Data processing agreement (DPA)

1. Purpose

This agreement governs, in accordance with article 28 GDPR, the personal data processing Erganos ("the Processor") carries out on behalf of the Customer ("the Controller") as part of the Service. It forms an integral part of the terms of service.

2. Nature of processing and data concerned

Processing: hosting, structuring, text generation, sending of messages (e-mails, SMS, posts) on the Customer's behalf.

Data concerned: contact details and exchanges of the Customer's own customers and prospects (name, e-mail, phone, message content, invoices). Data subjects: the Customer's customers, prospects and correspondents.

3. Customer instructions

Erganos processes this data only on the Customer's documented instructions, materialised by the configuration of the Service (hiring an AI employee, autonomy levels, approvals). Erganos informs the Customer if an instruction appears to infringe the regulations.

4. Confidentiality and security

Persons authorised to process the data are bound by confidentiality. Erganos implements the measures described in the privacy policy: encryption in transit and at rest for secrets, per-organisation isolation, audit logs, least privilege.

5. Sub-processors

The Customer authorises the sub-processors listed in the privacy policy (OVHcloud, Stripe, Resend, Twilio, Anthropic). Erganos informs the Customer of any change to this list and allows objection on legitimate grounds.

6. Assistance and breach notification

Erganos assists the Customer in responding to data subjects' requests and notifies the Customer of any personal data breach without undue delay after becoming aware of it, with the information needed for the Customer's own notification to the supervisory authority.

7. Fate of the data

At the end of the contract, Erganos deletes the data processed on the Customer's behalf, subject to statutory retention obligations. The Customer may request prior return of the data in a structured format.

8. Audits

Erganos keeps at the Customer's disposal the documentation needed to demonstrate compliance with this agreement and allows audits under reasonable conditions (frequency, notice, confidentiality).