Data processing agreement

Clause 1. Allocation of responsibilities

Corsala is software. It never holds funds, neither issues nor verifies any professional licence, and does not certify compliance with any rule.

For the rules that apply to the space’s activity, Corsala requires the relevant legal data, displays the mandatory notices, blocks the acts that a clear provision prohibits, and warns about the rest. Document templates and suggested values are editable suggestions, never imposed.

The space, that is, the professional who uses it, remains responsible for its activity, for the compliance of its documents and practices with the law of its country, and for the decisions it takes following a warning. The country rules that Corsala applies do not replace the advice of a lawyer or of another regulated professional.

Clause 2. Aggregated and anonymised reuse: market statistics

Corsala may reuse the space’s data in an aggregated and anonymised form to produce market statistics, by trade, by area and by period. These statistics do not make it possible to identify a person, a client company or a space. They are never sold.

The “Contribute to market statistics” setting is enabled by default. The space can disable it at any time in Settings, Data. Withdrawal removes the space from subsequent calculations.

No cell is published below 10 distinct spaces and no space weighs more than 50% of a cell. Checks for singling out, linkability and inference supplement these thresholds, in line with Opinion 05/2014 of the Article 29 Working Party on anonymisation techniques.

Clause 3. Training of artificial intelligence models

Corsala never trains an artificial intelligence model on personal data of the spaces’ clients (the space’s clients, prospects, employees and partners).

Corsala may train or improve models only on anonymised aggregates, under the conditions of the clause on market statistics, and, with the explicit agreement of the space, on the space’s pseudonymised business content, from which the data relating to its clients, prospects, employees and partners is removed. This second case is disabled by default: the space enables it, and withdraws it, at any time in Settings, Data.

Clause 4. Annex: data processing agreement

The data processing agreement, concluded under Article 28(3) of the GDPR, is annexed to the Terms of Use and forms part of them. It applies to the personal data that the space processes in Corsala about its clients, prospects, employees and partners.

By accepting the Terms of Use, the space also accepts this agreement, in the version annexed to the version of the Terms of Use that it accepts. Corsala records, for each space, the version accepted, the date and the person who accepted it.

Article 1. Parties and roles

This agreement is concluded between the space that accepts the Terms of Use (the “Space”, controller) and the publisher of the Corsala service (“Corsala”, processor). It is annexed to the Terms of Use and forms part of them.

For the personal data that the Space processes in Corsala about its clients, prospects, employees and partners (the “Space Data”), the Space is the controller and Corsala is its processor, within the meaning of Article 28 of the GDPR.

Corsala is the controller, on its own account, of user accounts, of the billing of artificial intelligence tokens and of the security of the platform. These processing activities fall under the privacy policy and not under this agreement.

Article 2. Subject matter

This agreement sets out the conditions under which Corsala processes the Space Data on behalf of the Space, in accordance with Article 28(3) of Regulation (EU) 2016/679 (GDPR).

Corsala provides the Space with business management software (contacts, files, quotes, worksites, documents and related modules), hosted by Corsala. The processing consists of hosting, storing, displaying, organising, transmitting and backing up the Space Data in order to provide this service.

Article 3. Duration

This agreement applies as soon as the Terms of Use are accepted and for as long as Corsala processes Space Data, that is, for as long as the space exists. It ends when the space is closed, subject to the return and deletion obligations set out below.

Article 4. Nature and purposes of the processing

Nature of the processing: collection (entry or import by the Space and its users, or receipt through the connections that the Space enables), recording, organisation, consultation, making available, transmission to the recipients chosen by the Space, backup, anonymisation on instruction, and deletion.

Purposes: to provide the Space with the features it uses (management of contacts and files, quotes and invoices, worksite follow-up, documents, communications, artificial intelligence assistants), to ensure the security, availability and support of the service, and to produce, on the Space’s instruction, aggregated and anonymous market statistics. Corsala does not process the Space Data for any other purpose.

Article 5. Categories of data and of data subjects

Categories of data subjects: the Space’s clients and prospects and their contacts; the Space’s employees, collaborators and subcontractors; its partners and suppliers; the people who take part in the Space’s files or worksites.

Categories of data: identity and contact details (name, postal address, e-mail address, telephone number); data relating to files, quotes, invoices, payments and worksites; messages and documents exchanged; working data of collaborators (schedules, time records); any other data that the Space chooses to enter.

The service is not intended to collect sensitive data (Article 9 of the GDPR) or data relating to criminal convictions (Article 10). The Space avoids entering them; if it does so, it bears responsibility for the legal basis.

Article 6. Documented instructions

Corsala processes the Space Data only on documented instructions from the Space, including as regards transfers outside the Union. The Space’s instructions are: this agreement and the Terms of Use; the settings and actions of its users in the service (entry, import, export, enabled connections, deletion); any additional written instruction sent to support.

If an instruction appears to Corsala to infringe the GDPR or another data protection rule, Corsala informs the Space immediately. If Union or Member State law requires Corsala to carry out a processing activity, Corsala informs the Space before the processing, unless the law prohibits this.

Anonymisation is an instruction of the Space, provided for by this agreement: the Space instructs Corsala to anonymise data in order to produce aggregated market statistics. The “Contribute to market statistics” setting is enabled by default; the Space can disable it at any time in Settings, Data, and withdrawal removes the Space from subsequent calculations. No cell is published below 10 distinct spaces and no space weighs more than 50% of a cell. These statistics are never sold.

Article 7. Confidentiality

Corsala ensures that the people authorised to process the Space Data are bound by a commitment or a statutory obligation of confidentiality, and that they access the data only as far as necessary for the service, support and security. Access by the Corsala team is restricted and logged.

Article 8. Security (Article 32)

Corsala implements the appropriate technical and organisational measures required by Article 32 of the GDPR, taking into account the state of the art, the costs, the nature of the data and the risks.

These measures include in particular: isolation of each space’s data in the database; encryption of integration secrets (AES-256-GCM); restriction and logging of access by the Corsala team; hosting in the European Union; daily backups of the database and of the files, whose archives are encrypted (AES-256).

Backup retention: local copies are kept for about 7 days and then deleted by rotation. An encrypted external copy is kept with a separate provider; it is not purged automatically at present, and the commitment to purge that copy is a matter for Corsala’s security policy.

Corsala reviews these measures regularly and does not lower their overall level during the agreement. The Space remains responsible for the security of its own access (passwords, rights given to its team, devices).

Article 9. Sub-processors

The Space gives Corsala a general authorisation to use sub-processors to provide the service (hosting, artificial intelligence providers, messaging, payment, e-mail).

The up-to-date list of sub-processors, with their role and country, is published on the “Sub-processors” page (/cgu/sous-traitants), which Corsala keeps up to date.

Corsala informs the Space of any addition or replacement of a sub-processor before it processes any Space Data, within a reasonable time, by updating that page and by notifying the head of the Space. The Space may object, on reasonable grounds relating to data protection, within that time. If no solution is found, the Space may stop using the service and export its data under the conditions of the Terms of Use.

Corsala imposes on each sub-processor data protection obligations equivalent to those of this agreement and remains liable to the Space for their performance.

Article 10. Assistance with data subject rights

Corsala assists the Space, by appropriate technical and organisational measures, in responding to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection), in particular through the search, export, rectification and deletion functions of the service.

If a person contacts Corsala directly about data processed on behalf of the Space, Corsala tells that person to contact the Space and forwards the request to it, without answering on the merits unless the Space instructs otherwise.

Article 11. Personal data breach notification

Corsala notifies the Space of any personal data breach affecting the Space Data, without undue delay after becoming aware of it, at the address of the head of the Space.

The notification describes, as far as Corsala knows: the nature of the breach, the categories and approximate number of data subjects and of data concerned, its likely consequences, and the measures taken or proposed. It is completed as the investigation progresses. Corsala helps the Space to meet its own obligations to notify the supervisory authority and to inform data subjects.

Article 12. Impact assessment and prior consultation

Corsala assists the Space in carrying out its data protection impact assessments (Article 35 of the GDPR) and its prior consultations of the supervisory authority (Article 36), taking into account the nature of the processing and the information available to Corsala.

Corsala drafts and keeps up to date its own impact assessment for the artificial intelligence agents and for the market statistics, and makes the relevant elements available to the Space.

Article 13. Deletion or return at the end of the contract

At the end of the agreement, at the choice of the Space, Corsala deletes the Space Data or returns it to the Space and then deletes it, and destroys existing copies, unless Union or Member State law requires them to be kept.

The Space can export its data at any time, under the conditions of the Terms of Use. Copies held in backups are not deleted one by one: local copies disappear by rotation after about 7 days; the encrypted external copy is not purged automatically at present, and the commitment to purge that copy is a matter for Corsala’s security policy. These copies remain encrypted for as long as they exist.

Article 14. Audits

Corsala makes available to the Space the information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR.

Corsala allows for and contributes to audits, including inspections, carried out by the Space or by an auditor it appoints. The audit is announced in writing with reasonable notice, is limited to the Space’s processing, disrupts neither the service nor other spaces, gives no access to the data of any other space, and remains subject to confidentiality.

Article 15. Transfers outside the Union

Corsala hosts the Space Data in the European Union.

Where a sub-processor located outside the European Union processes Space Data (for example an artificial intelligence provider), the transfer relies on an adequacy decision of the European Commission or, failing that, on the standard data protection clauses adopted by the Commission, supplemented where necessary by additional measures. These providers are listed on the sub-processors page.

Article 16. Spaces established in the United Arab Emirates

For a Space established in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the protection of personal data (PDPL) applies to the processing that falls within its scope. The parties apply this agreement taking that text into account, as it may impose additional obligations, in particular on transfers.

Transfers of personal data outside the United Arab Emirates are regulated by the PDPL. This agreement mentions them: the Space Data is hosted in the European Union and may be processed by the sub-processors listed, including outside the Union, under the conditions of the article on transfers.

Spaces established in the DIFC (Dubai International Financial Centre) or in the ADGM (Abu Dhabi Global Market) are subject to a data protection regime of their own. That regime is flagged here; it may require additional clauses, which the parties then agree in writing.

Article 17. Model training

Corsala never trains an artificial intelligence model on personal data of the Spaces’ clients (the Space’s clients, prospects, employees and partners).

Corsala may train or improve models only on anonymised aggregates, under the conditions of the article on documented instructions, and, with the explicit agreement of the Space, on the Space’s pseudonymised business content, from which the data relating to its clients, prospects, employees and partners is removed. This second case is disabled by default: the Space enables it, and withdraws it, at any time in Settings, Data.

Article 18. Version, acceptance and amendment

This agreement is annexed to the Terms of Use. By accepting the Terms of Use, the Space accepts the version of the agreement annexed to the version of the Terms of Use that it accepts. Corsala records, for each Space, the version accepted, the date and the person who accepted it; the Space can consult them in Settings, Data.

In the event of a conflict between this agreement and the Terms of Use on the processing of personal data, this agreement prevails.

Corsala may amend this agreement, in particular to follow the law or changes to the list of sub-processors. Each version carries an identifier (dpa-YYYY-MM-DD); a new version is annexed to a new version of the Terms of Use, brought to the users’ attention before it takes effect, and accepted under the same rule.