Ductis

Data processing agreement

Version of 31 October 2026

This English version is provided for convenience. In case of discrepancy, the French version prevails.

Agreement made under Article 28 of Regulation (EU) 2016/679 (GDPR) between the Customer, as controller, and [to complete: publisher’s company name — ORIGO EVERWORKS, or your own name if a sole trader], as processor. It forms part of the terms of use.

1. Subject and duration

The processor processes personal data on behalf of the Customer for the sole purpose of providing the Ductis Service (sales management, invoicing, stock, collaboration), for as long as the Customer has access and until its data is deleted.

2. Data and data subjects

  • Data subjects: the Customer’s customers, prospects, suppliers and contacts; the Customer’s Users.
  • Data: identity and business contact details, commercial information (quotes, orders, invoices, payments), messages exchanged in the Service.
  • The Customer undertakes not to record special category data (health, opinions, etc.) in the Service.

3. Processor commitments

  • process the data only on the Customer’s documented instructions, these terms constituting such instructions;
  • ensure that people authorised to process the data are bound by confidentiality;
  • implement the security measures described in section 5;
  • help the Customer respond to requests from data subjects and meet its security and impact assessment obligations;
  • notify the Customer of any personal data breach as soon as possible, and no later than 48 hours after becoming aware of it;
  • make available the information needed to demonstrate compliance with this agreement.

4. Sub-processors

The Customer authorises the following sub-processors: IONOS SARL (hosting, data centre: [to complete: country of the server’s data centre, shown in the IONOS customer area]) and, once email sending is enabled, Brevo (France). Any addition or replacement is announced to the Customer at least 30 days in advance; the Customer may object and, failing agreement, stop using the Service. No data is transferred outside the European Union.

5. Security measures

  • encrypted communications (HTTPS/TLS);
  • hashed passwords (scrypt), revocable sessions, two-factor authentication available;
  • strict data isolation per company, checked by automated tests;
  • role management and audit log of actions;
  • daily backup kept for 14 days, with an integrity checksum;
  • firewall-protected server, key-only administrative access, automatic security updates.

Known limitation during the pilot phase: backups are stored on the same server as the Service. An off-site copy is planned before the end of the pilot phase.

6. End of processing

When the workspace is closed, the Customer has 30 days to export its data. It is then deleted from the Service, and from backups no later than 14 days afterwards. A deletion certificate can be provided on request.

7. Customer obligations

The Customer guarantees that it has a legal basis for the processing it entrusts, informs data subjects and remains their point of contact for exercising their rights.