Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") forms part of the terms of service between ALLEZOU SAS, 40 Rue Damrémont, 75018 Paris, France, RCS Paris 832 194 807 ("we", the processor) and the organisation that uses BunBunCloud ("you", the controller). It applies when we process personal data on your behalf in providing the Service, and meets Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP). You accept it by accepting the terms; no signature is needed. Words such as "personal data", "processing", "controller", "processor", "sub-processor" and "personal data breach" have the meanings the GDPR gives them.

2. The processing

3. Our obligations

• Instructions. We process the personal data only on your documented instructions, which are the terms, this DPA and your use of the Service's settings, unless the law requires otherwise; we then tell you first, unless the law forbids it. We tell you if we believe an instruction infringes data protection law.
• Confidentiality. Everyone we authorise to process the personal data is bound to confidentiality.
• Support access. To help with a request or to keep the Service secure, our support staff may view a workspace as one of its users: read-only, for at most an hour at a time, seeing only what that user sees. Each view is recorded in our internal logs.
• Security. We implement the technical and organisational measures in the annex, and keep them at least as protective as they are today.
• Assistance. Taking into account the nature of the processing, we help you answer the requests of data subjects (the Service lets your administrators export, correct and delete data themselves), and help you with security, breach notification, data protection impact assessments and prior consultations.
• Information. We make available the information needed to show compliance with this DPA, answer reasonable security questionnaires, and allow audits as described in section 8.

4. Your obligations

You are responsible for the lawfulness of the processing you instruct, including having a legal basis for it and informing the people concerned; for connecting only cloud accounts you are authorised to inspect; and for the accounts and roles you give your users.

5. Sub-processors

You authorise us to use the sub-processors listed on our sub-processors page. We impose on each the same data protection obligations as this DPA by written contract, and remain liable for them. We tell your workspace's administrators by e-mail at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that time; if we cannot address the objection, you may end your subscription and we refund the prepaid fees for the period after it ends.

6. Personal data breaches

We notify you without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting your data, with what we know of its nature, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed; we complete this information as it becomes available, and help you meet your own obligations.

7. International transfers

We are established in the European Union (France). Workspaces in the Europe region are stored and processed in the European Union. Workspaces in the Asia-Pacific region are stored in Singapore, and our team may access the Service from outside the European Union to operate and support it: for these transfers to countries without an adequacy decision, the European Commission's Standard Contractual Clauses (Decision 2021/914) apply and are incorporated by reference: Module 3 (processor to processor) between us and our sub-processors and staff outside the EEA, and Module 2 (controller to processor) where you are a controller outside the EEA. For them: Clause 7 does not apply; Clause 9 uses option 2 with the 30 days' notice of section 5; the optional wording of Clause 11 does not apply; under Clause 13, the competent supervisory authority is the CNIL (France) unless you are established elsewhere in the EU; Clauses 17 and 18 choose the law and courts of France; the annexes are completed by section 2, the annex below and the sub-processors page. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies with these clauses; for transfers subject to the FADP, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is a competent authority. These clauses prevail over this DPA, and this DPA over the terms, where they conflict.

8. Audits

We answer your reasonable written questions about our measures within 30 days. If that is not enough to show compliance, or a supervisory authority requires it, you may audit our processing once a year, with 30 days' notice, during business hours, by yourself or an independent auditor bound to confidentiality, at your cost, without access to other customers' data.

9. End of the processing

You can export your workspace's data at any time. When your workspace is deleted, by you or under the terms, we delete its personal data within 30 days, and from backups as they expire, unless the law requires us to keep it; we confirm deletion on request. If we close your workspace, we keep its data available for export for at least 30 days first, as the terms describe.

10. Contact

For anything about this DPA, write to privacy@bunbuncloud.com or to ALLEZOU SAS, 40 Rue Damrémont, 75018 Paris, France. Our representative in the United Kingdom: being appointed.

Annex: technical and organisational measures

• Access to your cloud accounts: only through the read-only roles you create, with an external ID unique to your connection; BunBunCloud is designed not to change your resources or read secret values, message contents, logs or records.
• Separation: each workspace's data is kept apart by row-level security in the database, so one workspace's queries cannot read another's.
• Encryption: all connections use HTTPS (TLS); integration credentials are encrypted at rest with AES-256-GCM; passwords are stored only as salted scrypt hashes; session tokens are stored only as hashes.
• Sign-in: secure, HTTP-only session cookies; throttling of failed sign-ins; confirmation of e-mail addresses; re-authentication before sensitive changes; optional sign-in with Google, GitHub or LinkedIn.
• Our access: production access is limited to the people who need it; every action of a platform administrator is recorded in an audit log kept 24 months.
• Outbound requests: the Service's requests to other systems are checked so they cannot reach private networks.
• Availability: hosted on Amazon Web Services in the chosen region, on a managed database with automated daily backups.
• Minimisation and retention: only configuration needed for the Service is collected; personal data is deleted on the schedule in our privacy policy, enforced automatically.
• Development: changes are reviewed and tested before release, and dependencies are kept up to date.