Data Processing Agreement
Reference translation. The French version is binding.
Article 1 — Purpose and capacity of the parties
This agreement defines the conditions under which the Provider processes, on behalf of the Customer, the personal data necessary for the performance of the HostMind AI service.
The Customer acts as controller. The Provider acts as processor within the meaning of article 28 of Regulation (EU) 2016/679.
Article 2 — Description of the processing
Nature of the processing: collection, recording, storage, consultation and deletion of the messages exchanged between the Customer's guests and the conversational assistant.
Purpose: provision of a conversational assistance service to the establishment's guests.
Duration: the processing is carried out for the entire term of the subscription, extended by the retention periods provided for in article 9.
Categories of data subjects: the guests and visitors of the Customer's establishment who use the assistant.
Categories of data: content of messages, technical conversation identifier, timestamp, connection IP address.
The service is not designed to process data falling within article 9 of the Regulation. The Provider requests none. The Customer informs its guests not to communicate any such data through the assistant.
Article 3 — Documented instructions
The Provider processes the data only on the Customer's documented instructions. These terms, together with the settings chosen by the Customer in its administration area, in particular the retention period for conversations, constitute those instructions.
The Provider informs the Customer if it considers that an instruction constitutes a breach of the Regulation.
Article 4 — Confidentiality
The Provider ensures that persons authorised to process the data undertake to respect its confidentiality, or are subject to an appropriate statutory obligation of confidentiality.
Article 5 — Security
The Provider implements appropriate technical and organisational measures, in particular:
- hosting within the European Union - encryption of communications in transit - partitioning of each establishment's data at database level - restriction of access to production data to those persons who need it - rate limiting and request size control to prevent abusive use - automatic deletion of conversations on expiry of the retention period
Article 6 — Sub-processing
The Customer authorises the Provider to use the following sub-processors:
- Lovable Labs AB (Sweden) — application and database hosting, infrastructure located in Ireland - Google, through Lovable's artificial intelligence gateway — generation of answers - Email providers: Supabase (SUPABASE PTE. LTD., Singapore) — sending of authentication emails to customer establishments (sign-up confirmation, password reset). Lovable Labs AB (Sweden) — sending of internal summary emails, already cited above in respect of hosting
The Provider informs the Customer of any intended change concerning the addition or replacement of a sub-processor, at least thirty (30) days before it is implemented. The Customer has that period in which to raise objections; failing agreement, it may terminate its subscription without penalty.
The Provider remains fully liable for the performance by its sub-processors of their obligations.
Article 7 — Transfers outside the European Union
Data is hosted within the European Union.
Messages transmitted to the artificial intelligence model provider may be processed outside the European Union. Such transfers are governed by the standard contractual clauses adopted by the European Commission.
Article 8 — Assistance to the Customer
The Provider assists the Customer, so far as possible and taking into account the nature of the processing:
- in responding to requests from data subjects exercising their rights; the administration area allows the Customer to consult and delete the relevant conversations directly - in carrying out data protection impact assessments, where required - in implementing security measures and notifying breaches
The Provider notifies the Customer of any personal data breach without undue delay after becoming aware of it, and at the latest within forty-eight (48) hours, providing the information necessary for the Customer to fulfil its own obligations.
Article 9 — Fate of the data at the end of the contract
At the end of the subscription, the Provider deletes all data processed on behalf of the Customer within thirty (30) days, save where an export has been requested before the effective date of termination and save where there is a legal obligation to retain.
Article 10 — Audit
The Provider makes available to the Customer all information necessary to demonstrate compliance with its obligations and allows audits to be carried out, limited to one audit per calendar year, subject to reasonable notice and under conditions preserving the confidentiality of its other customers.
Article 11 — Record
The Provider maintains a record of the categories of processing activities carried out on behalf of the Customer.
Article 12 — Acceptance
This agreement is accepted by the Customer on subscription, together with the general terms of which it forms an inseparable annex.