Personal Data Processing Appendix

Roles of the Parties

For data collected through your website, you are the data controller, and we act as a data processor, as defined by the General Data Protection Regulation.

We process this data only in accordance with your documented instructions, which are derived from your use of the service and these terms and conditions.

We will notify you if we believe an instruction constitutes a violation of applicable regulations.

Processing Activities

The processing activities carried out on your behalf are as follows, depending on the modules you activate.

• Contact forms: Receiving messages sent from your website and forwarding them to your email address.
• Shop: Recording orders, the items ordered, the contact details required to process them and, where the end customer creates one, their customer account.
• Visit statistics: Counting views of your website by page, country, device type and referring website, without cookies or visitor identifiers.

Data Subjects: visitors to your website, your customers, and individuals who contact you.

Categories of data: identification and contact data, message content, order data, aggregated traffic data. We do not request any sensitive data and the service is not designed to process any.

Duration: for as long as your Account exists. Encrypted backup copies are overwritten at the end of their cycle, at the latest 400 days after deletion, and are used solely for restoration in the event of an incident.

Our Commitments

• Confidentiality: Individuals authorized to process this data are subject to a confidentiality obligation.
• Security: We implement appropriate technical and organizational measures, including encryption of communications, segregation between clients, and access restrictions.
• Support: We assist you in responding to requests from data subjects to exercise their rights, to the extent that the service allows.
• Notification: We will notify you without undue delay of any data breach affecting the data processed on your behalf.
• Deletion: We delete this data at your request, unless a legal retention obligation applies.

Subsequent Processors

You generally authorize the use of sub-processors that provide sufficient safeguards. An up-to-date, dated list of these sub-processors is available for review at any time through your account.

You will be notified of any additions or replacements before they are implemented, so that you may object to them. In the event of a legitimate objection that we are unable to address, you may terminate the contract at no cost.

Audit

We make available to you the information necessary to demonstrate compliance with our obligations, in the form of documented written answers to your questions. This disclosure primarily fulfils our audit obligation.

An on-site or remote inspection remains possible. It is carried out on reasonable notice of at least thirty days, no more than once a year, and without compromising the security or confidentiality of other clients' data.

Any costs incurred by an audit request, including those of an auditor you may appoint, are your responsibility.

Requests under this appendix should be directed to contact@intuisphere.com.