Data Processing Agreement

This agreement (“DPA”) is entered into between the Organization, as controller, and LA MASHINE, a simplified joint-stock company with a share capital of 30,000 euros, Toulouse Trade and Companies Register 932 458 441, as processor. It governs the personal data La Mashine processes on behalf of the Organization in the platform https://app.lamashine.com/, in accordance with Article 28 of Regulation (EU) 2016/679 (“GDPR”). It is part of the Organization’s contract; its accepted special provisions prevail over these general provisions.

1. Subject matter, duration, nature and purpose

La Mashine provides the Organization with a platform for supporting projects: accounts and permissions, projects, tasks and documents, meetings with recording, transcription and meeting notes, assistance by artificial intelligence and sending of e-mails. The sole purpose of the processing is to provide this service. La Mashine acts, however, as a controller, on its own account and without reusing project content, for the security of the platform and its logs, measuring the cost of artificial intelligence per account, invoicing, aggregated usage statistics and the messages users send it; this processing is described in its privacy policy. La Mashine uses no data to train models and does not authorize its sub-processors to do so. The processing carried out on behalf of the Organization lasts for the term of the contract, then for the return and deletion set out in Section 10.

2. Data subjects and personal data

Data subjects: the users the Organization invites (founders, coaches, program managers, experts, juries) and the people mentioned in the content or present at a meeting.

Data: identity and work contact details, roles and permissions, project content (texts, files, messages, decisions), audio recordings, transcripts and notes of meetings, access and usage logs, proof of agreement to recording.

The platform is not designed to receive special categories of data or data relating to criminal convictions and offences (Articles 9 and 10 GDPR), data about minors, identity documents or official identifiers, authentication secrets or payment card data; the Organization and its users do not enter them. An accidental upload is reported to La Mashine, which restricts and deletes it.

3. Documented instructions

La Mashine processes the data only on the Organization’s documented instructions, including for transfers outside the European Economic Area, unless required to do so by Union or Member State law to which La Mashine is subject; in such a case, it informs the Organization of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The contract, this agreement and the platform settings the Organization chooses are its instructions. La Mashine immediately informs the Organization if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

4. Confidentiality

The people authorized to process the data have committed to confidentiality or are under a statutory obligation of confidentiality. Their access is limited to what their task requires.

5. Security

La Mashine implements the measures of Article 32 GDPR described in Annex 1 and maintains them for the whole term of the contract.

6. Sub-processors

The Organization gives a general authorization to use the sub-processors listed in Annex 2. La Mashine informs it in writing of any addition or replacement at least thirty days in advance; the Organization may object on data protection grounds. Failing agreement, it may terminate the service concerned without penalty. Each sub-processor is bound by contract to the same data protection obligations, with one exception: Anthropic keeps, under its own terms described in Annex 2, the content flagged by its safety systems; the Organization accepts this by using the Anthropic configuration, and the EU configuration excludes it; La Mashine remains fully liable to the Organization for their performance, informs it of any failure by a sub-processor to meet its obligations and gives it on request a copy of the terms that bind it, redacted only of business secrets and confidential information.

7. Transfers outside the European Economic Area

Data is transferred outside the European Economic Area only to the recipients and countries listed in Annex 2, on the basis of an adequacy decision of the European Commission or of the standard contractual clauses it has adopted. When the Organization has chosen the EU configuration, no processing by artificial intelligence takes place outside the European Union.

8. Assistance to the Organization

La Mashine assists the Organization, through appropriate technical and organizational measures, in responding to requests to exercise data subjects’ rights (access, rectification, erasure, restriction, portability, objection). It forwards to the Organization within five working days any request it receives directly, without answering it itself unless instructed. It also assists the Organization with security, breach notifications, impact assessments and prior consultation of the CNIL (Articles 32 to 36 GDPR). It informs the Organization without delay if it finds that data it processes is inaccurate or outdated, and answers its questions about the processing promptly.

9. Personal data breaches

La Mashine notifies the Organization of any personal data breach no later than 48 hours after becoming aware of it, by e-mail to the contact named in the Special Conditions. The notification describes, where possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed and the details of a contact from whom more information can be obtained; missing information follows as soon as it is known. The Organization notifies the CNIL and, where required, the data subjects.

10. End of the contract and non-compliance

At the end of the contract, the Organization chooses whether the data is returned or deleted. The return includes an export of the text data in JSON format and the related files in their original format. The data remains retrievable for at least thirty days after the end of the transition period set in the Terms of Use or, where the Special Conditions so provide, during a restricted retention of at most twelve months for a return or a renewal. It is then deleted within thirty days, its backup copies when their seven-day cycle expires, and the raw exchanges with the models when their ninety days expire; the copies Anthropic keeps follow the conditions in Annex 2. La Mashine confirms the deletion in writing. Only data that Union or Member State law requires to be kept is retained, for the period that law sets. Until the data is returned or deleted, this agreement continues to apply.

If La Mashine breaches this agreement, the Organization may ask it to suspend the processing until it complies; La Mashine informs the Organization without delay if it is unable to comply, for whatever reason. The Organization may terminate the part of the contract that concerns this processing if compliance is not restored within a reasonable time and at the latest one month after the suspension, in the event of a serious or persistent breach, or if La Mashine fails to comply with a binding decision of a court or of the CNIL. La Mashine may terminate it if the Organization maintains an instruction that La Mashine has reported to it as unlawful.

11. Documentation and audits

La Mashine makes available to the Organization the information needed to demonstrate compliance with Article 28 GDPR. It allows audits, including inspections, by the Organization or by an auditor it appoints, bound by confidentiality and not a competitor of La Mashine, at most once a year, except where there are indications of non-compliance, after a data breach or at an authority’s request, with thirty days’ notice. Each party bears its own costs. This information and the results of audits are made available to the CNIL on request.

12. The Organization’s obligations

The Organization gives its instructions in writing, informs the data subjects (Articles 13 and 14 GDPR), has a legal basis for each processing operation and ensures that the data it enters in the platform is accurate and necessary.

13. Records and contacts

La Mashine keeps the record of processing carried out on behalf of the Organization (Article 30(2) GDPR) and cooperates with the CNIL. La Mashine’s contact: contact@lamashine.com. The Organization’s contact: the one named in the Special Conditions.

Annex 1. Security measures

Encrypted communications between browsers and the platform, HTTPS enforced. The platform, database, files and backups hosted by OVH in France. The database can be reached only from the platform’s private network; only the website, the meeting room and administration by SSH key, without passwords, are open to the internet, behind a firewall. Files encrypted at rest (AES-256), each storage space opened only by its own key; database backups encrypted and copied to a second site in France. The database can be restored to any moment of the last two days; backups renewed on a cycle of at most seven days.

Partitioning: an organization reaches a project’s data only through the program the project is enrolled in; each person reaches only what their role allows.

Account protection: passwords of at least twelve characters, following the CNIL’s recommendation, stored as hashes (Argon2id); after ten failed sign-in attempts, sign-in is refused for one hour; fourteen-day sessions, revoked when the password changes. Access to projects is logged, including the La Mashine team’s, and the log is kept for twelve months. The checks (tests, a dependency audit) run before each production release, which deploys only a version already running on staging. In the event of an incident, the access concerned is revoked within the hour, its extent is measured the same day from the logs, and the Organization is informed within the time limits of Section 9.

Artificial intelligence: detected e-mail addresses and phone numbers are removed automatically from texts before they are sent to a model, including text read from images; the content of an image or scanned document sent as it is to a model is not filtered; raw exchanges with the models are kept for ninety days at OVH in France, under restricted technical access, then deleted. Error reports contain no user, cookies, headers or request content; they contain the error message and the page address.

Annex 2. Sub-processors

OVH SAS: hosting of the platform, database, files, backups and logs. France.

Anthropic, PBC: assistance by artificial intelligence and drafting of meeting notes in the Anthropic configuration, and web search in this configuration when Amazon’s is not available. United States and other countries where Anthropic and its own sub-processors operate, including the worldwide infrastructure of Google Cloud, Amazon Web Services and Microsoft Azure, listed by Anthropic at https://trust.anthropic.com/subprocessors; standard contractual clauses incorporated in its commercial terms, for all these countries. Content deleted within thirty days, except where the law requires otherwise or for content flagged by its safety systems, kept up to two years, and seven years for classification scores.

Mistral AI: audio transcription; reading text in images in the EU configuration; assistance by artificial intelligence in the EU configuration. European Union.

Requesty Ltd: fallback gateway to authorized deployments only. Gateway in Frankfurt (European Union); company established in the United Kingdom, a country covered by an adequacy decision.

TensorX Ltd, via Requesty: fallback for the EU configuration. Ireland.

Google (Vertex AI), via Requesty: fallback for the Anthropic configuration. European Union.

Brevo SAS: sending of the platform’s e-mails. France (OVH) and Belgium (Google Cloud); maintenance possible from companies of its group in India and the United States.

Sentry: error diagnostics, from the error message and the page address. European Union region.

Amazon Web Services: web search from the question worded by La Mashine. Ireland.

Anthropic, Google, Sentry and Amazon Web Services are companies established in the United States or depending on one: transfers to them rely on the European Commission’s standard contractual clauses and, for those certified under it, on the adequacy decision for the EU–US Data Privacy Framework. Brevo may involve companies of its group in India for maintenance, under standard contractual clauses and supplementary measures, and in the United States, under the EU–US framework. The messages users send La Mashine, by e-mail or through the platform, are its own processing and are not in this list.