Data processing agreement

This data processing agreement (the “agreement”) forms an integral part of the Tikivio general terms. It applies to every organisation from its creation — during the trial, on the Free plan and on a paid plan alike — until its data is deleted.

1. Subject, parties and roles

The agreement is made between the operator of Tikivio, FACILICLIC (SARL à associé unique, SIREN 492489521; 4 Avenue du Général de Gaulle, 49400 Saumur), hereinafter “the operator”, and the organisation on whose behalf it is accepted, hereinafter “the organisation”.

For the personal data that the organisation processes in Tikivio on its own account — its requesters, its end customers, their messages, attachments, tasks and notes — the organisation is the controller and the operator is its processor within the meaning of Article 28 of Regulation (EU) 2016/679 (“GDPR”). The agreement sets out the operator’s obligations in that capacity.

The operator is itself a controller for user accounts, billing and payment, the security of the service and its technical logs, the audit log, the support requests addressed to it and product requests: that processing is covered by the privacy policy, not by this agreement.

Where the operator uses Tikivio for its own needs (internal organisation), it is the controller of the data it processes there; the agreement is accepted for that organisation as for the others, so that the same rule applies to all.

2. Definitions

• Organisation data: the personal data described in Annex 1, which the organisation or its requesters and end customers enter, send or receive in Tikivio.
• Sub-processor: a provider to which the operator entrusts all or part of the processing of organisation data.
• Data breach: a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, organisation data.
• Administrator: an administrator of the organisation in Tikivio; the notices provided for by the agreement are sent by e-mail to the active administrators.
• Business days: Monday to Friday, excluding public holidays in France.

3. Term

The agreement takes effect when it is accepted, at the creation of the organisation or, for an organisation created before it was introduced, when one of its administrators accepts it. It applies for as long as the operator holds organisation data: trial, Free plan, paid plans, read-only period and closure, until the deletion described in Article 11.

4. Instructions of the organisation

• The operator processes organisation data only on the organisation’s documented instructions: this agreement, the general terms, the settings chosen by its administrators in the application and the written requests of its administrators.
• The sole purpose is to provide the service. Apart from the case of abuse and reports, set out below, the operator uses organisation data for no other purpose: no marketing, no resale, no training of an artificial intelligence model. The only exception to that purpose and to the absence of marketing is the Tikivio notice carried by the e-mails sent to requesters, provided for in section 5a of the general terms and described below — the same for all recipients of its category, in the language of the e-mail, without targeting or tracking, and with no requester data going into its text.
• If an instruction appears to it to infringe the GDPR or another data protection rule, the operator immediately informs the organisation and may suspend its execution until it is confirmed or amended.
• No transfer outside the European Union takes place other than those of Annex 4. If European Union law or French law, to which the operator is subject, requires it to carry out other processing, it informs the organisation beforehand, unless that law prohibits such information on important grounds of public interest.
• Abuse and reports. By way of exception, the operator processes on its own behalf, as a controller, the organisation data strictly necessary to: examine a report concerning the organisation; withdraw or make inaccessible content that is manifestly illegal or contrary to the general terms (section 8a of those terms), or block the organisation; keep the evidence of it; answer a judicial or administrative authority that requires it in the forms provided by law. It informs the organisation of the measure and of its reasons, by e-mail to its administrators, no later than when the measure takes effect, unless the law or the authority prohibits it. It uses that data for no other purpose.
• Tikivio notice in e-mails. The e-mails that the service sends to requesters on behalf of the organisation, from its mailbox and under its name — acknowledgement of receipt, agent reply, participant notice, including when they leave through the fallback sending, from Tikivio’s server — carry below their footer a short Tikivio notice, set by plan in section 5a of the general terms: for an organisation on the Free plan, a short message presenting Tikivio and its free trial; for other organisations, a signature line that names Tikivio and invites the reader to create their own help desk too. The presentation message is only placed in an e-mail addressed to the requester who opened the request themselves and wrote in it — by an e-mail received from their address, from the portal, or from the help widget with a proven address; any other recipient receives the signature line: a participant, the requester of a request created on their behalf by an agent, even if they reply to it later, or an address passed on by the organisation’s website without proof. The notice is the same for all recipients of the same category, in the language of the e-mail: it is neither targeted nor personalised, it contains no image, pixel or tracking parameter, and no requester data goes into its text; to choose between the presentation message and the signature line, only the author of the request’s messages, the way the request was opened and the proof of the address are read from the request, and for no other purpose. The operator builds no file from these addresses and never sends requesters a separate message on its own behalf: this notice, placed in the organisation’s e-mails, is the only Tikivio communication they receive in them. The e-mails of the operator’s internal organisation carry no notice.

5. Confidentiality and access by the operator

• The persons the operator authorises to process organisation data are bound by confidentiality.
• In the normal course of the service, the operator does not view an organisation’s content. Exceptional access remains possible for support, for security or to examine a report concerning the organisation: it is opened by a platform administrator signed in with two-step authentication, read-only, for 30 minutes at most, with a mandatory reason, and it is recorded in the audit log. The record of such access is provided to the organisation on written request from an administrator.
• The operator develops and runs Tikivio with the help of an artificial intelligence development agent. That agent reads no organisation content outside a product request the operator has authorised it to handle; the provider that supplies it receives data only if it is listed in Annex 3.

6. Security

The operator applies the technical and organisational measures described in Annex 2. It may change them, without lowering their level. The organisation remains responsible for the choice of its users and their rights, the confidentiality of their credentials, the enabling of two-factor authentication, the security of its own mailboxes and of the site on which it installs the widget.

7. Sub-processors

• General authorisation. The organisation authorises the operator to use the sub-processors of the base list (Annex 3, section 1). The current, dated list is published on the “Sub-processors” page of the Tikivio site.
• Specific authorisation for the translation of exchanges. The translation provider (Annex 3, section 2) receives no data from an organisation until one of its administrators has enabled translation and accepted the activation text, which names the provider, the data sent, the possible transfer outside the European Union and its safeguard. That acceptance is a specific authorisation; disabling translation ends it for the future.
• Same obligations. The operator imposes on each sub-processor, by contract, data protection obligations equivalent to those of the agreement and remains fully liable to the organisation for it.
• Notice. Before adding or replacing a sub-processor, the operator notifies the administrators by e-mail and updates the “Sub-processors” page at least 30 days before that provider processes organisation data. The notice gives its name, address, role, the data concerned, the place of processing and the safeguard for any transfer.
• Objection. The organisation may object to the change in a reasoned written notice sent to support@tikivio.com before its effective date; without an objection by that date, the change is deemed accepted. If the objection is maintained after discussion, the new provider does not process that organisation’s data. If it cannot be set aside for a single organisation, either party may terminate the subscription at no cost — the operator with 30 days’ notice — and the part of the subscription paid in advance for the period after termination is refunded by a credit note.
• Providers’ notices. When a sub-processor notifies the operator of a change to its own sub-processors, the operator relays that notice to the administrators within 5 business days, with the same right to object.
• Emergency. No new provider processes organisation data without prior notice. If a provider fails, the operator falls back only on a provider already authorised; failing that, it asks for the administrators’ written authorisation.

8. Transfers outside the European Union

The operator does not transfer organisation data outside the European Union, except in the cases described in Annex 4, with the safeguard stated there for each provider.

9. Assistance to the organisation

• Requests from individuals. The organisation itself answers data subjects, using the functions of the application (search, editing, export). If an individual sends a request to the operator, the operator does not answer on the substance and forwards it to the organisation within 5 business days.
• Erasure of an end customer. On written request from an administrator sent to support@tikivio.com, the operator erases the data of a named end customer or requester — their record, their requests, the related messages and attachments — within 10 business days and confirms it in writing. It keeps a record of that erasure in its register — organisation, date, reference of the request and a digital fingerprint of the erased address, with no other data — so that it can be carried out again if an earlier backup had to be restored. Backups follow the rule of Article 11.
• Impact assessment and supervisory authority. The operator provides the organisation with the documentation needed for an impact assessment or a consultation of the supervisory authority: this agreement, its annexes and the detail of the security measures.
• This assistance is not charged, within the limits of reasonable use.

10. Data breach

The operator notifies any data breach to the organisation’s administrators, by e-mail, without undue delay and no later than 72 hours after becoming aware of it. The notice describes the nature of the breach, the categories and approximate number of individuals and records concerned, its likely consequences, the measures taken or proposed and the contact point; information not yet available at that time is provided afterwards, without further delay. The operator keeps a register of breaches. It does not itself notify the supervisory authority or the data subjects in place of the organisation, unless the organisation asks it to.

11. End of the service

• Return. At any time, including in read-only mode, during a closure and when the organisation is blocked for abuse, an administrator can export the organisation’s data from the application: requests, messages, requesters, end customers, tasks and, optionally, attachments. The export contains neither the raw copy of inbound e-mails (as received, with their headers) nor the translations of messages. Nor does it contain content that the operator has withdrawn for abuse (Article 4). Where the organisation’s attachments exceed 2 GiB, the export from the application cannot contain them: on written request from an administrator sent to support@tikivio.com, the operator hands them over within 10 business days, and deletion is suspended for as long as a handover requested before the scheduled date has not been made. An organisation that wishes to keep its data exports it before deletion.
• Requested closure. When an administrator requests the closure of the organisation, it becomes read-only; the closure can be cancelled for 30 days, after which the data is deleted.
• Automatic end. When the trial ends without a subscription and the organisation does not move to the Free plan, when a cancelled period ends in the same situation, or when a payment default is not settled within the period set by the general terms, the organisation becomes read-only for 30 days: export remains possible, as does subscription once online payment is open (Article 6 of the general terms), and a reminder is sent to the administrators 7 days before the end of that period. Closure is then scheduled: the data is deleted 30 days later, after another reminder 7 days before. An administrator may cancel that closure once only, for 7 days, in order to subscribe.
• Free plan. On the Free plan, the contract continues. An organisation with no member sign-in and no new request for 12 months is deleted after a notice by e-mail 30 days and then 7 days beforehand, which offers the export.
• Collection stops. As soon as the organisation is read-only for one of these reasons, or being closed, the operator stops collecting its mailboxes: uncollected messages stay with its e-mail provider.
• Deletion. On the scheduled date, the organisation’s content is deleted — requests, messages, attachments, stored e-mails, requesters, end customers, tasks, mailboxes and their credentials, settings, memberships — whether or not an invoice remains due.
• What remains, and why. Invoices, credit notes, payments and billing details, together with the subscription history, are kept for accounting obligations. The organisation’s record — its name, its identifier, its dates and the reason for the closure — is kept with them; 5 years after deletion, the name, the identifier and the reason are erased from it (the name remains on the invoices). The proof of acceptance of the agreement, which bears the organisation’s name, is kept for 5 years after deletion. The audit log lines that concern the organisation are deleted 12 months after they were written. In the event of abuse (Article 4): withdrawn content is kept as evidence, inaccessible to everyone, then permanently deleted 90 days after its withdrawal; an organisation blocked for abuse has 30 days to appeal to support, after which its closure is scheduled and its data is deleted 30 days later — while the block lasts, a closure already scheduled can only be cancelled by lifting the block, and nothing is deleted before the end of the appeal period; the operator may suspend either of these deletions by keeping the data as evidence, for a set period recorded with its reason, when an authority requires it or proceedings are under way; the file of a report and the register of decisions are kept for 12 months after the case is closed. User accounts are covered by the privacy policy.
• Backups. Encrypted backups are not altered by a deletion; they are erased by rotation: on the server, none is kept for more than 12 months; the off-server copy is erased no later than 17 months after it was made. A backup is never restored, except after an incident; in that case, the operator deletes again the data that had been deleted, including the data covered by the erasures of Article 9.

12. Audits

• Documentation. Once a year, on written request from an administrator sent to support@tikivio.com, the operator provides free of charge the documentation showing compliance with the agreement: security measures, results of the restore checks, list of sub-processors, register of the breaches that concern the organisation.
• On-site audit. If that documentation is not sufficient, the organisation may carry out an audit, itself or through an independent auditor of its choice bound by confidentiality, with 30 days’ notice, once a year, or without that limit after a data breach. The audit takes place during business hours, without access to other organisations’ data; each party bears its own costs.
• Sub-processors. They are checked on the basis of their reports and attestations, which the operator passes on to the organisation where they may be disclosed.

13. Register and contact

The operator keeps the record of the categories of processing carried out on behalf of organisations (GDPR, Article 30(2)). For any question about the agreement: support@tikivio.com.

14. Liability

Each party is liable for its own breaches, under the conditions of Article 12 of the general terms. The agreement limits neither the rights of data subjects nor the powers of supervisory authorities.

15. Acceptance, proof, amendment, precedence

• The agreement is accepted online, on behalf of the organisation, by the person who creates it or by one of its administrators, by ticking a box; that person declares that they are able to commit the organisation. No organisation is created without that acceptance.
• The operator keeps the proof of acceptance: the version and text accepted, the list of sub-processors on that date, the date, the person and the IP address. It is kept for the term of the contract, then for 5 years, and administrators can read it again in the application. A signed copy is provided on written request.
• Except for updates to the list of sub-processors, which are governed by Article 7, any amendment of the agreement is notified by e-mail to the administrators at least 30 days before it takes effect and is subject to their acceptance; publication on the site alone is not a notification. A change in the operator’s identity or contact details, or a correction of form with no effect on the parties’ rights and obligations, is simply notified for information.
• In the event of a conflict with the general terms on the protection of personal data, the agreement prevails.

Annex 1 — Description of the processing

Subject and purpose

Providing the Tikivio service: receiving, tracking and handling the organisation’s support requests, keeping the list of its end customers and requesters, planning tasks, tracking deadlines.

Nature of the operations

Receipt (e-mail, widget, portal, entry by an agent), recording, organisation, consultation, sending of replies by e-mail — through the organisation’s mailbox or, if it has connected none and the fallback sending is in service, by Tikivio on behalf of the organisation, to proven addresses only —, receipt of the replies to these fallback e-mails, export, backup, deletion; translation of exchanges only if an administrator enables it.

Duration

That of the agreement (Article 3).

Data subjects

The organisation’s requesters and end customers and the persons they mention in their exchanges; the members of the organisation, as authors of messages and notes.

Categories of data

Identity and contact details (name, e-mail address, telephone and company if entered); content of requests, messages and internal notes; attachments; inbound e-mails, with their headers; dates, statuses and language of the exchanges; IP addresses of its offices that the organisation declares as trusted addresses.

Sensitive data

Tikivio is not designed to process health data, other special categories of data or data relating to offences. The organisation refrains from asking its end customers for such data and remains responsible for any that messages and attachments may contain.

Place of processing

See Annexes 3 and 4.

Annex 2 — Security measures

• Separation. Every piece of data carries the identifier of its organisation and every access is filtered by organisation; this separation is verified by automated tests at each version.
• Access. Individual accounts; hashed passwords, never stored in clear text; two-factor authentication offered to everyone, which an organisation can require of its administrators and which is mandatory for platform administrators; roles and permissions per organisation; sessions limited to 12 hours without activity and revocable.
• Transport. The application, the widget and the portal are served over HTTPS (TLS) only.
• Encryption at rest. Secrets — mailbox credentials, two-factor authentication secrets — are encrypted by the application. The database, attachments and stored e-mails are not encrypted at rest on the server. Backups are encrypted.
• Attachments. They are stored outside the public area of the server and served after a rights check.
• Backups. Encrypted backups every 4 hours; restore verified every week; encrypted off-server copy with the provider of Annex 3, which does not hold its key.
• Monitoring. The service, its scheduled tasks, its backups and its disk space are monitored continuously; anomalies are reported to the operator.
• Audit log. Sensitive operations are recorded (author, date, IP address) and kept for 12 months.
• Access by the operator. Named platform administrators, signed in with two-step authentication; exceptional access to an organisation’s content is read-only, limited to 30 minutes, justified and recorded.
• Development. The development environment is separate from production and uses demonstration data only.
• Limits. The service does not offer end-to-end encryption and promises no availability figure.

Annex 3 — Sub-processors and other providers

List as at the version of this text. A provider whose entry carries an effective date processes no organisation data before that date. The “Sub-processors” page of the site gives the current dated version of this list.

Section 1 — Base list (general authorisation)

Scaleway SAS — Dedibox (dedicated server)

Address

8 rue de la Ville-l’Évêque, 75008 Paris, France

Contact

privacy@scaleway.com

Role

Hosting of the dedicated server that runs Tikivio: application, database, files, stored inbound e-mails, encrypted local backups.

Data

All data processed by Tikivio.

Place of processing

France (Scaleway data centre, country confirmed by the operator).

Transfer safeguard

Tikivio has chosen no location outside the European Union for this service; any transfer decided by the provider is governed by its own data processing agreement.

Its own list of sub-processors

https://www.scaleway.com/en/subprocessorlist/

Scaleway SAS — Transactional Email

Address

8 rue de la Ville-l’Évêque, 75008 Paris, France

Contact

privacy@scaleway.com

Role

Sending of the platform’s own e-mails: address verification, invitations, widget confirmation codes, invoices, notifications. When the fallback sending is in service for an organisation without a sending mailbox: acknowledgements and its agents’ replies addressed to its end customers.

Data

E-mail address and name of the recipient (including end customers who use the widget), subject and content of the e-mail; for the fallback sending, subject and content of the exchanges between the organisation and its end customers.

Place of processing

France (Paris) — Union européenne / European Union

Transfer safeguard

Tikivio has chosen no location outside the European Union for this service; any transfer decided by the provider is governed by its own data processing agreement.

Its own list of sub-processors

https://www.scaleway.com/en/subprocessorlist/

OVH SAS — Object storage

Address

2 rue Kellermann, 59100 Roubaix, France

Contact

dpo@ovh.com — https://www.ovh.com/fr/protection-donnees-personnelles/exercer-vos-droits

Role

Off-server copy of the encrypted backups; the provider does not hold the encryption key.

Data

Encrypted backups of all data processed by Tikivio.

Place of processing

France (Roubaix)

Transfer safeguard

Tikivio has chosen no location outside the European Union for this service; any transfer decided by the provider is governed by its own data processing agreement.

Its own list of sub-processors

https://contract.eu.ovhapis.com/1.0/pdf/OVH_Sub_processors-fr.pdf

TITAN DATACENTERS FRANCE (SAS) — Hosting of the tikivio.com mail service

Address

7 avenue Michel Chevalier, ZI Les Bois de Grasse, 06130 Grasse, France

Contact

dpo@titandc.fr

Role

Hosting of the tikivio.com mail service: support mailbox, replies sent to the platform’s e-mails and reply mailbox of the fallback e-mails.

Data

E-mails received and sent by Tikivio support, including end customers’ replies to the platform’s e-mails; replies of the organisations’ end customers to the fallback e-mails, kept in this mailbox for 30 days at most.

Place of processing

France

Transfer safeguard

Tikivio n’a choisi aucun emplacement hors de l’Union européenne pour ce service. / Tikivio has chosen no location outside the European Union for this service.

Its own list of sub-processors

This provider does not publish a list of its own sub-processors.

Section 2 — Only if the organisation enables the translation of exchanges (specific authorisation)

Section 3 — Separate controller (outside this agreement)

Online payment is not open yet: no payment provider receives data.

Section 4 — Technical providers that receive no organisation data

• updown.io: External monitoring of the availability of the service: only public Tikivio addresses are queried.
• Cloudflare: Domain name service (DNS) of tikivio.com.
• Let’s Encrypt (Internet Security Research Group): TLS certificates of the Tikivio domains.

Annex 4 — Transfers outside the European Union

For each provider of sections 1 and 2, the place of processing and the safeguard for any transfer:

• Scaleway SAS — Dedibox (dedicated server)
  Place of processing: France (Scaleway data centre, country confirmed by the operator).
  Transfer safeguard: Tikivio has chosen no location outside the European Union for this service; any transfer decided by the provider is governed by its own data processing agreement.
• Scaleway SAS — Transactional Email
  Place of processing: France (Paris) — Union européenne / European Union
  Transfer safeguard: Tikivio has chosen no location outside the European Union for this service; any transfer decided by the provider is governed by its own data processing agreement.
• OVH SAS — Object storage
  Place of processing: France (Roubaix)
  Transfer safeguard: Tikivio has chosen no location outside the European Union for this service; any transfer decided by the provider is governed by its own data processing agreement.
• TITAN DATACENTERS FRANCE (SAS) — Hosting of the tikivio.com mail service
  Place of processing: France
  Transfer safeguard: Tikivio n’a choisi aucun emplacement hors de l’Union européenne pour ce service. / Tikivio has chosen no location outside the European Union for this service.

No other transfer outside the European Union is made on behalf of the organisation.