Data processing agreement (DPA)

1. Parties and subject

This agreement applies between the customer as controller and CLOUPIX SUARL, Rue Île de Rhodes 10, 3ème étage, bureau A1, Immeuble Henda, 1053 Les Berges du Lac 2, Tunis, Tunisia, as processor. It forms part of the terms and conditions for Contabli and applies for as long as the customer uses Contabli.

The processor processes personal data on the customer's behalf to provide Contabli, in compliance with Organic Law No. 2004-63 of 27 July 2004. Where it conflicts with the terms, this agreement prevails on data protection.

2. Nature, purpose and data subjects

The purpose is operating Contabli: creating, sending and archiving quotes and invoices, recording receipts, matching payments and working with the accountant.

Types of data: names and contact details, addresses, tax IDs and identity numbers, bank details (RIB), invoice and payment data, uploaded receipts and documents, messages in questions, and users' access and log data.

Data subjects: the customer's customers, suppliers and contacts, its employees and invited users, and staff of its accounting firm.

3. Instructions

The processor only processes the data on the customer's documented instructions unless required to do so by law. Instructions are this agreement, the terms and the customer's use of Contabli's features.

If the processor considers an instruction unlawful, it informs the customer without undue delay.

4. Confidentiality

The processor only uses people who are committed to confidentiality or are under a statutory duty of confidentiality. Customer data is only accessed as far as needed for operations, security or support.

5. Technical and organisational measures

The processor takes appropriate security measures, in particular:

Servers and database hosted with providers whose identity and location are available to the customer on request; encrypted transport (TLS) and an encrypted database connection.

Mandatory two-factor sign-in for all users; roles and permissions per company; accountant access only after the customer grants it, revocable at any time.

Tenant separation at database level (row-level security); virus scanning of uploaded files.

Server access only via SSH keys, firewall and protection against login attempts, regular security updates; support access only for authorised staff with two-factor sign-in, without access to documents or amounts, and logged.

The customer can export all data at any time.

The processor may adapt the measures to the state of the art as long as the level of protection does not decrease.

6. Sub-processors

The customer approves the following sub-processors: the hosting and database provider (identity and location available on request); Microsoft Ireland Operations Ltd., Dublin (email delivery via OVH); an online payment provider (only for the customer's billing data).

The processor announces new or changed sub-processors by email at least four weeks in advance. The customer may object for a legitimate data protection reason; if no solution is found, it may terminate the contract as of the change.

The processor contractually binds every sub-processor to an equivalent level of protection. Data is only transferred outside Tunisia after authorisation by the national personal data protection authority (INPDP), in accordance with articles 50 to 52 of Organic Law No. 2004-63.

7. Assistance

The processor assists the customer with appropriate measures in responding to data subject requests and in meeting its own security and declaration obligations. The customer can handle many requests itself in Contabli, for example by exporting, correcting or deleting records.

8. Personal data breaches

The processor notifies the customer of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it, with the information the customer needs to meet its own obligations.

9. Deletion and return

Until the contract ends, the customer can export its data at any time. After the contract ends, the processor deletes the data within 90 days unless the law requires it to be kept.

10. Evidence and audits

The processor provides the customer with the information needed to demonstrate compliance with this agreement. It allows audits by the customer or an auditor it appoints who is bound to confidentiality, with reasonable notice, normally at most once a year and without disrupting operations.

11. Final provisions

Liability is governed by the terms. The processor announces changes to this agreement in the same way as changes to the terms. This agreement is governed by Tunisian law.