Data processing agreement

Purpose and duration

Hosting and processing, on the agency's behalf, its clients' data needed for content collection, approvals and conversations, for as long as the service is used.

Data and data subjects

Data subjects: the agency's clients and their contacts. Data: identity and contact details (name, email), files, answers, approvals, messages, visit dates. No special categories of data are expected; the agency agrees not to request them without need.

Our commitments

Process data only on the agency's instructions (using the service counts as instructions); ensure confidentiality of authorised people; never use the data for other purposes.

Security measures: unguessable secret links of which only a fingerprint is kept; private files served through 60-second temporary links; account isolation enforced by the database and checked by tests; encryption in transit (HTTPS) and at rest at the host; log of sensitive actions; abuse limits.

Help the agency answer data subjects' requests (access, deletion, export) and with impact assessments.

Notify any personal data breach to the agency without undue delay, and at the latest 48 hours after becoming aware of it.

Sub-processors

The agency authorises the following providers; any change will be notified in advance, with the option to object by stopping the service:

Supabase (database and files) — data hosted in the eu-west-1 (Ireland, European Union) region.

Vercel (application hosting) — the application is served from its global network; data is not stored at Vercel.

Resend (email delivery) — receives the recipient's address and the email's content.

Sentry (technical error reporting, data hosted in the EU) — receives an error's details, without cookies, IP addresses, content or client links.

These providers may be established outside the European Union (United States): transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

End of the agreement

The agency can export its data at any time. When the account is closed, or on request, the data is deleted, unless the law requires keeping it.

Audit

We provide the information needed to demonstrate compliance (Security and data page, written answers). Contact: tiboguerydev@gmail.com.