Data processing agreement

Preamble

This agreement (the "Agreement") is entered into between the Customer, acting as controller (or as processor for its own clients, where it is an agency), and CODEVIUM SAS, publisher of the iPand service, acting as processor ("iPand"), within the meaning of Article 28 of Regulation (EU) 2016/679 (the "GDPR").

It constitutes Annex 1 to the General Terms of Sale (the "GTS") and is accepted together with them, by the acceptance box ticked at the time of subscription or by the acceptance of a Custom quote. It applies for as long as iPand processes Customer Personal Data, including after the GTS have ended.

The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them in Article 4 GDPR. Other capitalized terms have the meaning given to them in the GTS.

Article 1 — Scope: what iPand processes for the Customer

1.1 iPand acts as processor for the personal data contained in the Customer Data (the "Customer Personal Data"), described in Annex A: composition of the Organization (members, roles, accessible brands, invitations), content entered by members (prompts, entities, competitors, tasks, tracked pages), conversations with Pandi, iPand’s GEO assistant, and results produced for the Customer.

1.2 iPand acts as controller, and not as processor, for the processing operations that it determines itself: creation and security of user accounts, authentication and security log, proof of acceptance of the terms, billing and commercial relationship, service emails, support, abuse prevention, measurement of the use of the application, website audience measurement. These processing operations are described in the privacy policy and fall outside the Agreement.

1.3 The answers collected from artificial intelligence engines and the web pages analyzed may mention natural persons (executives, authors, public reviews). For the collection of this public content and for its measurement method, iPand acts on its own behalf, as controller, on the basis of its legitimate interest; this processing is described in the privacy policy.

Article 2 — Instructions

2.1 iPand processes Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers outside the European Union, unless required to do so by law; in such a case, iPand informs the Customer before processing, unless the law prohibits it.

2.2 The Customer’s instructions consist of the GTS, the Terms of Use, this Agreement, the settings and actions carried out by members in the Service (adding or deleting prompts, entities, members; requesting an archive; deleting a brand or an account; authorizing an MCP client), and any additional written instruction accepted by iPand.

2.3 iPand immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or another data protection rule.

2.4 iPand does not use Customer Personal Data for its own purposes, does not sell it, and does not use it to train artificial intelligence models.

Article 3 — Confidentiality

iPand ensures that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that they access it only to the extent necessary for the performance of the Service, for support requested by the Customer, or for security.

Article 4 — Security

4.1 iPand implements the appropriate technical and organizational measures described in Annex B, in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature of the processing, and the risks.

4.2 iPand may change these measures, provided that the overall level of security is not reduced.

4.3 The Customer remains responsible for the measures incumbent upon it: management of members and their rights, removal of access for persons leaving its organization, confidentiality of the mailboxes receiving sign-in codes, choice of the MCP clients it authorizes, and the content it enters (in particular the absence of personal data in prompts, as required by the Terms of Use).

Article 5 — Personal data breach

5.1 iPand notifies the Customer of any personal data breach affecting Customer Personal Data without undue delay and no later than 48 hours after becoming aware of it, by email to the billing address and to the Administrators.

5.2 The notification describes, as far as possible: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information that is not available is provided as soon as possible, in phases.

5.3 iPand cooperates with the Customer to enable it to notify the supervisory authority and, where applicable, the data subjects. Notification by iPand does not constitute an admission of fault. iPand applies an internal procedure for managing personal data breaches.

Article 6 — Subprocessors

6.1 The Customer grants iPand a general authorization to engage the subprocessors appearing in the list kept up to date by iPand (Annex C), as of the date of subscription, and thereafter as that list changes in accordance with this article. The up-to-date list is provided to the Customer on request, at contact@ipand.io.

6.2 Subprocessors chosen by iPand. iPand informs the Customer of any addition or replacement of a subprocessor that it chooses at least 30 days before it processes Customer Personal Data, by email to the Administrators of each customer Organization. The Customer may object in writing, at contact@ipand.io, within that period, on reasonable grounds relating to data protection. The parties then seek a solution; failing that, the Customer may terminate the subscription concerned free of charge, and the unserved portion of the annual Period is refunded to it on a pro rata basis.

6.3 Emergency replacement. Where the security of the data or the failure of a provider requires a replacement without waiting for that period, iPand may proceed with shorter notice. It then informs the Customer without delay, in the same manner, and the Customer has the same rights to object and to terminate after the fact.

6.4 Changes among the subprocessors’ own subprocessors. Some subprocessors themselves use providers that they choose and may change under their own terms, without always guaranteeing iPand 30 days’ notice: in particular the collection providers and their model providers, the hosting provider, the email delivery provider and the publishers of the Custom plan engines. iPand informs the Customer of such changes, in the same manner, as soon as it becomes aware of them. The Customer then has the same rights to object and to terminate as under Article 6.2.

6.5 iPand imposes on each subprocessor, by contract, data protection obligations equivalent to those of the Agreement, in particular sufficient guarantees as to the technical and organizational measures. iPand remains liable to the Customer for the performance of their obligations.

6.6 MCP clients (third-party assistants such as claude.ai or ChatGPT) that a member authorizes to read the Organization’s data are not subprocessors of iPand: they act on the initiative and under the responsibility of the Customer, under their own terms. The Customer may withdraw their access at any time (Settings › Integrations).

Article 7 — Transfers outside the European Union

7.1 Customer Personal Data is hosted in the European Union, in the Azure "West Europe" region (Netherlands); the geo-redundant backup copies of the database are kept there and replicated by Azure to the paired "North Europe" region (Ireland), in the European Union. Processing by language models is carried out in the European Union: requests and responses may be processed in any Member State of the Union.

7.2 Where a subprocessor processes data outside the European Economic Area, or gives access to it from there, the transfer is governed by an adequacy decision (including the EU–US Data Privacy Framework for a certified company) or by the European Commission’s standard contractual clauses (Decision 2021/914), supplemented where necessary by supplementary measures. The list of subprocessors (Annex C) states, for each one, the place of processing and the mechanism adopted.

7.3 As of the date of this version of the Agreement:

• Collection providers and engine publishers established in the United States: standard contractual clauses, Module 2 (controller to processor) and, for some, Module 3, provided for by their data processing agreement.
• Collection providers established in the European Union that process data, or have it processed, outside the Union (in particular in the United States and the United Kingdom): the transmission of prompts by iPand is not a transfer outside the Union; their own transfers are governed by standard contractual clauses or adequacy decisions, according to their data processing agreement or their privacy policy.
• Engine publisher established in the European Union (Custom plan): the transmission of prompts is not a transfer outside the Union; it uses providers located in the Union as a priority, and providers located outside the Union in exceptional cases.
• Email delivery provider (United States): a company certified under the EU–US Data Privacy Framework; its data processing agreement also incorporates the standard contractual clauses, Module 2. Emails are sent from Ireland; account data (email metadata, logs) is stored in the United States.
• Hosting provider (Microsoft Ireland Operations Limited): processing is governed by the Microsoft DPA (Microsoft Products and Services Data Protection Addendum).
• The APIs of two model providers are used for a technical probe on prompts internal to iPand and do not process Customer Personal Data. Their use for customers’ collection would be announced in accordance with Article 6.2.

Article 8 — Assistance to the Customer

8.1 Data subject rights. Taking into account the nature of the processing, iPand assists the Customer, by appropriate technical and organizational measures, in responding to requests to exercise data subjects’ rights. The Service enables the Customer, directly:

• to access and export data: archive of the Organization (Settings › Organization, Administrators), exports from the screens;
• to rectify the data entered;
• to erase: removal of a member, archiving of a prompt, deletion of an entity, of a task, of a conversation with Pandi (erased with its messages 30 days after its deletion), of a brand (purged 30 days after its deletion);
• to restrict a member’s access to certain brands.

Requests not covered by these functions are sent to contact@ipand.io; iPand responds within a time frame that allows the Customer to comply with the one-month time limit of Article 12 GDPR. A request received directly from a data subject and relating to Customer Personal Data is forwarded without delay to the Customer, without responding to it on the merits, unless instructed otherwise by the Customer.

8.2 Other obligations. iPand assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breaches, data protection impact assessment, prior consultation), taking into account the information available to it, in particular by providing the description of the processing and of the security measures in Annex B. This assistance is provided free of charge, within reasonable limits.

Article 9 — Term, return and deletion

9.1 The Agreement applies throughout the term of the subscriptions and until Customer Personal Data has actually been deleted.

9.2 Return. Before deletion, an Administrator may at any time obtain an archive of the Organization’s data, in JSON and CSV format, available for 24 hours after it is prepared. It contains the organization and its subscriptions, the members and invitations, the brands (markets, engines, tags, entities), the prompts, a preview of each collected answer, the tracked pages and the result of their latest analysis, and the Organization’s activity log. Conversations with Pandi, tasks and recommendations, which are not included, are returned on request sent to contact@ipand.io.

9.3 Deletion. At the end of the provision of services, iPand deletes Customer Personal Data, unless a legal retention obligation applies:

• end of a brand’s subscription: the brand’s data is purged 12 months after the end of its last subscription, at the following monthly run; during that period, the Customer may resubscribe on request to contact@ipand.io or request the archive, and may obtain earlier deletion by deleting the brand;
• deletion of a brand: data purged 30 days after its deletion;
• deletion of a member account: sessions, linked sign-in identities and memberships removed immediately; account and records erased 30 days later;
• conversation with Pandi deleted by its author: erased with its messages 30 days after its deletion; tasks created from the conversation are kept; the conversations of a member removed from the Organization are kept until the brand or their account is deleted;
• Organization activity log: 12 months;
• invitations: erased 90 days after their expiry, whether or not they were accepted or revoked;
• Organization with no member and no active subscription: marked as deleted at the daily morning run, purged 30 days later.

Once erased from the database, data disappears from backups and archives within 90 days at most: point-in-time restore over 14 days, monthly database archives kept for 90 days at most, soft delete of files for 14 days. Technical logs are kept for 30 days. The data remains subject to the Agreement until it is erased.

9.4 Upon written request, iPand confirms the deletion in writing.

Article 10 — Information and audit

10.1 iPand makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR: this Agreement and its annexes and, upon request, the list of subprocessors and a completed security questionnaire.

10.2 The Customer may have an audit carried out, at its own expense, by an independent auditor bound by confidentiality and not a competitor of iPand, no more than once a year (except in the event of a personal data breach or a request from a supervisory authority), with 30 days’ notice, during business hours, without access to other customers’ data or to security secrets, and without disrupting the Service. Subprocessors are audited by means of their certifications and reports (ISO 27001, SOC 2…).

Article 11 — Liability

Each party’s liability under the Agreement is subject to the limitations of Article 19 of the GTS, unless mandatory provisions provide otherwise; Article 82 GDPR applies in relations with data subjects.

Article 12 — Miscellaneous provisions

In the event of a conflict between the Agreement and the GTS, the Agreement prevails with regard to the protection of personal data. The Agreement is governed by French law and subject to the courts designated by the GTS. iPand may amend it under the conditions of Article 25 of the GTS; an amendment required by law or by an authority applies without delay.

This text is written in French. Its translations are provided for information only; in the event of any discrepancy, the French version prevails.

Annex A — Description of the processing

Annex B — Technical and organizational measures

Measures in place as of the effective date of this version. Additional information may be provided to the Customer on request, under a confidentiality undertaking.

Hosting and encryption

• Hosting on Microsoft Azure, West Europe region (Netherlands); geo-redundant backup copies of the database, in the same region and in the paired North Europe region (Ireland); no production data outside these regions, except with the subprocessors of Annex C.
• Encryption in transit: TLS 1.2 at minimum for the database, storage and the API; HTTPS mandatory; HSTS on the API and the application.
• Encryption at rest of Azure SQL and Azure Storage, enabled by default by Azure, with Microsoft-managed keys.
• Secrets in Azure Key Vault (role-based access control, 90-day soft delete, purge protection); no secrets in the code.

Access control

• Service access to resources via managed identity; Entra-only authentication for the database; storage shared keys and language model access keys disabled; anonymous public access to files closed.
• Deployment via federated identity (OIDC) from the main branch only; no standing password-based access.
• Users: passwordless sign-in (hashed one-time code, valid for 10 minutes, 5 attempts; Google; Microsoft); 15-minute access token held in memory; refresh token in an HttpOnly, Secure, SameSite=Strict cookie, revoked upon reuse; sessions visible and revocable.
• Segregation: each request verifies membership of the Organization and access to the brand; a contributor sees only their own brands.
• Platform administrators: limited in number, designated in the database, with no membership of Organizations; administrative actions logged.
• MCP access: OAuth 2.1 with PKCE, a single read-only scope, 60-minute access tokens, revocable by the user.

Application security

• Rate limits on authentication, forms, Pandi, the MCP server and OAuth.
• Protection against requests to the internal network (SSRF) for any address supplied by a customer; isolated rendering browser, with no secrets and no database access.
• Notifications from the payment and email providers verified by signature.
• Third-party content (engine answers, pages) treated as untrusted by Pandi and the MCP server.

Logging and monitoring

• Security log kept for 12 months: the IP address and the email address appear in it only as a hash computed with a secret key, never in clear text.
• Organization activity log (12 months) and log of administrative actions.
• Technical logs kept for 30 days, IP address masked.
• Email alerts on service errors, collection failures, blocked queues and spending overruns.

Continuity

• Database backups: point-in-time restore over 14 days; geo-redundant copies, in West Europe and in the paired North Europe region (Ireland).
• Monthly database archive, exported and verified in Azure, West Europe region, and kept for 90 days at most in Azure storage in that region; no production data is entrusted to the code hosting service.
• Soft delete of files for 14 days.

Minimization and retention

• Automatic purges: daily morning run (deleted accounts, brands, organizations and conversations, activity log, expired invitations), monthly run (brands whose subscription ended 12 months ago, contact and demo requests, feedback, usage events older than 25 months), hourly cleanup (sign-in codes, security log, sessions, messages awaiting sending, expired tokens).
• Limited retention of raw answers from collection providers (30 days) and of page captures (183 days).
• Language models: requests sent without storage of the responses by the service (store: false); no training of the models on this data; the provider stores requests and responses in the European Union for abuse monitoring, for a limited period that it sets, with automated review and then, if necessary, review by authorized employees located in the European Economic Area.
• Collection providers and engine publishers: each retains collection requests and responses in accordance with its data processing agreement, from the time needed to generate the response to 12 months depending on the provider, or until the end of the service; up to 2 years for content flagged under a usage policy. For one of the Custom plan engines, iPand enables the zero data retention offered by its publisher before opening that engine to collection. The period applied by each is stated in the list of subprocessors (Annex C).
• No production data in development environments; no pre-production environment.

Organization

• Staff bound by confidentiality; access to production data limited to support and operational needs.
• Internal procedure for managing personal data breaches.

Annex C — Authorized subprocessors

The up-to-date list of subprocessors (identity, role, data processed, place of processing and transfer safeguards) is kept by iPand and provided to the Customer on request, at contact@ipand.io. The Customer is notified by email at least 30 days before any addition or replacement of a subprocessor, and may object under the conditions of Article 6.