Annex C – Data Processing Agreement

For the purpose of this Data Processing Agreement (hereinafter referred to as the “DPA“), terms starting with a capital letter are defined in accordance with the Contract or this Annex.

1. Context and Purpose

The Client, the data controller (hereinafter referred to as “Data Controller”), has subscribed to one or more Services from Partoo, under the General Terms and Conditions of Partoo (or “T&C”) or a specific contract (hereinafter collectively referred to as the “Contract”, whether it is the T&C or a specific contract).

The Data Controller makes available to Partoo personal data required for the performance of the Agreement (hereinafter referred to collectively as “Personal Data”). In this regard, Partoo is given the status of data processor (hereinafter referred to as the “Data Processor”) in accordance with the guidance of the supervisory authorities. Therefore, the purpose of these clauses is to determine the conditions under which the Data Processor undertakes to carry out the Personal Data processing operations defined below on behalf of the Data Controller.

2. Applicable regulations

As part of their contractual relationship, the Parties undertake to comply with the regulations in force under the legislation applicable to the Contract regarding the processing of Personal Data (hereinafter referred to as the “Data Protection Regulations”) and in particular, when applicable, the regulation (UE) 2016/679 of the European Parliament and of the Council of 27 April 2016 applicable from 25 May 2018 (hereinafter referred to as “GDPR”).

3. Description of the processing

3.1. Nature and object of the processing

The nature of processing activities involves the use of Personal Data for identifying the individuals logging into the Partoo Applications on the one hand, and the hosting, transmission, organization, consultation and restitution of the Personal Data uploaded, generated or being accessible by Users and third parties, including the Data Controller’s customers, who interact with the Services.

In the context of providing the subscribed Services, the Data Processor is authorized to carry out operations of collection, consultation, recording, organization, structuring, storage, adaptation, extraction, disclosure by transmission, alignment, analysis, restriction, and erasure of Personal Data, in accordance with the documented instructions of the Data Controller, the features of the subscribed Services, and the Agreement.

It is reminded that, in the context of its commercial relationship with the Data Controller, the Data Processor mainly provides access to the Partoo Applications and Services. Except for the Users whose Personal Data is processed for the purpose of providing the services, the Data Processor has no general obligation to monitor the content hosted on its Partoo Applications. Therefore, the Data Processor does not have knowledge of whether the Client hosts Personal Data within the Services. In this regard, it is expressly specified that, in connection with the use of the Messages product, the Data Controller remains solely responsible for providing the required information to data subjects, selecting the appropriate legal basis for processing, and obtaining any necessary consent. The Data Processor acts indeed exclusively as a technical service provider, ensuring the transmission and temporary hosting of messages.

3.2. Description of the processing

The Data Processor is authorized to process Personal Data to the extent necessary for the operation, provision, maintenance, security, and improvement of the Partoo Applications under the Agreement.

Processing activities covered by the common framework are implemented regardless of the subscribed Services; product-specific processing activities are only implemented if the Data Controller has subscribed to that specific product. These processing activities are described as follows:

Service	Nature and object of the processing	Purpose of the processing	Personal Data categories
Common core (all Partoo Services)	Identification of Users logging into the Partoo Applications. Hosting, organization, consultation and restitution of Personal Data related to Partoo Users’ accounts.	Management of User access and rights Hosting of the Partoo Applications in SaaS mode Support, maintenance and problem resolution: responding to online chat requests, accessing Users’ online accounts, resolving incident tickets. Retention of logs for incident traceability. Taking into account User feedback and continuous development of the Partoo Applications	Identification: surname, first name, pseudonym. Professional data: job title, professional email address. Login details: logs (time-stamp information, access information such as IP address and browser), browsing data on the Partoo Applications.
Presence Management	Distribution and synchronization of the Data Controller’s business information on third-party platforms (Publisher Sites).	Creation, update and distribution of business listings Publication of content on business listings Monitoring of business visibility statistics	Mainly data relating to businesses, which does not constitute Personal Data. Where applicable: contact details of the person in charge of a business listing (name, telephone number, email address).
Store Locator	Creation and hosting, on behalf of the Data Controller, of a store locator and of pages dedicated to each business, integrated into its website.	Display and update of business information Measurement of page audience	Mainly data relating to businesses. Where applicable, website visitors: browsing data (IP address, pages viewed, approximate geolocation). This data is not retained by Partoo.
Review Management	Collection, hosting and restitution of reviews published on third-party platforms (Publisher Sites) Publication of the Data Controller’s responses	Centralization of reviews Responding to reviews Review analysis and reporting	Review author: name or pseudonym, review content, as displayed by the platform. Review content: rating, text, date, photographs. Responses: responses published by Users.
Review Booster	Sending, on behalf of the Data Controller, of invitations to submit an online review, and monitoring of such invitations.	Sending of invitations Monitoring of invitations sent and reviews submitted Reporting	Recipients: surname, first name, telephone number, provided by the Data Controller or entered by a User. Invitations: content, date and sending status. Users: identification of the Partoo User who initiated the sending.
Messages	Transmission and temporary hosting of messages exchanged between the Data Controller and its customers via third-party channels, in its capacity as a technical service provider.	Centralization of conversations Centralized or local response to messages Assignment of conversations to Users Where applicable, collection of contact details (leads)	Correspondents: name, pseudonym, telephone number, account identifier on the channel. Messages: content, attachments, time-stamp. Contact details: contact details provided by the correspondent.
Feedback Management	Sending of satisfaction surveys to the Data Controller’s customers. Collection, hosting and analysis of responses.	Distribution of questionnaires (email, SMS, QR code) Collection and analysis of responses Reporting	Recipients: surname, first name, email address, telephone number, provided by the Data Controller. Responses: ratings, free-text comments. Context: business, date of visit or purchase. Monitoring of sendings: opening, response.

Apart from processing the Personal Data of Users for the purpose of providing the Services, as defined hereinabove, the Data Processor is limited to hosting and transmitting the Personal Data that may be communicated by the Data Controller or their contact person, if applicable, on the Partoo Applications.

3.3. Categories of data subjects

Depending on the purpose, the categories of data subjects are:

• Users (employees, service providers or any other subject habilitated by Data Controller)
• Persons who interact with the Data Controller via the Publisher Site, such as its customers or prospects.

4. Term

This DPA comes into effect upon the Effective Date of the Contract by the Parties and remains in effect for the entire term of the Contract. Therefore, Personal Data shall be processed for the duration of the Contract and then shall be archived for a duration of ninety (90) days after the end of the Contract.

5. Obligations of the Data Processor towards the Data Controller

The Data Processor undertakes to:

1. Process the Personal Data solely for the purpose of the subcontracting, as defined hereinabove.
2. Process the Personal Data in accordance with the Services subscribed by the Client. If the Data Processor considers that an instruction constitutes a violation of the GDPR or any other provision of the Data Protection Regulation, it shall immediately inform the Data Controller. Furthermore, if the Data Processor is required to transfer Personal Data to a third country or an international organization, it must inform the Data Controller of this legal obligation before processing, unless the law in question prohibits such information on important grounds of public interest.
3. Guarantee the confidentiality of Personal Data processed under this contract (insofar as the Data Controller does not make its hosting accessible to unauthorized third parties and ensures that security measures allowing confidentiality are taken, since the Data Controller has full access to the Personal Data hosted by the Data Processor).
4. Ensure that persons authorized to process Personal Data under this Agreement:
   • Commit to maintaining confidentiality or are subject to an appropriate legal obligation of confidentiality.
   • Receive the necessary training in the protection of Personal Data.
5. Consider, with regard to its tools, products, applications, or services, the principles of data protection by design and by default.

6. Sub-processing Activities

6.1. Use of a Sub-processor

The Data Processor has appointed sub-processors (hereinafter referred to as the “Sub-processor“) to carry out specific processing activities in the provision of its Services, which the Data Controller hereby authorizes. The list of Sub-processors approved by the Data Controller, on the day of the conclusion of the DPA, is available on the Data Processor’s dedicated web page. The Data Processor undertakes to regularly update this list and to communicate, on simple request from the Data Controller, the extracted updated list of all its Sub-processors.

In the event of any modification to the list of Sub-processors, the Data Processor will inform the Data Controller. This information must clearly indicate the outsourced processed activities, the identity and contact information of the Sub-Processor. The Data Controller has a maximum of fifteen (15) days from the date of receipt of this information to submit any objections, on reasonable data protection grounds.

In the event the Data Controller objects to a new Sub-processor, the Data Processor shall, at its sole discretion, elect to: (i) provide the Services without using the objected Sub-processor; (ii) appoint an alternative Sub-processor. If none of these solutions is reasonably possible the Data Controller may terminate the specific Service or feature affected by such objection. This termination is Data Controller’s sole and exclusive remedy under this objection.

6.2. Guarantees submitted by the Sub-processor

The Sub-processor must comply with the obligations of this DPA on behalf of and in accordance with the instructions of the Data Controller. It is the responsibility of the Data Processor to ensure that the Sub-processor provides the same sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the GDPR and any other legislation applicable to the Contract.

If the Sub-processor fails to meet its obligations regarding data protection, the Data Processor remains fully responsible to the Data Controller for the performance by the Sub-processor of its obligations.

7. Right of information of data subjects

It is the responsibility of the Data Controller to provide information to data subjects concerned by processing operations at the time of the collection of Personal Data. The responsibility of the Data Processor cannot be held liable in this regard.

8. Exercise of data subject rights

To the extent possible, the Data Processor must assist the Data Controller in fulfilling its obligation to respond to requests for the exercise of data subject rights: right of access, rectification, deletion, and objection, right to restrict the processing, right to data portability, and right not to be subject to an automated individual decision (including profiling).

When data subjects submit requests to exercise their rights to the Data Processor, the Data Processor must forward these requests upon receipt by email to the address provided by the Client at the time of the subscription to the Services.

9. Notification of Personal Data breaches

The Data Processor shall notify the Data Controller without undue delay upon Data Processor becoming aware of a Personal Data breach and by email to the address provided by the Data Controller at the time of the subscription to the Services.

This notification shall be accompanied by all relevant documentation to allow the Data Controller, if necessary, to report this breach to the relevant control authority.

The notification shall contain at least:

• The description of the nature of the Personal Data breach, including, if possible, the category and approximate number of data subjects concerned by the data breach and the categories and the approximate number of Personal Data records concerned;
• The name and contact information of the Data Protection Officer or any other contact person who can provide additional information;
• The description of the likely consequences of the Personal Data breach;
• The description of the measures adopted or suggested by the Data Processor to remedy the Personal Data breach, including, if applicable, the measures to mitigate any potential negative consequences.

If, and to the extent that it is not possible to provide all this information at once, the information may be communicated in stages without undue delay.

The Data Controller handles communication with data subjects concerned by the Personal Data breach. It is reminded that the Data Processor does not have visibility over the nature of the Personal Data hosted on behalf of the Data Controller, and is therefore not in a position to assess the level of risk to the rights and freedoms of natural persons in case of a Personal Data breach.

10. Assistance by the Data Processor in helping the Data Controller meet its obligations

The Data Processor will provide the Data Controller the relevant documentation in order to carry out data protection impact assessments by the latter, only with regard to the aspects for which the Data Processor is responsible.

The Data Processor shall help where possible and reasonable the Data Controller with the preliminary consultation with the control authority by providing the required documentation.

It is expressly understood that any intervention of the Data Processor on behalf of the Data Controller within the scope of the present DPA, and in particular the assistance in the performance of impact analysis, will be invoiced to the Data Controller according to the tariff subject to the Data Controller’s prior consent if such intervention exceeds one (1) business day.

11. Security measures

The Data Processor carries out the processing with technical and organizational measures that ensure an adequate level of security for the associated processing risk, in accordance with the provisions of Art. 32 of the GDPR.

These measures include data encryption, robust access control, regular security audits, and any other necessary measure to ensure the confidentiality, integrity and availability of the data. The Data Processor reserves the right to update and improve these security measures according to the regulatory requirements and the industry good practices.

To assess the appropriate level of security, the Data Processor considers the state of the art, the costs of implementation, as well as the nature, scope, context, and purpose of the processing, along with the risks to the data subjects.

In particular, the Data Processor has a written security process and policies that meet at least the requirements imposed by the Data Protection Regulations and are in line with established industry practices. During the term of the Contract, the Data Processor will provide the Data Controller with the security documentation at its first request.

12. Data reversibility at the end of the Contract

Data reversibility at the end of the contractual relationship between the Data Processor and the Client is stipulated in the Contract.

13. Data Protection Officer

The contact details of the Data Processor’s Data Protection Officer (DPO) are as follows:

Solène Kulisz – personaldata@partoo.fr

14. Register of processing activity categories

The Data Processor declares to keep a written record of all categories of processing activities carried out on behalf of the Data Controller including:

• The name and contact details of the Data Controller on whose behalf it is acting, of any Sub-processors and, if applicable, of the data protection officer;
• The categories of processing carried out on behalf of the Data Controller;
• Where applicable, transfers of Personal Data to a third country or to an international organization, including the identification of such third country or international organization and, in the case of transfers referred to in the second subparagraph of Article 49(1) of the GDPR, the documents attesting to the existence of appropriate guarantees.

15. Transfers of Personal Data outside the European Union

The Data Processor may indirectly transfer, through its Sub-processors mentioned in article 6 herein, the Personal Data outside the European Union. In such a case, the Data Processor is committed to obtain the prior written consent of the Data Controller.

Any transfer of Personal Data outside the European Union shall be carried out in strict accordance with Chapter V of the GDPR, specifically by relying on an adequacy decision or by implementing appropriate safeguards. Therefore, when such transfer is carried out, the Data Processor commits to ensure that it is covered by:

• Standard contractual clauses issued by the European Commission or a Supervisory Authority in accordance with Article 46 of the GDPR; and/or
• Any binding corporate rules approved by a competent Supervisory Authority under Article 47 of the GDPR; and/or
• An approved code of conduct in accordance with Article 46 of the GDPR; and/or
• An approved certification mechanism in accordance with Article 46 of the GDPR; and/or
• An adequacy decision of the European Commission in accordance with Article 45 of the GDPR.

In any case, the Data Processor will inform the Data Controller within a reasonable period of time of any planned transfer and will at the same time provide the Data Controller with all relevant information allowing the Data Controller to comply with its obligations in the event of a Personal Data transfer.

16. Data Protection Impact Assessment

The Data Controller is responsible for determining whether the processing operations carried out through the Services are likely to result in a high risk to the rights and freedoms of natural persons, in accordance with Article 35 of the GDPR. Where such risk is identified, the Data Controller shall carry out a Data Protection Impact Assessment (hereinafter referred to as “DPIA”) prior to the processing.

The Data Processor shall provide the Data Controller with all reasonable assistance, upon request, to enable the completion of the DPIA, including by providing documentation relating to the technical and organizational security measures implemented, as well as any other relevant information concerning the processing operations performed on behalf of the Data Controller.

17. Audits

17.1. Framework

The Data Processor shall make available to the Data Controller the necessary information to demonstrate compliance with all its obligations and to enable audits, including inspections, by the Data Controller or another auditor appointed by the Data Controller, and contribute to these audits.

The audits provided for in this article can only be conducted under the following conditions:

1. The audit must be requested by registered letter with acknowledgment of receipt, at least thirty (30) calendar days before the desired date for the audit, and must state the reasons justifying the audit. If the audit can be conducted through the provision of documents, the Parties will prioritize an audit based on the presentation of documents;
2. There can only be one (1) audit per year;
3. The audit shall not last more than one (1) business day. Beyond that, the Data Processor may charge for the time spent by its teams on the audit at the rates that will be communicated to the Client at the time of the audit request or at any moment upon the Client’s request.

17.2. Purposes

The audit must not disturb the Data Processor’s activities beyond what is strictly necessary, therefore it may only focus on the Data Processor’s compliance with the provisions of this DPA.

If the Client decides to entrust the audit to a third party, the latter must (i) not be a direct or indirect competitor of the Data Processor; (ii) be strictly bound by professional confidentiality that will be transmitted to the Data Processor before the audit is conducted; (iii) in any event, the Data Processor can object to the choice of auditor, provided that reasonable justification is given; and (iv) comply with all of the Data Processor’s internal procedures. The Client remains in any case fully responsible for the auditor, without being able to assert any limitation of liability against the Data Processor in the event of a breach by the said auditor.

17.3. Results

It is understood between the Parties that the results of the audit cannot be made public and will remain strictly confidential. The Data Processor may present its observation before the definitive version of the audit report and will have thirty (30) calendar days to do so, except if this timeframe is deemed insufficient, in which case it may request an additional thirty (30) calendar days by notifying via email.

18. Use of artificial intelligence

18.1. Framework and definitions

In the framework of the Services subscribed to by the Data Controller, the Data Processor may make available features based on artificial intelligence technologies (the “AI Features“) that may process Personal Data. These AI Features are notably present in the following Services:

• Review Management: suggested replies to reviews, review analysis, and categorization;
• Messages: suggested replies to messages;
• Jim Cowork: suggestions aimed at optimizing the use of Partoo Applications’ features within the platform.

The AI Features form an integral part of the relevant Services when subscribed to by the Data Controller. They are not subject to separate activation or deactivation.

For the purposes of this article:

• “AI Inputs” mean the data, content, text, instructions, or information transmitted to the AI Features in order to generate a response or a suggestion;
• “AI Outputs” mean the content, suggestions, results, or data generated by the AI Features based on the AI Inputs;
• “AI Technologies” mean the software, models, algorithms, and artificial intelligence infrastructures used by the Data Processor to provide the AI Features.

18.2. Role of the Parties and Purpose of Processing

When the AI Features process Personal Data on behalf of the Data Controller, the Data Processor acts exclusively as a processor, in accordance with the documented instructions of the Data Controller, this Agreement, and the Contract.

The processing carried out within the framework of the AI Features has the sole purpose of providing the subscribed Services, including generating suggested responses to reviews and messages, categorizing reviews, and offering recommendations for using the Partoo Applications.

The Data Controller remains responsible for:

• The lawfulness of the Personal Data and content made accessible via the Services;
• Verifying the relevance, accuracy, and appropriateness of the AI Outputs prior to any use, communication, or publication;
• Business decisions made on the basis of the AI Outputs;
• Compliance with its information obligations towards data subjects and, where applicable, obtaining any required consent.

The AI Outputs constitute suggestions only. They must not be considered as legal or professional advice, or as automated decisions producing legal effects concerning natural persons. In any case, they must be subject to human verification and validation prior to any use.

18.3. Minimization and Pseudonymization of Transmitted Personal Data

The Data Processor implements measures designed to limit the Personal Data transmitted to AI Technologies.

In particular, for review response suggestion features, the Data Processor uses placeholders to mask, where technically applicable, certain data contained in the reviews or necessary for the proposed response, notably the reviewer’s name as well as the establishment’s contact details that could be used to offer direct contact.

The Data Controller undertakes not to submit special categories of Personal Data within the meaning of Article 9 of the GDPR, nor data relating to criminal convictions or offenses, to the AI Features, unless strictly necessary, lawful, and expressly agreed between the Parties with the implementation of appropriate safeguards.

18.4. No Training and Stateless Processing

The Personal Data, AI Inputs, and AI Outputs of the Data Controller are not used to train, fine-tune, or improve artificial intelligence models for the Data Processor’s own purposes, or those of its service providers or third parties, without the prior, express, and written agreement of the Data Controller.

Requests submitted to the AI Technologies are processed on a one-off basis, without retention of conversational context between two requests. Each request is processed independently, based solely on the elements submitted for that request, without building a conversational history or preparing a model from the Data Controller’s Personal Data.

Subject to technical logs strictly necessary for security, maintenance, abuse prevention, and incident resolution, the Data Processor does not retain the AI Inputs or AI Outputs within the AI Technologies for the purpose of creating a persistent context or training the models.

18.5. Use of a Sub-processor

For the provision of the AI Features, the Data Processor may use Microsoft Azure (Microsoft, having its registered office at 39 quai du Président Roosevelt, 92130 Issy-les-Moulineaux, France), including the OpenAI models made available within its Azure environment, as a Sub-processor.

The use of this Sub-processor is subject to the provisions of Article 6 of this DPA. The Data Processor shall ensure that such Sub-processor is bound by Personal Data protection obligations at least equivalent to those set out in this DPA.

Any transfer of Personal Data outside the European Economic Area carried out in this context shall remain subject to the provisions of the article relating to transfers of Personal Data outside the European Union and to the applicable safeguards provided for by the GDPR.

18.6. Security, Transparency and Compliance

The Data Processor implements appropriate technical and organizational measures to protect the Personal Data processed in connection with the AI Features, in accordance with this DPA.

Upon reasonable request, the Data Processor shall provide the Data Controller with the available information necessary to enable it to assess the processing carried out through the AI Features and to comply with its own transparency, information and compliance obligations.

The Data Processor undertakes to implement the AI Features in compliance with the Data Protection Regulations and, to the extent applicable to it given its role and the relevant features, with Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence.

18.7. Liability

Any liability arising from the use of the AI Features shall be governed by the liability provisions set out in the Contract.

The Data Processor implements the measures reasonably available to limit the risks associated with any errors, inaccuracies, hallucinations or biases in the AI Outputs. As a reminder, however, the Data Controller expressly acknowledges and agrees that the AI Outputs are generated automatically and must be reviewed by a human prior to any use or dissemination.

19. Obligations of the Data Controller towards the Data Processor

The Data Controller undertakes to:

1. Document in writing all instructions regarding the processing of Personal Data by the Data Processor.
2. Ensure, prior to and throughout the duration of the processing, the compliance with the obligations set out by the applicable legislation by the Data Processor.
3. Supervise the processing carried out by the Data Processor in accordance with the Contract.

20. Scope of the general data exchange terms

This DPA forms a single document with the Contract.

In this regard, all provisions of the Contract that are not amended or are not contradictory to the terms of this DPA remain fully applicable between the Parties. Particularly, the limitation of liability clause provided in the Contract (and particularly in article 10 of the T&Cs when applicable) is fully applicable in the event of a breach of this DPA. In the event of a conflict relating to Personal Data protection between the provisions of the Contract and those of this Agreement, this Agreement shall prevail for any matter relating to Personal Data protection, notwithstanding the clause of the Contract relating to the order of precedence of contractual documents.

If any provision of this DPA is found to be null and void under an applicable legal rule or a final court decision, it shall be deemed unwritten, without affecting the validity of this DPA or altering the validity of its other provisions.