Data processing agreement (DPA)

1. Parties and formation of the agreement

The agreement is entered into between:

• the merchant that has taken out a subscription, whose identity is the one given at sign-up (the “Controller”);
• MALEDA SAS, SAS, 17 rue de la caserne, 57710 Aumetz, France, 123456TEST12345 (“Maleda” or the “Processor”).

It is accepted electronically together with the terms of use and sale, of which it forms part. The accepted version and the date of acceptance are recorded. It applies to each of the merchant’s businesses. In the event of a conflict on the processing of personal data, this agreement prevails over the terms of use and sale.

2. Purpose

Maleda processes, on behalf of the Controller and on its documented instructions, the personal data of its customers only to the extent necessary to provide the Service: hosting the shop’s website, online booking, pick-up orders, sending e-mails and notifications, and managing deposits through Stripe Connect.

The Controller remains responsible for the lawfulness of the collection of this data, for informing its customers (Articles 13 and 14 of the GDPR) and for the choice of purposes. For other processing (merchant account, invoicing, security, directory, verification of the address and the company, referral programme), Maleda is itself the controller: see the privacy policy.

This other processing is outside the scope of this agreement. It does, however, involve providers that receive no customer data, listed in Annex 3 for information: in particular the public services that verify the merchant’s address and the existence of the company, and Stripe for the payout of referral commissions.

3. Duration

The agreement takes effect on acceptance of the terms of use and sale and lasts as long as the subscription. It continues after the end of the contract for the return and deletion of data (“Fate of data” article).

4. Nature, purpose, data and data subjects

The nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

5. Controller’s instructions

Maleda processes data only on the Controller’s documented instructions. The contract, the use of the Service and its settings, and written requests sent to contact@maleda.eu constitute these instructions.

Maleda immediately informs the Controller if it believes that an instruction infringes the GDPR or another data protection rule. It does not process the data for its own purposes, except where required by law, in which case it informs the Controller where the law permits.

The Controller refrains from collecting, through the free-text fields of the Service (service, order note, etc.), sensitive data within the meaning of Article 9 of the GDPR (health, opinions, etc.), unless there is a real need and an appropriate legal basis.

6. Confidentiality

Maleda ensures that the persons authorised to process the data have committed to confidentiality (by contract or legal obligation) and process it only to perform the Service. A shop’s data is not accessible to any other merchant.

7. Data security

Maleda implements the technical and organisational measures listed in Annex 2, to ensure a level of security appropriate to the risk (Article 32 of the GDPR). It updates them in line with the state of the art, without reducing the overall level.

8. Sub-processors

The Controller gives Maleda a general authorisation to use the sub-processors listed in Annex 3.

Maleda informs the Controller of any addition or replacement of a sub-processor at least 30 days in advance, by e-mail or by an update of Annex 3 accompanied by a notice in the Merchant area. The Controller may object, on reasonable data-protection grounds, within that period, by writing to contact@maleda.eu. The parties then seek a solution; failing that, the Controller may cancel the subscription concerned, free of charge (cancellation takes effect at the end of the Paid period, or earlier if the change is implemented).

Maleda imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement, and remains liable to the Controller for the performance of those obligations.

9. Data subjects’ rights

Maleda assists the Controller, by appropriate technical and organisational measures, in responding to requests to exercise individuals’ rights (access, rectification, erasure, restriction, portability, objection). The Controller can view, correct and delete the bookings and orders of its shop from its Merchant area.

If a person contacts Maleda directly about data processed on behalf of the Controller, Maleda tells them to contact the Controller and forwards the request within 5 working days, without answering it itself unless instructed otherwise.

On request, Maleda provides the Controller with a copy or export of the data concerned, within a reasonable time not exceeding 15 days.

10. Personal data breach

Maleda notifies the Controller of any personal data breach affecting the data processed on its behalf, without undue delay and at the latest 48 hours after becoming aware of it, by e-mail to the account address. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences and the measures taken or proposed. Missing information is provided as it becomes available.

It is for the Controller to assess whether it must notify the breach to the supervisory authority (within 72 hours) and to the data subjects; Maleda assists it. Maleda takes without delay the measures needed to contain the breach and limit its effects.

11. Assistance

Maleda assists the Controller, taking into account the nature of the processing and the information available to it, in complying with its obligations on security, breach notification, data protection impact assessment (DPIA) and prior consultation of the supervisory authority (Articles 32 to 36 of the GDPR). It makes available to the Controller the information necessary to demonstrate compliance with this agreement.

12. Audits

The Controller may verify compliance with this agreement: first on the basis of the information that Maleda makes available (documentation, description of security measures, reports or certifications of sub-processors), then, if this information is not sufficient or in the event of a proven breach, through an audit carried out by it or by an independent auditor bound by confidentiality.

The audit is announced in writing at least 30 days in advance, is limited to the processing concerned, takes place during working hours without disrupting the Service or compromising the security of other customers’ data. Each party bears its own costs; Maleda’s reasonable costs are borne by the Controller, unless a breach is found.

13. Fate of data at the end of the contract

At the end of the contract, whatever the cause, Maleda, at the Controller’s choice expressed in writing, returns the data to it or deletes it, and then destroys existing copies, within 30 days of the end of the contract (or of the request, if later), unless Union or Member State law requires their retention.

Failing a choice, the data is deleted within that period. Database backups, kept for 14 days, are purged at the latest 14 days after the deletion. Maleda confirms the deletion on request.

14. Transfers outside the European Union

Maleda does not transfer data outside the European Union, except to a sub-processor in Annex 3 and under the safeguards of Article 46 of the GDPR: an adequacy decision (EU–US Data Privacy Framework) or the Commission’s standard contractual clauses, supplemented where necessary by additional measures. [TO BE COMPLETED: confirm, for each sub-processor, the safeguard relied on]

15. Liability

Each party is liable for its breaches of the GDPR and of this agreement under Article 82 of the GDPR, without prejudice to the rights of data subjects. As between them, Maleda’s liability under this agreement is subject to the limitations of the “Limitation of liability” article of the terms of use and sale, except where the law sets them aside.

The Controller indemnifies Maleda against the consequences of an unlawful instruction or of a failure to inform its customers that is attributable to it.

16. Governing law and jurisdiction

This agreement is governed by French law and, for disputes, by the same rules of jurisdiction as the terms of use and sale (competent courts of the place where the publisher has its registered office). The mandatory rules of the GDPR apply in any event.

17. Annex 1: description of the processing

18. Annex 2: security measures

Confidentiality and access

• Data partitioned by shop: every business record carries the shop identifier, determined by the server (never by a form field); every change is filtered by shop and by identifier.
• Passwordless merchant authentication: one-time link and code, 15-minute expiry, 5 attempts, limit on sends per hour and per address, identical response whether or not the address exists.
• Only fingerprints (SHA-256) of links, codes and session tokens are kept; sessions of 30 days at most, “httpOnly” cookie.
• Social network access tokens encrypted (AES-GCM); customers’ cancellation link stored as a fingerprint.
• Production access limited to authorised people; secrets kept in the server environment, never in the code.

Integrity and availability

• Encryption of data in transit (HTTPS, automatic certificates).
• Server-side validation of all input; prices and amounts recalculated on the server.
• Payment events signed and processed only once (idempotence).
• Daily database backups, kept for 14 days; monitoring of the service’s health.
• Photos re-encoded and stripped of their metadata.

Traceability and organisation

• Logging of server access and errors.
• Security updates of components; separation of development and production environments; no real data in tests.
• Incident management and breach notification procedure (“Personal data breach” article).

19. Annex 3: authorised sub-processors

The following providers supply functions of the Service without receiving customer data: Anthropic (the Assistant’s AI model: the merchant’s request, product names), OpenStreetMap / Nominatim and Photon (geocoding and verifying the shop’s address outside France), the Base Adresse Nationale (verifying addresses in France), the business directory / SIRENE database (existence of French companies) and the European Commission’s VIES (European VAT numbers): these services receive only the shop’s address and business number; Stripe Connect for the payout of referral commissions to referrers (no customer data); Google (the merchant’s Google sign-in, reviews, Street View: the visitor’s browser may connect to Google when Street View is displayed), Meta (the merchant’s posts on its social networks).