Data processing agreement

Purpose and parties

This agreement forms part of the contract between the customer and KASOCORP SAS ("Cairn"). It applies to the personal data that Cairn processes on behalf of the customer when it provides the service. For that data the customer is the controller and Cairn is the processor, in the sense of Regulation (EU) 2016/679 (the GDPR).

Details of the processing

• Subject and purpose: providing the Cairn service to the customer, which means hosting a workspace, displaying it to the people the customer authorises, sharing parts of it through share links, and making it available to agents the customer connects.
• Duration: the length of the subscription, then the deletion described below.
• Nature: storage, display, transmission, backup and deletion.
• Data subjects: the customer's staff and contractors, and the people named in the customer's roadmaps.
• Categories of data: name, email address, role, team, project ownership, records of actions, and the free text that the customer enters. The service is not meant for sensitive categories of data, and the customer does not enter them.

Instructions

Cairn processes the data only on the customer's documented instructions, which are the contract, the use of the service and the customer's written requests. Cairn tells the customer if it believes an instruction breaks the law.

Confidentiality

People who work with the data at Cairn are bound by a duty of confidentiality.

Security

Cairn takes measures that fit the risk. Today they include:

• traffic between the customer and the service is encrypted;
• every person has a role in each workspace, and what they can do follows that role;
• sessions, API tokens and refresh tokens are stored as hashes;
• a share link shows only the fields that were chosen for it, and can expire or be revoked;
• workspaces are kept apart by checks in the application, over one shared database;
• changes and sensitive actions are recorded;
• the database is copied to backups.

Sub-processors

The customer gives Cairn a general authorisation to use the sub-processors listed on the sub-processors page. Cairn tells the customer at least 30 days before it adds or replaces one, and the customer can object on reasonable grounds within that time. Cairn imposes on each sub-processor obligations that protect the data to the same level as this agreement, and remains responsible for it.

Help for the customer

Taking into account the nature of the processing, Cairn helps the customer to answer requests from data subjects, to secure the data, to report a breach, and to carry out an impact assessment where one is needed.

Personal data breach

Cairn tells the customer without undue delay after it becomes aware of a personal data breach that affects the customer's data, and gives the information it has that the customer needs to meet its own duties.

Deletion and return

At the end of the services, Cairn gives the customer a copy of its workspace content in a common format on request, then deletes the content from the live database. Backups expire at the end of their retention period, which is 30 days. Cairn keeps data longer only where the law requires it.

Audits

Cairn gives the customer the information needed to show that it meets this agreement, and allows audits by the customer or by an auditor it appoints, once a year on reasonable notice, during working hours and at the customer's cost, without access to the data of other customers.

Transfers outside the European Economic Area

Cairn transfers personal data outside the European Economic Area only with a safeguard that the GDPR allows, such as an adequacy decision or the standard contractual clauses.

Order of precedence and law

If this agreement and the terms of use differ on data protection, this agreement prevails. French law governs it, and the courts named in the terms of use have jurisdiction. The French text prevails and the English text is a courtesy translation.