Data Processing Agreement

Preamble

This DPA applies to the contractual relationship between PrivateCore as publisher and its professional customers. It clarifies each party's GDPR role, the security guarantees the publisher provides, and how data-subject rights are handled.

Article 1 : Roles

The Customer is the controller for all personal data processed through the PrivateCore software on its Mac Mini (customer data, employee data, supplier data, transactions, etc.).

The publisher acts as a processor under article 28 of the GDPR only in the following cases:

• Remote maintenance explicitly accepted by the Customer (Tailscale tunnel activated by the Customer).
• Software updates deployed on the Customer's Mac Mini.
• Technical support (email or phone exchanges initiated by the Customer).

Article 2 : Categories of data

The categories of personal data processed depend on the Customer's use of the software, without the publisher having prior knowledge of their content:

• End-customer data (contact details, commercial history).
• Employee data (contact details, scheduling, payroll, working time).
• Supplier and contractor data.
• Transaction data (invoices, payments, accounting).

This data remains physically on the Customer's Mac Mini and is never collected or stored by the publisher by default.

Article 3 : Documented instructions

The publisher acts only on the Customer's written instructions (email, support ticket, signed quote). Any instruction contrary to GDPR or French law will be flagged to the Customer and may justify suspending the intervention.

Article 4 : Confidentiality

Publisher personnel with potential access to data (currently the founder only) is bound by a written confidentiality commitment, extending beyond the end of assignment.

Article 5 : Security measures

The publisher implements the following technical and organisational measures:

• At-rest encryption (Apple FileVault, AES-256) on every Mac Mini.
• In-transit encryption (TLS 1.3 for web traffic, WireGuard via Tailscale for remote administration).
• Strong authentication by certificate and private key for any administrator access.
• Immutable, timestamped, cryptographically signed audit logs available to the Customer.
• Strict environment separation (each customer has its own Mac Mini : no multi-tenancy).

Article 6 : Sub-processing

The publisher will not engage any further sub-processor without the Customer's prior written approval. The list of approved sub-processors is provided on request and updated at every change.

Article 7 : Transfers outside the European Union

No data transfer outside the EU/EEA occurs in the scope of processing. Cloudflare (used only for the marketing website privatecore.fr tunnel) only receives TLS-encrypted traffic and no PrivateCore customer data.

Article 8 : Data-subject rights

The publisher assists the Customer, as far as reasonably possible given the nature of processing, in responding to data-subject rights requests (access, rectification, erasure, portability, objection).

Since requests are addressed to the Customer as controller, the Customer remains in charge of the final response.

Article 9 : Breach notification

In the event of a personal data breach affecting the processing activities sub-processed by the publisher, the publisher informs the Customer within 48 hours of detection, with the information needed for the Customer's own CNIL notification where applicable.

Article 10 : Audit

The Customer may audit the publisher's infrastructure with 30 days' written notice. One annual audit is offered; any additional audit is at the Customer's expense (publisher time billed at the prevailing rate). The audit may be conducted by the Customer or a third party of its choice, subject to a confidentiality undertaking.

Article 11 : End of processing

Upon termination, all processed personal data remains physically with the Customer (on its Mac Mini). The publisher has no data to return or delete on its side, since it holds no copy. The publisher erases its own intervention logs within 90 days at most.

This DPA is available on written request to [email protected] for formal signature.