentication status, sign-in logs, technical logs); questions, answers and documents submitted to the AI; learning memory if enabled |
| Sensitive data | None expected. The Customer undertakes not to introduce any without necessity or a legal basis |
| Duration | Term of the Contract and return period; default periods in the Data Collection and Processing Policy |
| Location | France (hosting); other locations as set out in Annex 2 |
Annex 2 — Sub-processors
A. Sub-processors used for all spaces
| Sub-processor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| OVH SAS (France) | Server hosting (VPS), managed PostgreSQL database, storage of off-site backups if enabled | France [TO BE COMPLETED: data centres and region of the managed database] | No transfer (EU) |
| Mistral AI (France) | Language models (conversation, drafting, planning) and vector embeddings for search | European Union [TO BE COMPLETED: to be confirmed under the contract] | No transfer (EU) [TO BE COMPLETED: to be confirmed] |
| [TO BE COMPLETED: e-mail sending provider, for example OVH SAS — SMTP server] | Sending of transactional e-mails (noreply@toonah.io) | [TO BE COMPLETED] | [TO BE COMPLETED] |
B. Sub-processors activated only on the decision of a Customer Administrator
| Sub-processor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Google Cloud (Vertex AI) — [TO BE COMPLETED: contracting entity] | Access to Anthropic's Claude models for in-depth document analysis | Google Cloud European Union region | Processing in the EU; [TO BE COMPLETED: standard contractual clauses / EU–US framework for any access from the United States] |
| Anthropic PBC (United States) — direct API | Claude models | United States | [TO BE COMPLETED: standard contractual clauses Module 3 or certification under the EU–US framework]; mode refused for spaces in the EU / EEA zone |
C. Other providers
| Provider | Service | Status |
|---|---|---|
| OpenAI | Audio transcription; legacy vector embedding model | [TO BE COMPLETED: confirm whether it is active in production; otherwise remove it from the list] |
| Stripe | Payment of subscriptions | Processes the billing data of the customer organisation, for which TOONAH is the controller (outside the DPA) |
| GitHub | Hosting of source code and software images | Does not process any customer data |
Services connected by the Customer itself (Microsoft 365 / Entra ID, Google Workspace, monitoring tools, Slack or Teams webhooks, SSO identity provider) are chosen and contracted by the Customer; they are not sub-processors of TOONAH.
Annex 3 — Technical and organisational measures
Measures in place at the date of this draft, based on how the platform operates:
| Area | Measures |
|---|---|
| Hosting | Servers and database hosted by OVH in France; managed database accessible only from the application server (encrypted connection); no database exposed to the internet |
| Encryption in transit | HTTPS mandatory (TLS, one-year HSTS header) on the website, the platform and the API |
| Encryption at rest | Two-factor authentication secrets encrypted (libsodium); connector, single sign-on and integration secrets encrypted (AES-256-GCM, key derived per space); recovery codes and passwords hashed; [TO BE COMPLETED: disk and managed database encryption by the hosting provider; backup encryption — not implemented to date] |
| Authentication | Passwords hashed (modern algorithm selected automatically by the framework); TOTP two-factor authentication with recovery codes and replay protection; single sign-on (SSO) depending on the plan; short-lived access tokens bound to their surface (platform, console) and to their holder, renewal limited to 30 days |
| Abuse protection | Limitation of the number of login attempts (5 failures in 15 minutes) and of the rate of sensitive requests; locking of suspended accounts |
| Access control | Role-based and feature-based access control in each space; deny by default; separate roles for the TOONAH administration console |
| Customer isolation | Each user request is restricted to their space by a systematic filter at the data access layer; automated isolation tests |
| Traceability | Audit log of sensitive actions (login, roles, AI settings, support access, publication and acceptance of contractual documents); application logs without personal data in clear (e-mail addresses, links and tokens excluded) |
| Artificial intelligence | Choice of provider by region; non-EU provider subject to explicit activation; call logs without content; AI actions subject to human confirmation; protections against prompt injection in the public assistant |
| Backups and continuity | Daily backup of the databases and before each deployment; local copies kept for 14 days, with integrity checks; copy in another OVH region if enabled; objectives: maximum data loss 24 hours, recovery within 2 hours; documented monthly restoration test procedure |
| Development and operations | Code review, automated tests and security checks in continuous integration (including secret detection); production deployment subject to approval; strict content security policy (CSP) on web interfaces |
| Organisation | Production access limited to authorised persons; support access to a space limited to 30 minutes and logged; [TO BE COMPLETED: staff confidentiality undertakings, awareness training, incident and data breach management procedure, periodic access review] |