Data Processing Agreement (DPA)

1. Purpose and duration

This agreement governs the processing of personal data by KOLOSALTech ("the Processor") on behalf of the client ("the Controller") within the scope of services contracted separately. The duration of this DPA is aligned with that of the main contract.

2. Nature and purpose of processing

The Processor processes data for the following purposes:

• IT infrastructure integration and maintenance
• Hardware sourcing and export logistics
• Cybersecurity (audit, EDR, monitoring)
• Technical support and managed services
• Client data hosting and backup

3. Categories of data and data subjects

• Data subjects: the client's employees, end users of the hosted systems.
• Categories of data: identity (first name, last name, work email), technical data (IP address, access logs), business data hosted in the client's systems.
• Excluded sensitive data: no health, religious, political, biometric or sexual-orientation data is processed without a separate express agreement.

4. Obligations of the Processor (KOLOSALTech)

• Process data only on the Controller's documented instructions.
• Ensure confidentiality through commitments from all staff accessing the data.
• Implement technical and organizational measures (see art. 32 GDPR and our /en/securite page).
• Notify the Controller of any data breach within 72 hours of becoming aware of it, with technical details and a remediation plan.
• Assist the Controller in responding to access, rectification, erasure and portability requests.
• Maintain a record of processing activities (art. 30 GDPR), available on request.
• Return or delete all data at the end of the contract, at the Controller's choice, within 30 days, with written attestation.

5. Sub-processors

The Processor uses the following sub-processors:

• Vercel Inc. (USA + EU datacenters) — web hosting
• OVHcloud SAS (France) — sovereign infrastructure hosting
• Wasabi Technologies (Paris datacenter) — immutable object storage
• Resend (USA) — transactional emails
• Airtable (USA) — lightweight CRM lead management
• Cloudflare (USA + EU) — CDN + network security
• Stripe (USA + Ireland) — payments (where applicable)
• Sentry (USA) — error monitoring (if enabled)

Any addition of a new sub-processor is subject to a 30-day prior notification.

6. Security measures (art. 32 GDPR)

• TLS 1.3 encryption in transit, AES-256 at rest
• Mandatory MFA on all admin accounts
• Tiered access model (T0/T1/T2)
• 3-2-1-1-0 backup with S3 Object Lock immutability
• EDR Bitdefender GravityZone on team endpoints
• Centralized logs retained for 1 year
• Annual BCP/DRP test + quarterly access review
• Full details: kolosaltech.com/securite

7. Transfers outside the EU

Some sub-processors (Vercel, Resend, Airtable, Stripe, Sentry, Cloudflare) are established outside the EU. Transfers are governed by:

• Standard Contractual Clauses (SCC) approved by the EU Commission
• For the United Kingdom: EU Commission adequacy decision (June 2021)
• Transfer Impact Assessment (TIA) for US transfers (Data Privacy Framework where applicable)

8. Audit right

The Controller may audit the Processor's compliance once a year with 30 days' notice. Reasonable audit costs are borne by the Controller, except in the event of proven non-compliance.

9. Data breach notification

Documented procedure in the event of a breach:

• Detection via Sentry + EDR + audit logs
• Containment + forensic analysis within 24 hours
• Controller notification within 72 hours with details
• Controller assistance for CNIL notification if required
• Shared post-mortem within 30 days

10. Governing law and jurisdiction

This DPA is governed by French law. Disputes fall under the jurisdiction of the Tribunal Judiciaire de Rennes (jurisdiction agreed by the parties).

Signatures

© 2026 KOLOSALTech — RCS Rennes 106 103 047 · 3 Rue de Robien, 35000 Rennes, France · contact@kolosaltech.com · kolosaltech.com. This template is provided for guidance only. It must be appended to your main contract and adapted to your context.