Data processing addendum (GDPR, Article 28)
This addendum governs the processing of personal data that Diamontis Informatique carries out on behalf of the client company. It is accepted together with the mandate, and its version is recorded alongside it.
Article 1 - Subject matter
Diamontis Informatique ("the Processor"), publisher of the Diamontis FX service ("the Service"), processes on behalf of the client company ("the Controller") the personal data appearing on its invoices and in the surrounding modules of the Service.
It does not cover the processing for which Diamontis Informatique is itself the controller - user account, subscription, security of the Service - described in the privacy policy.
Article 2 - Nature, purposes and duration
Nature: collection, structuring, storage, consultation, transmission and erasure of data appearing on invoices.
Purposes: receiving, normalising, displaying and tracking the lifecycle of invoices; submission and transport to the Approved Platform; evidential archiving; making invoices available to their recipient; assisted analysis at import and on receipt of off-network supplier invoices; history import; suggestion of accounting accounts; customer payment reminders and electronic signature of quotes; card payment of invoices on the Controller's own Stripe account.
Duration: that of the mandate, extended by statutory retention periods, chiefly the ten-year tax retention of invoices and archived records, which survives termination.
Article 3 - Data and data subjects
Categories of data: company names, SIREN and SIRET numbers, intra-EU VAT numbers, postal addresses, e-mail addresses, names and roles of contacts, amounts, service descriptions, bank details (IBAN, BIC), invoice lifecycle and transport data.
Data subjects: contacts appearing on invoices issued or received by the Controller - directors, accountants, contacts at its suppliers and customers; recipients holding access to the end-customer portal; the accounting professional to whom the Controller grants access (article 4a).
Article 4 - Documented instructions
The Processor processes the data only on documented instructions from the Controller. The following constitute such instructions: this addendum, the mandate to which it is appended, the Service documentation, and the Controller's actions in the interface.
The Processor immediately informs the Controller if it considers that an instruction infringes the GDPR or another applicable provision.
Article 4a - Access granted to your accountant
The Service lets the Controller grant access to their accountant. Granting it is the Controller's own act, and as such constitutes a documented instruction within the meaning of article 4.
What granting access entails: the designated professional gains access to the personal data contained in the Controller's invoices - contacts, addresses, bank details of their suppliers and customers. That is the very purpose of the access.
What the Processor guarantees in return:
- access is personal: only an account bearing the invited address can activate it, and a forwarded link binds no one;
- it is revocable at any time from the interface, with immediate effect;
- it is read-bounded: the accountant can neither issue nor reject a document, nor declare anything to the invoicing network on the Controller's behalf, nor touch the company, its subscription, its access keys or its members. The only writes granted are local payment tracking and producing the accounting entries file;
- granting, activation, revocation, accounting-file exports and payment entries made by the accountant are logged and readable by the Controller in their interface;
- the number of simultaneous accesses is capped, so that a personal access does not become a shared account.
The designated professional acts under the Controller's responsibility. The Processor is not a party to their relationship and exercises no control over how this third party uses the data it accesses.
Article 5 - Confidentiality and security
Persons authorised to process the data are bound by confidentiality. The measures in place include:
- strict data isolation between client companies (application-level filter, access controls, blocking non-leakage test suite);
- encryption in transit (TLS) on all exchanges, internal and outbound;
- application-level encryption at rest of authentication and integration secrets;
- available two-factor authentication and rate limiting on attempts;
- sealing, chaining and timestamping of archived records;
- logging of sensitive actions.
What the Processor does not do, and states so: the invoice data itself, bank details included, is not encrypted at rest at application level, and writes to object storage are not encrypted server-side. Its protection rests on the measures above. This limit is stated so that it is known, and will be reconsidered should the risk change.
Article 6 - Sub-processors
The Controller gives general authorisation to the following sub-processors. The Processor informs it of any addition or replacement at least thirty days before it takes effect, with the possibility of a reasoned objection.
- OVH SAS (OVHcloud) - infrastructure hosting, France.
- OVH SAS (OVHcloud) - object storage of documents and archives, France.
- OVH SAS (OVHcloud) - relay for transactional e-mails, France.
- OVH SAS (OVHcloud AI Endpoints) - language models hosted in France: the text of an imported invoice or of a supplier invoice received off-network, not redacted of its bank details and e-mail addresses, is submitted to them to suggest line items and a recipient identity; on the Business plan, the line items of an invoice and the identity of the third party, without bank details or addresses, to suggest an accounting account. The same company setting turns off these uses.
- SuperPDP - Approved Platform: regulatory transport and delegated archiving, European Union.
- Stripe - payment of the Service subscription, outside the scope of this addendum, European Union and United States under standard contractual clauses. For card payment of invoices that the Controller offers its customers, Stripe is its own provider, on its own account, and not a sub-processor: the Service only sends it the invoice number and the amount due.
Timestamping of archives and signed quotes uses a time authority that receives only a cryptographic hash of the document: no personal data is transmitted to it, so it is not a sub-processor.
Article 7 - Assistance
The Processor assists the Controller in responding to requests to exercise data subject rights - a request received directly by the Processor is forwarded without delay, for the Controller to answer - as well as with security of processing, impact assessment and prior consultation, within the limits of the information available to it.
Article 8 - Personal data breach
The Processor notifies any personal data breach within forty-eight hours of becoming aware of it, by e-mail to the account contact address, with the information available to it: nature of the breach, categories and approximate volume of data and data subjects concerned, likely consequences, measures taken. The notification deadline to the supervisory authority under Article 33 runs for the Controller.
Article 9 - Fate of the data on termination
At the end of the service, the Processor, at the Controller's choice, returns the data or deletes it, along with existing copies. The Controller has an export function available in the Service at any time.
Express reservation: this obligation yields to statutory retention obligations, foremost the ten-year tax retention of invoices and archived records. Data covered by such an obligation is kept until its term, with no processing other than that required for such retention, and then destroyed.
Article 10 - Documentation and audit
The Processor makes available the information needed to demonstrate compliance with Article 28, in particular its record of processing activities and its security audit reports. The Controller may request an audit, limited to once a year absent an incident, with reasonable notice, at its own expense, and without the audit compromising the confidentiality of other clients' data.