Data Processing Agreement

Tootela is operated by Tootela SAS, a French company. This DPA is provided in English for convenience; in case of dispute, French law applies as set out in the Terms of Service.

1. Parties

This Data Processing Agreement ("DPA") is entered into between Tootela SAS ("Processor" or "Tootela") and the customer who has accepted the Tootela Terms of Service ("Controller" or "Customer"). It forms part of the Terms of Service and applies whenever Tootela processes Personal Data on behalf of the Customer.

2. Definitions

Capitalised terms used here have the meanings set out in the EU General Data Protection Regulation 2016/679 ("GDPR") unless otherwise stated. "Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Subprocessor" follow the GDPR definitions. "Customer Content" has the meaning given in the Terms of Service.

3. Subject & duration

The subject matter, nature, purpose, types of Personal Data and categories of Data Subjects are described in Annex A. This DPA applies for the duration of the Customer's subscription, plus the post-termination period necessary to return or delete data as described in section 12.

4. Processing only on documented instructions

Tootela processes Personal Data only on the documented instructions of the Customer, which include the Terms of Service, the configuration choices made in the Customer's workspace, and any further instructions agreed in writing. Tootela will inform the Customer if it considers an instruction infringes the GDPR or other applicable data protection law.

Tootela does not transfer Personal Data outside the scope of this DPA, does not sell Personal Data, and does not use Customer Content to train AI models (and contractually prohibits its AI Subprocessor from doing so).

5. Confidentiality

Tootela ensures that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations and are trained on data protection.

6. Security measures

Tootela implements appropriate technical and organisational measures (TOMs) to ensure a level of security appropriate to the risk. The current TOMs are described in Annex B. Tootela may update TOMs from time to time provided the level of protection is not reduced.

7. Subprocessors

The Customer authorises Tootela to engage Subprocessors listed in Annex C, and any other Subprocessor notified to the Customer at least 30 days before they begin processing Personal Data. The Customer may object to a new Subprocessor on reasonable grounds (data protection); if the parties cannot agree within 15 days, the Customer may terminate the affected service for convenience. Tootela imposes contractual obligations on every Subprocessor that are no less protective than those of this DPA.

8. Assistance with data subject rights

The Customer can fulfil many Data Subject requests directly through the normal functionality of the product (viewing, correcting and deleting records inside its own workspace). For requests that require Tootela's support : including access, portability or erasure requests that go beyond what the workspace tools allow : the Customer contacts contact@tootela.net, and Tootela will assist by appropriate technical and organisational measures, taking into account the nature of the processing.

If a Data Subject contacts Tootela directly with a request relating to the Customer's processing, Tootela will redirect the request to the Customer.

9. Personal data breach notification

Tootela notifies the Customer without undue delay (and in any case within 48 hours) after becoming aware of a Personal Data Breach affecting the Customer's data. The notification includes the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

10. International transfers

Personal Data is processed primarily in the European Union (default region: eu-west-3 (Paris, France)). When Personal Data is transferred outside the EEA, Tootela relies on:

• An adequacy decision under Article 45 GDPR, or
• EU Standard Contractual Clauses (Module 3, Processor-to-Processor for Subprocessors) approved by Commission Implementing Decision (EU) 2021/914, supplemented by appropriate technical and organisational measures (encryption, pseudonymisation, access controls).

The SCCs are incorporated by reference. The Customer accepts them as data exporter; Tootela accepts them as data importer for transfers to its non-EEA Subprocessors.

11. Audit rights

Tootela makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR. Audits are usually satisfied by:

• The Security page, kept current
• Written responses to the Customer's reasonable security questionnaires

If those resources are insufficient, the Customer may request an on-site audit, conducted at the Customer's expense, on at least 30 days' written notice, at most once per year, during business hours, and subject to mutually agreed scope and confidentiality.

12. Return and deletion of data

On termination of the subscription, the Customer has 30 days to export its Customer Content : through the product where the relevant app provides an export, or by requesting an export from contact@tootela.net. After that window, Tootela deletes all Customer Personal Data from its production systems, except as required for legal retention (e.g. billing records). Backups are overwritten on the backup provider's rotation schedule.

13. Liability

The liability provisions of the Terms of Service apply equally to this DPA. Nothing in this DPA limits or excludes liability that cannot be excluded under applicable law.

Annex A : Description of the processing

Subject matter

Provision of the Tootela business operating system (chat, mail, calendar, documents, drive, projects, CRM, helpdesk, HR, AI assistant and related features).

Nature and purpose

Hosting, storing, transmitting, displaying, indexing, searching, processing and protecting Customer Content as configured by the Customer in their workspace.

Duration

For the duration of the Customer's subscription, plus 30 days for export, plus the backup rotation period.

Categories of Data Subjects

• The Customer's employees and contractors
• The Customer's clients, prospects and contacts
• Job applicants (if the Customer uses the recruitment app)
• Any other Data Subjects whose Personal Data the Customer chooses to process via Tootela

Categories of Personal Data

• Identification data (name, email, phone, role)
• Professional data (employer, title, department)
• Communications content (messages, emails, documents, comments, files)
• Activity data (calendar events, tasks, deals, tickets)
• Authentication data (hashed passwords, verification codes, session tokens)
• Technical data (IP, browser, device, logs)
• Special categories of data : only if the Customer chooses to upload them; Tootela does not require special-category data

Annex B : Technical and organisational measures

The current TOMs are documented on the Security page and incorporated here by reference. Headline controls:

• TLS encryption in transit; encryption at rest managed by our infrastructure providers
• Authentication managed by Supabase Auth : passwords hashed, never stored in clear; email-code two-factor authentication available
• Row-level security at the database level for tenant isolation
• Role-based access control inside each workspace
• Production access restricted to a small number of authorised people
• Daily backups performed by our database provider
• EU-hosted database (eu-west-3 (Paris, France))
• Breach notification to the Customer within 48 hours of becoming aware
• Vendor review and a written DPA for every Subprocessor

Annex C : List of Subprocessors

Updated whenever this list changes; the current Subprocessors are: