Data processing agreement (DPA)

1. Subject matter, duration, nature and purpose

• Subject matter: providing the Connexus partner program management service.
• Duration: the term of the contract, plus the return or deletion period in article 8.
• Nature and purpose: hosting, storing, viewing, formatting and transmitting data so that the customer can use the service.
• Data subjects: the customer’s partners, applicants to a partner program, contacts, leads and users.
• Data categories: identity, contact details, professional data, content and history entered in the service.
• The service may score applications with the customer’s AI provider and, if the customer enables a threshold, automatically approve an application; no rejection is automatic.

2. Instructions and confidentiality

Connexus processes data only on the customer’s documented instructions, including with regard to transfers to a third country; the contract and the use of the service express them. Connexus immediately informs the customer if, in its opinion, an instruction infringes the GDPR or other applicable provisions. Persons authorized to process the data are bound by confidentiality.

3. Security measures

• Data hosted with Supabase, in the European Union (Paris, France).
• Encryption of AI keys and integration secrets entered by the customer.
• Access controls designed to isolate each organization’s data.
• Time-stamped audit log of main actions, with no guarantee of completeness.

4. Sub-processors

The customer authorizes the following sub-processors: Supabase (database hosting), Vercel (website and web application hosting), Stripe (payment) and Resend (transactional e-mails). Connexus imposes on each sub-processor, by contract, the same data protection obligations and remains fully liable to the customer for their performance. Connexus informs the customer in writing of any addition or replacement of a sub-processor at least 30 days in advance. The customer may object in writing on reasonable grounds within that period; if no solution is found, it may terminate without charge.

The AI providers and integrations that the Customer enables with its own keys (for example OpenAI, OpenRouter, HubSpot, Slack, Pappers) act under its contract and are not sub-processors of Connexus.

5. Transfers outside the European Union

Sub-processors established outside the European Union (Vercel, Stripe, Resend and the Supabase company) are covered by the European Commission’s standard contractual clauses or, for a certified provider, by the EU–US Data Privacy Framework. The mechanism used for each provider and a copy of the safeguards are provided on request at tannous@connexus.fr.

6. Assistance and breach notification

• Connexus helps the customer respond to data subject requests and comply with the obligations of articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it.
• Connexus notifies the customer of any personal data breach without undue delay after becoming aware of it, with the information available to it, so that the customer can meet its own obligations.

7. Audits

Connexus makes available the information needed to demonstrate compliance with its obligations and allows audits, including inspections, by the customer or an auditor it mandates, on reasonable terms agreed in advance.

8. Deletion or return of data

During the contract, on the customer’s written request, Connexus provides an export of its data in a structured format. At the end of the contract, the customer may request in writing, for 30 days, an export of its data in a structured format; Connexus then deletes its data within the following 30 days. Backups are purged by rotation within 30 days. Excepted are data the law requires to be kept (notably invoices and accounting records, 10 years) and the audit log, kept 12 months, whose direct identifiers (e-mail, IP address) are erased on request.

9. Liability and governing law

The parties’ liability is governed by the terms of use and sale. This agreement is governed by French law; the Commercial Court of Lille Métropole (tribunal de commerce) has jurisdiction. For any question: tannous@connexus.fr.