Privacy Policy and Protection of Data

• “OliveSoft“, “we“, “our“, “us“ refer to the company OliveSoft, registered under the Siren number 843 934 860, a Joint Stock Company (JSC). Its headquarters are located at 42, rue de Maubeuge, 75009 Paris.
• Data Controller: refers to the entity that determines the purposes and means of the Processing of personal data;
• Processor: refers to the entity that processes personal data on behalf of the Data Controller and according to its instructions;
• Data Protection Regulation: refers to all European and national regulations related to privacy and personal data, including Regulation EU No. 2016/679 of April 27, 2016 (GDPR) and the French Law No. 78-17 of January 6, 1978 as amended and any other law provided for in the service contract signed by the Client;
• Data Protection Authority: refers to the supervisory authority concerned with the processing of personal data. If a processing activity affects individuals located in several member states of the European Union, the supervisory authority of the main establishment of the Data Controller will be considered as the lead authority, in accordance with the GDPR;
• Personal Data: refers to any information relating to an identifiable or identified natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
• Processing (or Process): refers to any operation or set of operations performed on Personal Data, such as collection, recording, organization, storage, adaptation, extraction, consultation, use, communication, dissemination, making available, matching, erasure, or destruction;
• OliveSoft Client(s): refers to the clients of the company OliveSoft who have entered into a service contract with said company.
• Service Contract: refers to the legal agreement concluded between OliveSoft as the service provider and its client, where OliveSoft undertakes to provide specific services in exchange for remuneration. This contract also formalizes the terms under which OliveSoft, as a service provider, may access the client’s personal data in order to execute the agreed services.

Article 2. Security Measures

OliveSoft may act either as a Data Controller or as a Processor, depending on the circumstances. As a Data Controller, OliveSoft determines the purposes and means of processing personal data and is responsible for the compliance of these processes with legal and regulatory obligations. As a Processor, OliveSoft processes personal data on behalf of a client under a service contract, respecting the instructions of the Data Controller and contractual and legal obligations regarding data protection, including security and confidentiality.

OliveSoft implements and maintains appropriate technical and organizational security measures to protect the confidentiality of the Personal Data it processes or accesses, in accordance with the prescriptions of the Data Protection Regulation.

These measures take into account the potential risks to the individuals concerned due to the processing activities. They comply with industry standards and best practices in security, and take into account the recommendations of Data Protection Authorities.

OliveSoft strives to:

• Ensure that it has physical security measures against acts of malice or cyberattacks.
• Access to client systems by OliveSoft personnel is protected by strong authorization and authentication measures. Security updates for operating systems are installed regularly. Technical measures are in place against malware.
• Implement and maintain security and confidentiality measures that take into account the principles of Personal Data protection and are adapted to the risks posed by their processing on the rights and freedoms of the individuals concerned, in accordance with the requirements of the applicable Regulation. These measures aim to protect Personal Data against destruction, loss, alteration, unauthorized disclosure to third parties, and to ensure the recovery of the availability and access to Personal Data in a timely manner in the event of an incident.

In case of failure, OliveSoft will do its best to restore the service as soon as possible, within the limits of its commitments.

Article 3. Identification of Processing Activities

For the purpose of providing Services and more generally to perform any other tasks assigned by the Client under the Service Agreement, OliveSoft may process the Personal Data that the Client integrates into its IT systems.

• Data Subject: Any individual whose personal data is collected or processed by the Client OliveSoft
• Purpose of Processing: The purposes are determined by the Client OliveSoft
• Legal Basis: Execution of the Contract between the Client and the Data Subject
• Categories of Data Processed: All categories, depending on the processing activities carried out by the Client as the Data Controller
• Retention Period: Duration of the Contract with the Client or any other retention period requested by the Client

Article 4. OliveSoft’s Commitments

As a Subcontractor, OliveSoft undertakes to respect the following obligations and to ensure that its staff respects these same obligations, in accordance with article 28 of the GDPR:

• Process the Personal Data collected by the Client for the strict purposes of providing the Services defined in the Contract.
• Ensure the confidentiality of Personal Data and ensure that its personnel authorized to process them are subject to an obligation of confidentiality;
• Take into account, regarding its tools, products, applications or services, the principles of protection of Personal Data from design (privacy by design) and by default (privacy by default);
• Not use Personal Data for purposes other than those provided for in the Contract and not keep them beyond the term of the Contract or any other period specified by the Client;
• Return the Personal Data under the conditions set out below;
• Not license, rent, transfer Personal Data, in whole or in part, to a third party, without the prior written consent of the Customer;
• Reasonably assist the Client in carrying out privacy impact analyzes if necessary;
• Respond as quickly as possible to any request from the Client relating to the Personal Data processed in order to enable it to take into account, within the allotted time, any requests from the Data Subjects (right of access, rectification, erasure, opposition, etc.);
• Warn and assist the Customer in ensuring compliance with obligations relating to the security of Personal Data, in particular within the framework of security violation notification procedures, under the conditions provided for below;
• Implement technical and organizational measures allowing the Client to fully respect the rights of the Data Subjects, in particular the right of access, rectification or erasure of Personal Data, or the limitation of the processing thereof, the right to object to decisions based on profiling, as well as the right to data portability, where applicable;
• Define and formalize a policy governing the restitution of personal data as well as their destruction, and make it available to the Client upon request.

Customer is advised that if OliveSoft is required to disclose Personal Data to a law enforcement agency, OliveSoft will use its best efforts to provide Customer with reasonable notice and opportunity to seek any protective order or other remedy. appropriate, unless OliveSoft is prohibited from doing so by law or by the relevant Data Protection Authority.

Article 5. Location of Personal Data

The Personal Data is not stored within OliveSoft infrastructure but is stored in the client’s data centers and IT systems in accordance with applicable legal provisions.

OliveSoft nevertheless has access to this data in the context of performing the service contract. This access is necessary to allow OliveSoft to provide the agreed services and meet the needs of its clients. Thus, OliveSoft access to clients’ personal data falls within the legal framework of the service contract and is limited to the needs of performing the agreed services.

Article 6. Personal Data Breach

If OliveSoft becomes aware of a Personal Data breach, it will inform the Client as soon as possible after becoming aware of it and will provide all necessary information so that the Client can assess the breach.

In accordance with Article 33 of the GDPR, unless the breach is unlikely to result in a risk to the rights and freedoms of Data Subjects, the Client, as the Data Controller, will be responsible for notifying the Supervisory Authority and, if the breach is likely to result in a high risk to their rights and freedoms, the affected individuals, in each concerned Member State. This notification must be made without undue delay and no later than 72 hours after the Client has become aware of a Personal Data breach.

This notification from the Client to the Supervisory Authority must:

• Describe the nature of the Personal Data breach and include, if possible, the categories and approximate number of affected Data Subjects and the categories and approximate number of Personal Data records concerned;
• Provide the name and contact details of the data protection officer or other contacts from whom further information can be obtained;
• Describe the likely consequences of the Personal Data breach;
• Describe the measures taken or proposed to address the Personal Data breach, including measures to mitigate its possible adverse effects.

Article 7. Record of Processing Activities

OliveSoft maintains a record of processing activities carried out on behalf of the Client, identifying for itself and each of its subsequent processors the processing activities performed on behalf of the Client, the location from which the service is provided, and any transfers of Personal Data outside the European Economic Area (EEA). The record will also document, where applicable, the implementation of appropriate safeguards to ensure an adequate level of protection, and any other information required by the Data Protection Regulation. The record will be accessible at any time to the Client and the Data Protection Authority.

Article 8. Security and Confidentiality of Processing

The general security requirements are set out in ARTICLE 2 above. Regarding the security of Personal Data processed for the purpose of providing the Services, OliveSoft implements additional measures resulting from the Data Protection Regulation. In particular, OliveSoft commits to implementing the following measures:

• Ensure adequate protection of Personal Data to guarantee their confidentiality and prevent Personal Data breaches and/or minimize impacts in case of a breach;
• Ensure that any person acting under OliveSoft’s authority who may have access to Personal Data bases for the purpose of their activity performs no other processing of such data, except in cases expressly authorized by the Client;
• Delete Personal Data at the end of the retention or access period defined by the Client;

Article 9. Subsequent Processors

The Client expressly authorizes OliveSoft to subcontract the execution of tasks involving processing, in whole or in part, of Personal Data in the context of the Services to its subsidiary.

OliveSoft commits to informing the Client of any planned changes regarding the designation or replacement of a subsequent processor and to give the Client the opportunity to object to this change in writing within 8 calendar days.

The Client may only object to the new subsequent processor for the following reasons: (i) the new processor is a direct competitor of the Client; (ii) the new processor is involved in an ongoing dispute with the Client; (iii) the Client believes that the new processor does not comply with the Data Protection Regulation; (iv) the replacement of the processor would reduce existing security measures.

In any case, OliveSoft guarantees that any subsequent processor it appoints provides sufficient guarantees to implement appropriate technical and organizational measures to meet the requirements of the Data Protection Regulation. Processing by a subsequent processor is governed by a contract between OliveSoft and the subsequent processor that sets out the same rights and obligations as those defined herein, including the obligation to ensure the security of processing, the protection of Personal Data, and the right to audit.

OliveSoft will regularly verify, including through audits, the compliance of its subsequent processors with the aforementioned obligations. Additionally, for transfers of Personal Data outside the European Economic Area (EEA), OliveSoft will ensure that these contracts include the standard contractual clauses approved by the European Commission to ensure an adequate level of protection for the transferred Personal Data.

OliveSoft maintains an up-to-date list of subsequent processors specifying (i) their name and contact details, as well as (ii) the nature of the tasks assigned, (iii) the location of processing, and (iv) the dates of the last audits. In any case, OliveSoft remains fully responsible to the Client for the performance of its subsequent processors’ obligations.

Article 10. Documentation

OliveSoft will provide the Customer, subject to confidentiality obligations, with all the information necessary to demonstrate its compliance with the obligations of the Data Protection Regulations.

Article 11. Termination of Contract

At the end of the Service Contract, OliveSoft undertakes to return or delete the Personal Data

Article 12. Client Commitments

As the Data Controller, the Client must ensure that Users and Data Subjects have been informed about the processing of their Personal Data and have given their consent where required. The Client guarantees OliveSoft compliance with Data Protection Regulations (including providing complete, intelligible, and easily accessible information to Data Subjects; establishing a proper legal basis for processing; and adhering to all required procedures and formalities, such as conducting a data protection impact assessment if applicable, etc.). If the Client acts as a Data Processor on behalf of a third-party Data Controller, the Client guarantees OliveSoft that:

• all necessary authorizations have been obtained to enter into the Service Agreement;
• the contract concluded with the Data Controller complies with the applicable regulations;
• the instructions given to OliveSoft comply with the Data Controller’s instructions;

Article 13. Client Guarantees

The Client guarantees that it has obtained and will maintain all necessary consents and/or declarations/authorizations required to lawfully process the Personal Data of Users and Data Subjects. The Client will indemnify and hold OliveSoft harmless from any claim or action by a User or Data Subject regarding the protection of their Personal Data.

Article 14. Liability

It is reiterated that OliveSoft is subject to a duty of care in providing Services to the Client. OliveSoft’s liability to the Client can only be engaged in the event of direct damage suffered by the Client due to a proven contractual breach by OliveSoft committed during or in connection with the performance of its obligations.

Notwithstanding the foregoing, the Client expressly acknowledges and agrees that OliveSoft liability cannot be engaged regarding the processing of Personal Data conducted by the Client. The Client, as the Data Controller, is solely responsible to third parties for compliance with Data Protection Regulations and guarantees OliveSoft against any action, claim, or recourse from third parties (Data Subjects, Supervisory Authorities, or other third parties) in this regard. In accordance with Article 82 of the GDPR, it is reiterated that OliveSoft’s liability, as a Data Processor for the Client, is strictly limited to the contractual obligations assumed within the framework of the service agreement.

If both Parties are jointly declared responsible for damage caused to a Data Subject due to the processing of their Data, OliveSoft will only be liable for damages proportional to its contractual responsibility towards the Client.