Terms of sale

This English version is provided for convenience. The French version is the only legally binding text; in case of discrepancy, the French version prevails.

ARTICLE 1. PURPOSE

1.1 Unless otherwise agreed in writing, these general terms apply by right to any provision of services (hereinafter « Services ») by NOWDSI, a SARL registered with the Paris Trade and Companies Register under number 893805093, whose registered office is located at 102 avenue des Champs Élysée 75008 PARIS (hereinafter : « NOWDSI »), provider of the « IOKOO » software solution as described below, to the person placing the order acting within the scope of their professional activity (hereinafter « Client »), who accepts them and acknowledges having full knowledge of them and thereby waives the right to rely on any contradictory document, in particular their own general terms of purchase. Consequently, the act of placing an order implies the Client's full and unreserved acceptance of and adherence to these general terms of service, to the exclusion of all other documents of the Client or of NOWDSI such as brochures, catalogues, etc. which are merely indicative.

No document other than these may create obligations on the parties or derogate from these terms unless it is the subject of a writing signed by the parties or a mention in the contract accepted in accordance with article 4.

1.2. The Client accepts that NOWDSI may subsequently and reasonably modify these general terms and that their relationship will always be governed by the latest terms in force on the day of the order.

ARTICLE 2. DEFINITIONS

For the interpretation of these terms, the Client and NOWDSI agree to give the terms and expressions listed below the following meanings.

Client Administrator : refers to the person, within the Client, designated to be NOWDSI's privileged point of contact and who is authorised to legally bind a legal entity where adherence to this contract is made for the benefit of a legal entity.

Cloud : refers to the platform hosted on remote computer servers from which the Platform is accessible in the context of a « SaaS » deployment.

Update : refers to an update of the Platform. It incorporates improvements to the latest version of the Platform and the correction of any anomalies.

Offer : refers to any paid offer proposed by NOWDSI on the Platform.

Platform : refers to the « IOKOO » software platform, consisting of a remote IT support service, made available to the Client by NOWDSI at the following address : https://iokoo.co/.

Services : refers to the services proposed by NOWDSI as described in article 5.

Parties : refers collectively to NOWDSI and the Client.

Ticket : refers to any incident ticket opened by the Client in the context of the « Remote support » Service described in article 5.3 and invoiced in accordance with article 8.3.

User : refers to any natural person within the Client called upon to use the Platform.

Major Version : refers to a new complete commercial version of the Platform. It incorporates improvements to the previous version, new features and new application modules.

Any reference to the singular includes the plural and vice versa.

Any reference to one gender includes the other gender.

ARTICLE 3. REGISTRATION

To access the Platform, the Client is invited to create an account in accordance with the terms set out in the Platform's General Terms of Use.

ARTICLE 4. SUBSCRIBING TO AN OFFER

Once their registration is validated, the Client may use the Platform free of charge or subscribe to an Offer, under the conditions set out below.

4.1 Subscribing to an Offer

If the Client wishes to subscribe to an Offer, they will select the Offer they wish to order from the Platform, and click on "Subscribe to the Offer".

To place an order, the Client accurately completes a form in which they provide their billing information (company name, billing address). The Client remains solely responsible for the accuracy of the information provided. An order containing incomplete or erroneous information could result in errors or delays which could in no event be attributed to NOWDSI.

A purchase order will appear on screen, detailing : the nature and price of the offer selected by the Client at the prevailing rate exclusive and inclusive of tax.

After reviewing the purchase order, the Client will have the opportunity to check for any errors and to modify their order.

4.2 Final validation of the order

After reviewing the purchase order, and once all the requested information, including the billing address, has been validated and/or modified by the Client, the latter will tick the box accepting these General Terms and click on « Pay for the order ». This second click constitutes an electronic signature. This signature has the same value between the Parties as a handwritten signature. The purchase order will be recorded in NOWDSI's computer records, themselves kept on a reliable and durable medium, and will be considered as proof of the contractual relations entered into between the Parties.

The Client may proceed with payment of the Offer under the conditions of article 8.

4.3 Order summary

Once they have validated their payment method on the Platform, a summary of the Client's order will be displayed and will mention in particular the transaction number. The sale will only be considered final and the Contract concluded after the display of the order summary by NOWDSI, which serves as acknowledgement of receipt of the order (hereinafter « the Contract »).

4.4 General provisions

Unless proven otherwise, the data recorded by NOWDSI constitutes proof of all transactions.

In any event, NOWDSI reserves the right to refuse any order in the event of an existing dispute with the Client, or of total or partial non-payment of a previous order by the Client. NOWDSI's liability cannot then be engaged.

The benefit of the order is personal to the Client and may not be assigned without NOWDSI's agreement.

Any modification requested by the Client can only be taken into consideration if it is received in writing before the Platform and/or the Services are made available, it being specified that NOWDSI alone reserves the right to act on such a request.

ARTICLE 5. SERVICES

5.1 NOWDSI undertakes to apply the utmost care, in compliance with the rules of its profession, to the accomplishment of its Services, for the performance of which it undertakes to devote the necessary means. NOWDSI's obligations depend on the mission entrusted to it.

5.2 Making the Platform available

The Platform is made available to the Client by NOWDSI on the Cloud.

Access to the Platform will be carried out by the Client on its own equipment with the required configuration and under its own responsibility, in accordance with the instructions given by NOWDSI. Thus, the Client is informed that access to the Platform in « SaaS » mode requires that it has a computer, a tablet or a smartphone as well as an internet connection.

5.3 Remote support

A paid remote support Service is proposed by NOWDSI to the Client from the Platform.

This Service allows the Client to create a Ticket and to be called back by a technician located in France, between 8:30 am and 6 pm, in order to benefit from human technical support. The technician intervenes remotely, where necessary via a remote takeover of the Client's device.

5.4 Maintenance of the Platform

NOWDSI provides a maintenance Service for the Platform.

In the absence of any provision to the contrary in the Contract, the maintenance conditions are those described below.

The maintenance Service includes the corrective maintenance and the evolutive maintenance of the Platform.

5.4.1 Corrective maintenance

Corrective maintenance consists of the correction by NOWDSI of any malfunctions that may affect the Platform.

This maintenance service is accessible by email at the address contact@iokoo.co.

The Client will designate from among its own staff a Client Administrator with whom NOWDSI may make contact.

The Client Administrator may submit an incident ticket via the email address above to notify NOWDSI of any malfunction affecting the Platform.

In all cases, the Client's request is taken into account by NOWDSI issuing an incident ticket and will be referenced by a number provided to the Client. This identification number is unique and must be quoted during any intervention.

Unless otherwise stated in the Contract, NOWDSI undertakes to contact the Client again within forty-eight (48) working hours following the recording of its request in order, in the first instance, to qualify the nature of the problem or the question raised by the Client.

An operational proposal will be given within timeframes compatible with the nature of the incident and its severity.

NOWDSI undertakes to implement the human and technical means necessary to provide, as quickly as possible, answers or solutions to the Client's requests. NOWDSI's obligations towards the Client are best-efforts obligations.

The Client undertakes to make available to NOWDSI all documents and files allowing a better understanding and diagnosis of any anomalies and undertakes to implement the means necessary to authorise the temporary remote takeover of the Platform by NOWDSI.

The Client must back up its data and files, NOWDSI disclaiming all liability in the event of accidental destruction of the Client's data during maintenance operations.

NOWDSI will not be required to provide the maintenance subscribed to by the Client in the following cases :

• non-payment of the price, as defined in article 8.1, by the Client ;
• deterioration caused by abusive use, negligence or handling errors on the part of the Client ;
• use of the Platform not in conformity with the associated documentation and the instructions provided by NOWDSI ;
• intervention by the Client or a third party on the Platform not authorised by NOWDSI.

5.4.2 Evolutive maintenance

NOWDSI provides the Client, automatically as and when they are produced, with the Major Versions and Updates of the Platform.

5.5 Data hosting

NOWDSI provides a hosting Service for the data passing through the Platform by NOWDSI. The Client is informed that the hosting Service is subcontracted by NOWDSI to a third-party provider that hosts its data on its servers.

5.6. Any exceeding of the deadlines in the performance of the Services may not give rise to any modification of the price and/or of the payment conditions of the Services. Furthermore, and in any event, the Client may never engage NOWDSI's liability if the delay is caused by the Client's negligence in providing the elements necessary for NOWDSI to perform its mission.

ARTICLE 6. CLIENT'S OBLIGATIONS

It is incumbent upon the Client :

• to declare complete and accurate information when placing its order, and to update it in the event of any change ;
• to designate a competent Client Administrator who remains NOWDSI's point of contact throughout the duration of the Service ;
• to ensure that the necessary instructions reach NOWDSI in good time to enable it to normally fulfil its Service ;
• to deliver, or have delivered by its partners, within the agreed timeframes, all working documents, files, elements (etc.) necessary for the performance of the Services ;
• to use the Platform solely within the scope of its professional activity and, in any event, not to use it for purposes not provided for by these general terms ;
• not to usurp an identity nor attempt to log in to an account other than its own ;
• not to engage in analyses of the system comparable to reverse engineering ;
• not to upload viruses or files potentially dangerous to the integrity of the Platform ;
• to ensure that the content published on the Platform complies in all respects with the applicable regulations.

ARTICLE 7. LICENCE AND RIGHTS GRANTED TO THE CLIENT

NOWDSI grants the Client the possibility of using the Platform in accordance with the Platform's General Terms of Use communicated to the Client at the time of its registration under the conditions of article 3.

The Client stands surety for the proper compliance by the Platform's Users with the provisions set out in the General Terms of Use.

No right other than those referred to in the General Terms of Use is granted to the Client.

ARTICLE 8. PRICE AND PAYMENT OF THE PRICE

8.1. In the event that the Client wishes to subscribe to an Offer, the price is the one shown in the Contract accepted in accordance with article 4. The price is always understood exclusive of tax and in euros.

The price is composed of :

• a subscription corresponding to the making available of the Platform and the associated maintenance and hosting Services ;
• a fixed and flat-rate amount per Ticket created by the Client in the context of the « Remote support » Service described in article 5.3.

The Client has the possibility of subscribing to an annual subscription or a monthly subscription, it being specified that the price differs according to the type of subscription.

8.2 The price of the subscription may be revised annually by NOWDSI according to the SYNTEC index following this formula : P1=P0x(S1/S0) where P1 is the revised price of the subscription, P0 is the reference price, it being understood that the reference price is, for the first year, the price at the date of signature and, for subsequent years, the revised price (P1) of the previous year, S0 is the last SYNTEC index published at the date of the previous price revision and S1 is the last SYNTEC index published at the date of the price revision.

At each anniversary date of the Contract, NOWDSI reserves the right to re-evaluate its prices, in particular in the event of currency fluctuation, significant improvement of the Platform including new services, or an increase in supplier rates. Failing agreement on the new rates, the Client may terminate the Contract under the conditions of article 14.

8.3 The invoicing conditions depend on the subject of the order.

In the case of an annual subscription, the Client is invoiced at the time of subscribing to the Offer, then each year at the beginning of the period.

In the case of a monthly subscription, the Client is invoiced at the time of subscribing to the Offer, then each month at the beginning of the period.

Tickets are invoiced on the basis of the prevailing price.

In the absence of any clause to the contrary, all invoices issued by NOWDSI are payable by bank card or direct debit within a period of thirty (30) days from the date of issue of the invoice.

No discount is granted for early payment.

Unless otherwise stipulated, the price is understood to be exclusive of any surcharge. Thus, if a particular request from the Client relating to the staff assigned to the performance of the Services and/or a modification of the schedule were to generate an additional cost for NOWDSI (an increase in staff remuneration, for example), this additional cost would be borne in full by the Client.

8.4. Any sum not paid within the prescribed time limits will bear interest at a rate equal to the interest rate applied by the European Central Bank to its most recent refinancing operation increased by 10 percentage points, and will give rise to the payment of a flat-rate sum of 40 euros for recovery costs. Late-payment penalties are payable from the first day of delay without a formal notice being necessary and run until full payment of all sums due, interest included.

8.5. The Client may not invoke any cause whatsoever to defer or modify the payment conditions or request a price reduction, in particular a dispute over the quality or non-conformity of the Services. In the event of failure to pay within the prescribed time limits and 48 hours after an unsuccessful formal notice, NOWDSI will have the right to demand immediate payment of the outstanding balance, to suspend the performance of its obligations, without prejudice to claiming damages and/or termination of the Contract in accordance with article 14 below.

ARTICLE 9. INTELLECTUAL PROPERTY

9.1 The Platform is protected by copyright and by the following provisions. All intellectual property rights relating to the Platform as well as all the elements that compose it (documentation, copyrights, etc.) are the full and entire property of NOWDSI, its officers and/or partners. The Client undertakes not to infringe, directly or indirectly or through third parties with whom it is associated, the said rights.

9.2 In the event of use exceeding the use defined in the Contract and in the licence to use, the Client exposes itself to an action for infringement.

9.3 In consideration of acceptance of these general terms, NOWDSI grants the Client a personal, non-transferable and non-exclusive right to use the Platform. The right to use the Platform is exclusive of the granting of any other right and in no case entails the right to perform any act not expressly authorised, in particular the rights of copying, translation, adaptation, arrangement or any other modification of the Platform and/or its components.

9.4. Where applicable, the Client guarantees that all elements provided to NOWDSI in the context of the performance of the Services do not infringe the intellectual property rights of third parties. It indemnifies NOWDSI against any consequence of any nature whatsoever (including procedural costs, lawyers' fees, damages and indemnities, etc.) in the event that NOWDSI's liability were to be sought by a third party.

9.5 NOWDSI may mention the Client's name, acting within the scope of its professional activity, as a commercial reference, unless the latter states otherwise in writing.

ARTICLE 10. WARRANTY

10.1 NOWDSI does not guarantee the continuity and quality of the communication links with the Client. Thus, communications with the Platform in « SaaS » mode may be interrupted without notice for a reasonable period, in particular for maintenance reasons or for any event other than a fault of NOWDSI. In particular, NOWDSI cannot be held liable for failures or malfunctions found on the communication networks used.

10.2 In addition, the Client acknowledges and accepts that the Platform operates by means of an artificial intelligence system on which the proposals for resolving IT incidents are based. It acknowledges that, by nature, artificial intelligence systems are new and involve a significant element of uncertainty in their operation. In any event, they in no way make it possible to guarantee a constant reliability of the results. Consequently, NOWDSI offers no warranty and disclaims all liability towards the User regarding the consequences of the use of the artificial intelligence system on the resolution of IT incidents.

10.3 NOWDSI undertakes to apply the utmost care, in compliance with the rules of its profession, to the accomplishment of its missions. Its liability may only be engaged in the event of negligence, of which it is incumbent upon the Client to provide proof. In this respect, NOWDSI's liability may not be engaged in the event of non-performance or improper performance of the Contract by the Client.

10.4 The Client acknowledges that in no case does NOWDSI carry out the verification of the configuration of the Client's system and/or the analysis of the suitability of the Platform and/or the Services to the Client's needs. The Client acknowledges having received from NOWDSI all the information necessary to enable it to assess the suitability of the Platform and/or the Services to its needs.

ARTICLE 11. LIABILITY

11.1. In the event of doubt over the interpretation of a clause or in the absence of a mention enabling the extent of NOWDSI's obligations to be determined, the Client acknowledges that NOWDSI's obligations will be understood as best-efforts obligations.

11.2. NOWDSI may in no case have its liability engaged towards the Client when the Services delivered conform to those ordered. Conformity to the order is assessed by reference to the Contract.

Furthermore, when NOWDSI formulates, in the context of the performance of the Service, a set of recommendations and guidance, NOWDSI may in no case have its liability engaged towards the Client when these recommendations are not followed by the latter.

11.3. Any dispute by the Client of the proper performance by NOWDSI of its contractual obligations must be substantiated and be the subject of a registered letter with acknowledgement of receipt sent at the latest within the year of the date of discovery of the facts likely to found the said claim.

Failure to proceed in this way constitutes a waiver on the part of the Client of the right to criticise the proper performance by NOWDSI of its contractual obligations.

11.4. In no case, except in the event of gross negligence or wilful misconduct, will NOWDSI be liable for compensation of indirect loss (moral or commercial harm, loss of data, damage to image, loss of profit, of turnover, of orders or of clientele) that the Client might suffer as a result of the performance of the Services.

FURTHERMORE, IN ITS RELATIONS WITH THE CLIENT, IN NO CASE MAY NOWDSI'S LIABILITY EXCEED THE AMOUNT PAID BY THE CLIENT UNDER THE CONTRACT DURING THE LAST TWELVE MONTHS preceding the occurrence of the damage.

ARTICLE 12. CONFIDENTIALITY

Each of the Parties considers as strictly confidential and undertakes not to disclose any information, data, formula or concept of the other party which is made available to the other Party in any form whatsoever (written, oral, by magnetic, electronic or computer media, etc.) on the occasion of the Contract (hereinafter « Confidential Information ») for a period of five (5) years from their disclosure.

Neither Party will disclose Confidential Information concerning the other to a third party without the express and written consent of that other Party, and will not make use of any Confidential Information other than for the performance of the contract. Each Party must apply the same degree of care to the non-disclosure of Confidential Information as it applies to its own Confidential Information.

Confidential Information does not include information :

• (a) generally available to or known by the public,
• (b) previously known to the recipient,
• (c) developed independently by the recipient outside the scope of the contract formed in accordance with article 4,
• (d) lawfully disclosed by a third party, or on the occasion of testimony before a competent authority.

Both Parties will take, vis-à-vis their staff and partners, all the measures necessary to ensure the effectiveness of the obligation mentioned above.

ARTICLE 13. PERSONAL DATA

13.1 The Client is informed and accepts that, by registering on the Platform, by subscribing to an Offer, and more generally by using the Platform, NOWDSI is led to store, process and use personal data, in accordance with the provisions of the French Data Protection Act of 6 January 1978 amended by law no. 2018-493 of 20 June 2018.

The processing of this data is necessary and has as its legal basis the performance of the Contract with the Client. The information collected is strictly confidential and is intended only for the relevant departments of NOWDSI and for the providers involved in the performance of the Contract, unless the Client consents to the transmission of its personal data to third parties. It is kept for a maximum period of 5 years from the end of the contractual relationship.

In accordance with the regulations, the Client has the rights to request access, rectification, erasure, a restriction of or objection to the processing of its personal data, and the portability of its data. It also has the option of formulating directives on the fate of its data after its death and of lodging a complaint with the CNIL. The Client may exercise its rights by contacting NOWDSI at the postal address shown at the head of these terms or by email at : contact@iokoo.co.

13.2 In the context of the provision of the Services, NOWDSI may be led to process personal data of Users or third parties in the capacity of processor of personal data. In this context, the terms set out in the Annex to these terms will apply.

13.3 Furthermore, to carry out the Services, the Client is informed that NOWDSI may call upon subcontractors of its choice. The Client acknowledges and accepts that, in the context of a subcontracting operation, NOWDSI will be led to transmit personal data of the Client and/or of the Users to the subcontractor. In this context, NOWDSI undertakes to comply with the regulations on the subcontracting of personal data.

ARTICLE 14. DURATION - TERMINATION

14.1. In the event of subscription by the Client to a monthly subscription, the Contract is concluded with no minimum duration and may be terminated by the Client at any time without notice, it being specified, however, that any month started is due.

In the event of subscription by the Client to an annual subscription, the Contract is concluded for an initial duration of twelve (12) months. At the end of this initial duration, the Contract is tacitly renewed for successive periods of twelve (12) months, unless terminated by one or other of the Parties at least three (3) months before the anniversary date of the Contract.

14.2. Notwithstanding the foregoing, each of the Parties has the right to terminate the Contract by right, by registered letter with acknowledgement of receipt, in the event of total or partial non-performance of its obligations by the other Party, in particular the non-compliance with the obligations as defined in article 6, the payment obligation, the confidentiality obligation, respect for NOWDSI's intellectual property rights and more generally the loyal performance of the Contract, thirty (30) days after a formal notice sent by registered letter with acknowledgement of receipt that has remained unsuccessful, containing a declaration by the aggrieved Party of its intention to avail itself of the benefit of this clause, without prejudice to the compensation of all direct and indirect damages that this termination might cause it.

In the event that, due to the nature of the unperformed obligation, it is not possible for the defaulting Party to remedy it (example : breach of an obligation not to do something), the Contract may be terminated by right by one or other of the Parties without prior formal notice.

ARTICLE 15. FORCE MAJEURE

15.1. Cases of force majeure will suspend the obligations of the Parties. In the event of the occurrence of such an event, the Parties will endeavour in good faith to take all reasonably possible measures with a view to continuing the performance of the Contract. If the cases of force majeure have a duration of existence exceeding sixty (60) days, this Contract may be terminated at the initiative of one or other of the Parties, with no right to compensation on either side.

15.2. The following are expressly considered as cases of force majeure : lock-out, strike, epidemic, embargo, accident, war, attack, cyberattack, fire, exceptional weather conditions, interruption or delay in transport, or any other event beyond NOWDSI's control resulting in particular in total or partial unemployment at NOWDSI, the total or partial blocking of the means of communication, including networks.

ARTICLE 16. APPLICABLE LAW - DISPUTES

All the clauses appearing in these general terms as well as all the contractual operations referred to therein are subject to French law, to the exclusion of any international convention.

ANY DISPUTE ARISING FROM THE OPERATIONS REFERRED TO HEREIN, EVEN IN THE EVENT OF A PLURALITY OF DEFENDANTS OR OF A WARRANTY CLAIM, WILL FALL WITHIN THE EXCLUSIVE JURISDICTION OF THE COMMERCIAL COURT OF PARIS (FRANCE), WHICH IS EXPRESSLY ACCEPTED BY THE CLIENT.

ARTICLE 17. TOLERANCE - PARTIAL NULLITY

17.1. No act of tolerance on the part of one of the Parties towards the other may be interpreted as a waiver of the right to avail itself of all the rights granted to it by these general terms, in particular a tolerance relating to payment deadlines.

17.2. The possible cancellation of a clause will not affect the validity of the other clauses of these terms.

ARTICLE 18. EVIDENCE

In the event of a dispute, the Parties agree to consider email and exchanges via the Platform as an original writing constituting perfect proof, and waive the right to contest this means of proof, except to dispute its authenticity.

Annex: Processing of personal data on behalf of the Client

Purpose, duration of processing and categories of data subjects.

Within the meaning of the GDPR, and for the proper application of these terms, the Client is qualified as « Data Controller » and NOWDSI is qualified as « Processor of personal data ».

In the context of the provision of the Services, NOWDSI may have access, in the capacity of processor, to personal data within the meaning of law no. 78-17 of 6 January 1978 relating to data processing, files and freedoms and of European regulation 2016/679 of 27 April 2016 relating to personal data (hereinafter referred to as the « Regulation »). NOWDSI may thus be led to carry out processing of such data on behalf of the Client, the data controller, for the sole purposes of providing the Services and for the duration provided for in the Contract.

Table of processing operations carried out by NOWDSI on behalf of the Client

Nature of the processing operations : Access, collection, use, backup, deletion.

Purpose(s) of processing : Provision of the Services, namely the making available of the Platform, the carrying out of maintenance and hosting operations.

Categories of data subjects : Users of the Platform ; the Client's staff.

Categories of Personal Data : May include all types of information provided at the Client's initiative in the context of the use of the Platform (and in particular the artificial intelligence system), in particular :

• Identification data (Title/surname/first name)
• Professional-life data (Position, Professional email address, Professional telephone number)
• Connection data (IP address, browsing history, logs)
• Location data (Geographical position)

Location(s) of the processing operations : European Union.

Duration of the processing operations : Duration of the Contract.

Register

NOWDSI keeps the required registers, the content of which is defined by article 30(2) of the Regulation, and makes them available on request.

Data protection officer

NOWDSI's data protection officer can be contacted at the following details : contact@iokoo.co.

Client's obligations towards NOWDSI

The Client undertakes to :

• comply with the obligations incumbent upon it in its capacity as data controller, under the provisions of the Regulation ;
• document in writing any instruction concerning the processing of data by NOWDSI ;
• provide NOWDSI with any information necessary for the creation of NOWDSI's register of processing activities. The Client remains solely responsible for the processing of the information and instructions communicated to NOWDSI ;
• implement the appropriate technical and organisational measures to ensure the security of the resources, systems, applications and operations that do not fall within NOWDSI's scope of responsibility as provided for in the Contract ;
• ensure, prior to and throughout the duration of the processing, compliance with the obligations provided for by the Regulation on the part of NOWDSI ;
• undertake to respond within a period of fifteen (15) days to any request from NOWDSI relating to the processing of personal data in the context of the provision of the Services ;

NOWDSI's obligations towards the Client

NOWDSI guarantees that it implements all the measures necessary to preserve the security, integrity, availability, resilience and confidentiality of the personal data to which it might have access or which might be communicated to it in the context of the performance of the Contract. Accordingly, NOWDSI undertakes to take all the measures required under article 32 of the Regulation and in particular the appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, that would be necessary for compliance by itself and by its staff with these obligations of security, integrity and confidentiality, and in particular to :

• process and consult this personal data and these files only within the framework of the Client's instructions, including with regard to transfers of personal data to a third country or an international organisation, unless it is required to do so under European Union law or French legislation ; in this case, NOWDSI will inform the Client of this obligation before processing, unless the law prohibits such information on important grounds of public interest ;
• not process or consult the said personal data or the files in which it appears for purposes other than the performance of the Services it carries out for the Client under the Contract ;
• not insert into the processing of personal data any data foreign to the said processing ;
• take any measure to prevent any misuse, malicious or fraudulent use of this personal data and of the files ;
• take all useful precautions in order to preserve the security of the said personal data, to ensure that it is not distorted or damaged, that unauthorised third parties do not have access to it, and to prevent any access that has not been previously authorised by the data controller ;
• take all measures in order to (i) guarantee the constant confidentiality, integrity, availability and resilience of the processing systems and services used, (ii) restore the availability of the personal data and access to it within appropriate timeframes in the event of a physical or technical incident, and (iii) regularly test, analyse and assess the effectiveness of these measures ;
• refrain from the consultation and processing of personal data other than that concerned by these terms and this, even if access to this personal data is technically possible ;
• ensure that the persons authorised to process the personal data undertake in writing to respect the confidentiality of the latter or are subject to an appropriate legal obligation of confidentiality, and receive the necessary training in personal data protection ;
• not disclose, in any form whatsoever, all or part of the said personal data ;
• not take a copy of or store, in any form and for any purpose whatsoever, all or part of the said personal data contained on the media or documents entrusted to it or collected by it during the performance of the Contract (apart from the technical operations strictly necessary for the performance of the Contract).

Collaboration

NOWDSI also undertakes to cooperate with the Client with a view to :

• warning it as soon as possible of any requests from data subjects received, and to cooperate reasonably with it in order to enable it to comply with its obligations under the Regulation in relation to such requests. The Client will bear all reasonable costs arising from the assistance that NOWDSI provides with regard to compliance with such obligations ;
• the Client's compliance with its own obligations regarding the security and confidentiality of personal data ;
• compliance with the obligation to notify the supervisory authority and to inform the data subject of a personal data breach. NOWDSI will notify the Client in writing by any means of any personal data breach as soon as possible after becoming aware of it, and at the latest within a period of 72 hours. The notification will (i) describe the nature of the incident, (ii) describe the likely consequences of the incident, (iii) describe the measures taken or proposed by NOWDSI and/or its subsequent Processor in response to the incident, and (iv) specify who is the point of contact at NOWDSI ;
• informing the Client as soon as possible if, in its opinion, an instruction constitutes a breach of the Regulation or of other provisions of European Union law or of the law of the Member States relating to data protection ;
• the carrying out of data protection impact assessments or in the event of prior consultation of the CNIL by the Client.

Deletion and reversibility of data

At the end of the Contract, NOWDSI undertakes to return the files held and the personal data processed on behalf of the Client under the conditions provided for in the Contract, and to destroy all manual or computerised files storing the said files and personal data (and any copy thereof), after having ensured with the Client that the latter does indeed have this information, unless a request issued by a competent legal or judicial authority, or the applicable law of the European Union or of a Member State of the European Union, requires otherwise.

Subsequent processors

Under these terms, NOWDSI may call upon another processor (hereinafter « the subsequent Processor ») to entrust to it all or part of the missions entrusted to it under the Contract. The Client is informed by any means of the identity, contact details and activities entrusted to the subsequent Processor. Any changes of subsequent Processors will be notified to the Client as soon as possible.

The subsequent Processor is required to comply with the obligations of the Contract on behalf of and according to the instructions of the Client. In this respect, NOWDSI undertakes to pass on all of its obligations to the subsequent Processor and to verify that it presents the same guarantees as regards the implementation of technical and organisational measures, so that the processing of personal data meets the requirements of the Regulation.

As at the day of conclusion of the Contract, the Client is informed that NOWDSI subcontracts the carrying out of certain Services or services to :

Identification of the subsequent Processors : Categories of subcontracted activities : Hosting.

Security and confidentiality

With regard to the security and confidentiality of personal data, NOWDSI undertakes to (i) keep the personal data strictly confidential, (ii) implement within its services, including its hosting infrastructure, the appropriate organisational and technical measures in order to protect the personal data, and (iii) establish, maintain and provide on request the description of the measures implemented to protect the personal data (it being recalled that the Client is solely responsible for the security, the access procedures and the protection of personal data on its own information system).

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons whose degree of probability and severity varies, the parties will put in place appropriate technical and organisational measures, in order to ensure a level of security adapted to the risks, including in particular, as needed :

• means to guarantee the constant confidentiality, integrity, availability and resilience of the processing systems and services ;
• means to restore the availability of the personal data and access to it in good time in the event of a physical or technical incident ; and
• a procedure to regularly test, analyse and assess the effectiveness of the technical and organisational measures, in order to ensure the security of the processing.

When assessing the appropriate level of security, particular account should be taken of the risks presented by the processing, related in particular to the destruction, loss, alteration, unauthorised disclosure of personal data transmitted, stored or otherwise processed, or to access to such data, whether accidental or unlawful. The Parties will take measures to ensure that any natural person acting under the authority of one or other Party and having access to the personal data processes it only on instruction from that Party, unless it is required to process it by Union or Member State law.

For more information on the technical measures implemented by NOWDSI to ensure the security of personal data, the Client is invited to contact NOWDSI.

Control and audit

The Client reserves the right to carry out, at its own expense, any verification that may appear useful to it to ascertain NOWDSI's compliance with its obligations under these terms, in particular by means of audits or inspections. These verifications may be carried out a maximum of once a year, by the Client itself or by a third party that it will have selected, commissioned and mandated for this purpose, not a competitor of NOWDSI. In this context, NOWDSI will make available to the Client or to the said third party the information necessary to provide proof of compliance with the obligations provided for within this Contract, and undertakes to contribute to the said verifications. The audits must allow an analysis of NOWDSI's compliance with these terms and with the applicable provisions on personal data protection, and in particular to ensure that adequate technical and organisational security and confidentiality measures are implemented, that they cannot be circumvented without this being detected and that, in such an event or in any other event of the occurrence of a personal data breach, a notification and handling procedure by NOWDSI is implemented in order to remedy it without delay. More generally, each of the Parties guarantees to the other compliance with the legal and regulatory obligations incumbent upon it regarding personal data protection.

Data transfer

As the Client's data is hosted in the European Union, it is not intended to be transferred outside the European Union. However, in the event that NOWDSI and/or its subsequent Processors were led to carry out processing of personal data outside the European Union in the context of the performance of the Services, NOWDSI will in any event ensure that this transfer is carried out to a country that has been the subject of a binding adequacy decision on the part of the European Commission or of the competent national data protection authority, or, failing that, that such a transfer is subject to an appropriate transfer mechanism, ensuring an adequate level of protection within the terms of the Regulation.

Liability

In any event, it is recalled that the Services provided by NOWDSI constitute a contributing but not sufficient element to the Client's compliance with all the regulatory requirements regarding data protection, and that NOWDSI's liability regarding compliance with the regulations is strictly limited to the scope of the Services operated by it. The Client must have, without this list being exhaustive, an information system adapted to the processing of personal data, a risk and impact analysis where applicable, a security policy for its information system, a charter for the use of IT resources, a programme for the training and awareness-raising of its users on security and data protection, under its sole responsibility. In no case may NOWDSI's liability be sought in the event of non-compliance by the Client with the organisational and technical measures for personal data protection incumbent upon it, nor more generally in the determination by it of the categories of data collected and/or uploaded by it within the services, of the purposes pursued and of the processing implemented by it or at its request.