Data processing agreement (DPA)

This Agreement sets out the conditions under which Kip processes, on behalf of the Customer, the personal data needed to provide the Service. It applies for the entire term of the Terms and until Kip has fully deleted or returned the data.

Kip hosts, stores, organises, displays, transmits, translates, indexes and deletes data in order to provide the Customer with an internal team app: announcements, procedures, maintenance, training, messaging, events, anonymous surveys, onboarding, statistics, notifications and AI-assisted features (translation, summaries, semantic search).

Data subjects

Members of the Customer’s staff and people working on its behalf, invited as Users; where applicable, people mentioned in content published by the Customer.

Categories of data

First and last name, email address, role, department, establishment, profile picture, language; published content (texts, files, media, messages, tickets, training results, anonymous survey answers); connection logs; push notification subscription identifiers.

Special categories

None. The Customer undertakes not to process data covered by Article 9 or 10 GDPR in the Service.

The Customer determines the purposes and essential means of processing, has a legal basis for each processing operation, informs data subjects (in particular its employees) and only provides Kip with lawful and relevant data. It is the point of contact for data subjects.

Kip undertakes to:

• Instructions: process data only on the Customer’s documented instructions — the Terms, this Agreement and the Service configuration constitute those instructions — and immediately inform the Customer if an instruction appears to infringe the GDPR;
• Confidentiality: ensure that persons authorised to process the data are bound by confidentiality and access it only as necessary;
• Security: implement the measures required by Article 32 GDPR, described in section 6 below;
• Sub-processors: comply with the conditions in section 7;
• Data subject rights: assist the Customer, through appropriate measures, in responding to requests to exercise rights (access, rectification, erasure, restriction, portability, objection), and forward without delay any request received directly;
• Assistance: help the Customer comply with Articles 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the information available to Kip;
• Records: keep a record of processing activities carried out on behalf of the Customer.

• encryption of data in transit (HTTPS/TLS);
• isolation of each establishment’s data through database row-level security policies;
• two-factor authentication available to Users and a strong password policy;
• least-privilege access management, for Kip staff and User roles alike;
• hosting with established providers, backups and access logging;
• regular review of measures in light of evolving risks.

The Customer grants Kip a general authorisation to engage sub-processors. The list in force on the date of this Agreement is set out below.

Kip informs the Customer of any addition or replacement of a sub-processor, by email or in the Service, at least 30 days before it takes effect. The Customer may object on reasonable data protection grounds within that period; if no solution is found, the Customer may terminate the Service without penalty, effective on the date the change takes effect.

Kip contractually imposes on each sub-processor data protection obligations at least equivalent to those of this Agreement and remains liable to the Customer for their performance.

Where data is transferred outside the European Economic Area, in particular to sub-processors based in the United States, such transfers are governed by the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and/or the EU–US Data Privacy Framework where the recipient is certified, supplemented by additional measures where necessary.

Kip notifies the Customer of any personal data breach within 48 hours of becoming aware of it. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Kip assists the Customer with its obligations to notify the supervisory authority and data subjects.

When the Terms end, the Customer may request an export of its data. Kip deletes all data processed on behalf of the Customer, including copies, within 90 days of definitive termination, or earlier upon the Customer’s written request, unless retention is required by law. Backups are overwritten according to their normal rotation cycle.

Kip makes available to the Customer the information needed to demonstrate compliance with this Agreement. The Customer may, at its own expense, carry out an audit no more than once a year (unless a breach has occurred), itself or through an independent auditor bound by confidentiality, with 30 days’ written notice. Audits must not disrupt the Service or compromise the security or confidentiality of other customers’ data, and may take the form of questionnaires or the provision of sub-processors’ certifications.

For any question about this Agreement: contact@hostelanalytics.fr.