1. Parties
Controller: the Client subscribing to an ACF Compliance plan. Processor: Vincent Dorange (Editor ACF Compliance), SIREN [to complete]. DPO: dpo@acf-compliance.com.
2. Object
The processor provides the controller with the AI governance and compliance services described in the Terms of Sale. In this context, the processor processes personal data on behalf of the controller.
3. Data concerned and persons
Categories of data: identification data, professional data, technical data (logs), data submitted by the controller (AI systems inventory, fiches, documents). Data subjects: controller's collaborators, persons mentioned in the inventories (no sensitive data by default).
4. Processor obligations
The processor: (1) processes data only on documented instruction from the controller; (2) guarantees confidentiality (team NDA); (3) takes technical and organizational measures of art. 32 GDPR; (4) assists the controller for data subjects' requests; (5) notifies any breach within 72h; (6) deletes or returns data at end of contract; (7) maintains a register of its processing activities.
5. Sub-processors
The processor uses the following sub-processors (updated list on request): Vercel, Supabase, Anthropic, Stripe, Resend, Plausible. The controller is informed by email of any modification 30 days before implementation.
6. International transfers
Transfers outside the EU (notably to Anthropic USA) are framed by the European Commission 2021/914 Standard Contractual Clauses.
7. Audit
The controller may carry out an annual audit (with 30 days notice, at their expense), or rely on processor's certifications (ISO 27001 / SOC 2 in progress).
8. End of contract
At the end of the contract, the processor returns or deletes all personal data (at the controller's choice) within 30 days. Backup copies are deleted after an additional 30 days.
9. Liability
Each party bears the consequences of its own GDPR breaches. The processor is responsible for the acts of its sub-processors.