Data processing agreement

This data processing agreement (the "DPA") is an annex to the Terms of Use (conditions générales d'utilisation, the "Terms of Use" or "CGU"), whose definitions it uses, and forms an integral part of them (article 12 of the Terms of Use). It is accepted together with the Terms of Use.

1. Purpose

The DPA sets out the conditions under which Raygister, acting as a processor within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR"), carries out on behalf of the Customer the processing of personal data needed to provide the Platform.

The "Customer" means the Organization or the Professional User who acts as controller and uses the Platform for its professional activities, whatever role it is given on the Platform (Consultant, Consulted Company or Project Owner). Raygister and the Customer are together the "Parties".

The processing that Raygister carries out as controller (accounts, billing, Commission, security, support, prospecting) is not governed by the DPA; it is described in the privacy policy.

2. Description of the processing entrusted

2.1 Subject matter. The processing entrusted to Raygister covers the hosting, collection, recording, organization, structuring, storage, consultation, transmission, making available and archiving of the Content and data entered on the Platform and, where applicable, their analysis assisted by artificial intelligence.

2.2 Purposes. The processing is carried out solely to:

• allow projects to be created, administered and followed up;
• structure the specifications, work packages, items and documents of projects;
• allow exchanges between authorized Users;
• collect offers and make them available;
• allow the comparison, summary, award, follow-up and archiving of the elements related to Consultations and Works Contracts;
• collect and share the administrative documents of consulted companies;
• provide assistance by artificial intelligence: reading documents, plans and quotes, structuring and drafting specifications, matching and comparing offers;
• provide the other features of the Platform used by the Customer.

The artificial intelligence features are tools. They do not replace the checks, trade-offs, validations or decisions of the Customer and of the authorized Users. Raygister takes, on behalf of the Customer, no decision based solely on automated processing that produces legal or similarly significant effects on the data subjects.

2.3 Duration. The data is processed for as long as needed to provide the Platform and manage the project concerned:

• the Content of a project is kept for the life of the project, then ninety (90) days after its deletion;
• a deleted document is permanently erased thirty (30) days after its deletion;
• the Content related to a Works Contract is kept for ten (10) years from its signature or, failing that, its award (article 11 of the Terms of Use).

At the end of these periods, the data is deleted under the conditions of article 10, unless a legal obligation requires it to be kept.

2.4 Nature of the operations. Raygister carries out the operations needed for the Platform to work, in particular hosting, recording, organizing, structuring, making available, storing, archiving and deleting the data, as well as the technical operations needed for support, maintenance, security and logging.

2.5 Categories of data. Depending on how the Customer uses the Platform, the data processed on its behalf may include:

• identification and contact data of the Users and of the persons mentioned on the Platform;
• professional and administrative data of the Organizations, the consulted companies and the parties involved in the project, including the administrative documents uploaded or shared (certificates, insurance, qualifications, bank details, list of foreign employees);
• data relating to projects, Consultations and Works Contracts;
• the documents and Content uploaded to the Platform;
• data processed by the artificial intelligence features;
• access logs, timestamps, actions performed and technical metadata needed for security, traceability, support and maintenance.

2.6 Data subjects. The processing concerns the persons whose data is entered, imported or made available on the Platform by the Customer or by authorized Users, in particular the Users, the representatives, employees, staff, service providers or contacts of the Customer, the Consulted Companies, the Project Owner and any person mentioned in the Content, documents, offers or exchanges.

3. Customer's instructions

Raygister processes personal data only on documented instructions from the Customer, including with regard to transfers to a third country or an international organization, unless required to do so by applicable law; in that case, Raygister informs the Customer of that legal requirement before processing, unless the law prohibits it.

The Terms of Use, the DPA, the settings made by the Customer on the Platform (in particular the activation of the organization library) and the assistance or support requests it makes constitute its documented instructions, provided they are lawful.

If Raygister considers that an instruction infringes the GDPR or another data protection provision, it informs the Customer as soon as possible.

4. Confidentiality

Raygister ensures that the persons authorized to process personal data:

• have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• receive the necessary awareness training in data protection and security.

5. Security

Raygister implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of the data subjects. These measures include in particular:

• control of logical access to systems and data;
• authentication of Users;
• management of access rights;
• logging of relevant actions and events;
• backup and restoration of data;
• logical separation of data between Organizations and between consulted companies;
• encryption of exchanges;
• detection, correction and management of incidents;
• internal security and continuity procedures.

Raygister may change these measures to maintain an appropriate level of security, without lowering it.

6. Sub-processors

The Customer gives Raygister a general authorization to use sub-processors to provide the Platform. Their list is published in article 4 of the privacy policy.

Raygister undertakes to:

• impose on every sub-processor, by contract, data protection obligations at least equivalent to those of the DPA;
• make sure that it provides sufficient guarantees;
• remain liable to the Customer for the performance of its obligations by the sub-processor.

Raygister informs the Customer of any intended addition or replacement of a sub-processor, by updating this list and by e-mail to the administrators of the Organization, before that sub-processor processes the Customer's data. The Customer may object on legitimate grounds relating to data protection; if the Parties find no solution, it may stop using the Platform and, if it has subscribed to one, terminate its licence under the Terms of Sale.

7. Location and transfers

The data processed on behalf of the Customer is hosted in the European Union, in Ireland.

Some sub-processors, in particular the providers of the artificial intelligence models, may process data outside the European Union or the European Economic Area. The Customer authorizes these transfers, which are covered by an adequacy decision of the European Commission (in particular the EU-U.S. Data Privacy Framework for certified companies) or by its standard contractual clauses. A copy of these safeguards can be obtained at contact@raygister.com.

Any new transfer resulting from a change of sub-processor follows article 6.

8. Assistance to the Customer

Taking into account the nature of the processing, Raygister assists the Customer, by appropriate technical and organizational measures and insofar as possible, in responding to requests from data subjects to exercise their rights.

Raygister also assists the Customer, insofar as possible and taking into account the information available to it, in meeting its obligations relating to:

• the security of processing;
• the notification of personal data breaches to the supervisory authority;
• the communication of these breaches to the data subjects, where required;
• data protection impact assessments;
• prior consultation of the supervisory authority, where required.

When Raygister directly receives a request from a data subject concerning data processed on behalf of the Customer, it forwards it to the Customer, unless the law requires otherwise.

9. Personal data breaches

Raygister notifies the Customer of any personal data breach affecting the processing carried out on its behalf, as soon as possible after becoming aware of it.

The notification includes, insofar as possible, the information available to Raygister to allow the Customer to assess the scope of the incident and meet its own obligations: nature of the breach, categories and approximate number of persons and data concerned, likely consequences, measures taken or planned.

10. What happens to the data at the end of the contract

When the Customer stops using the Platform, Raygister allows it to access the data processed on its behalf and to retrieve it with the available export features (specifications and offers in spreadsheet and PDF formats, bulk download of documents).

Raygister then deletes this data and its copies within the periods of article 2.3. Some data may be kept longer where needed to comply with a legal obligation, to keep the Content related to a Works Contract, for the security of the Platform, to prevent abuse or to defend the rights of Raygister or of the Customer. It is then kept for a limited period and is no longer used for the ordinary needs of the Platform.

11. Information and audit

Raygister makes available to the Customer the information reasonably needed to demonstrate compliance with the obligations of the DPA.

The Customer may, once per twelve (12) month period and on legitimate grounds relating to data protection or security, request additional information or an audit, carried out by itself or by an independent auditor bound by confidentiality. Except in the event of a proven breach, an order from a competent authority or a serious security incident, the audit is subject to the following conditions:

• reasonable notice;
• a scope limited to the processing concerned;
• no excessive disruption of Raygister's business;
• compliance with the confidentiality and security obligations of Raygister and of its other customers;
• performance during business hours, unless otherwise agreed;
• a documentary or remote audit in the first instance.

The costs of the audit are borne by the Customer, unless a serious breach by Raygister is established.

12. Order of precedence

In the event of a conflict between the DPA and the other contractual provisions applicable between the Parties, the DPA prevails for everything relating to the protection of the personal data processed by Raygister as a processor.