Cart
Contact

Privacy ●

WordPress maintenance

1 – Scope

These specific terms and conditions (hereinafter “ST”) are intended to set out the conditions for the processing of Personal Data that the Service Provider may be required to carry out in connection with the Contract and its relationship with the Client.

These terms are established in accordance with the provisions of Law No. 78-17 of January 6, 1978 (known as the “Data Protection Act” or “DPA”) and the General Data Protection Regulation (“GDPR”) No. 2016/679.

Each Party undertakes to comply with the obligations incumbent upon it under these regulations and these Specific Terms and Conditions.

2 – Definitions

–Personal Data or Data : means any information relating to an identified or identifiable Person. A Person is deemed identifiable if they can be identified directly or indirectly, in particular by reference to an identifier or to one or more specific factors unique to their identity.

–Regulations : means the regulations applicable to the Service Provider and the Client on the date of the Processing in question, in particular Law No. 78-17 of January 6, 1978 (known as the “Data Protection Act” or “DPA”) and the General Data Protection Regulation (“GDPR”) 2016/679 of the European Parliament and of the Council of April 27, 2016.

–Processing: means any operation or set of operations performed on Personal Data, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, as well as restriction, erasure or destruction, whether or not the operation is carried out by automated means.

–Controller : means the Party which, alone or jointly, determines the purposes and means of Processing.

–Processor : means any natural or legal person required to process Personal Data on behalf of the Controller.

-Data subject(s) : means any natural person whose Personal Data may be subject to Processing.

3. -Personal data processed by the Service Provider as Controller

The Service Provider may be required to process the Client’s Personal Data as a Controller.

3.1 Characteristics of the Processing carried out by the Service Provider

This processing may concern the Personal Data of the Client itself, when the Client is a natural person, as well as that of its employees or non-employee staff members (managers, sales, finance, purchasing, legal, etc.) who are in contact with the Service Provider.

The purposes of the processing are: 

  • management of the contractual relationship with the Client (negotiation, signing of the contract, exchanges, invoicing, etc.)
  • management of the website and in particular of orders placed online
  • management of the performance of the Services (collaboration on the project, ticket management, etc.)
  • management of electronic communication
  • customer retention and commercial prospecting

The types of Data concerned may be:

  • Identification Data (last name, first name, email address, telephone),
  • Data on professional role, SIRET
  • Economic and financial Data
  • Connection Data (IP address, logs)
  • Data relating to projects and the content of exchanges (nature of the need, exchanges, etc.)

Processing may consist of:

  • consultation,
  • extraction,
  • recording,
  • modification (updating),
  • hosting,
  • structuring,
  • organization,
  • matching / interconnection,
  • retention / archiving,
  • transmission / dissemination,
  • erasure / destruction

The legal bases for Processing are the performance of the Contract concluded with the Client or legitimate interest.

Customer retention and commercial prospecting for a former Client whose contract ended 3 years ago require consent.

The Service Provider retains the Data collected for the duration of the business relationship and then for 10 years. Connection Data is retained for a maximum of a few months. Emails exchanged with the Client are retained for 5 years.

3.2 Conditions relating to Processing

The data collected is transmitted directly by the Client or its employees.

The Data collected is mandatory in order to achieve the purposes of the processing.

The Data Controller uses subprocessors to carry out certain processing operations, in particular in connection with the management of the contractual relationship as well as the management of the Services. The Service Provider uses various collaborative tools in particular to facilitate exchanges with the Client.

The Client is informed and hereby gives its explicit consent to the fact that certain subprocessors of the Service Provider may be required to transfer Personal Data outside the European Union, in particular to the United States.

In such cases, the Service Provider undertakes to ensure that the transfers carried out by its subprocessors are made in accordance with the Regulations. Where Data transfers are carried out pursuant to Article 46, the Service Provider ensures that such transfers are subject to appropriate safeguards and are documented in accordance with the provisions of Article 30(2) of the GDPR. In this respect, the Client grants full authority to and authorizes the Service Provider to sign with the relevant subprocessors SCCs (Standard Contractual Clauses of the Commission

European) relating to the Data and, more broadly, mandates the Service Provider to take all measures likely to protect the Data.

The Service Provider implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. It takes measures to ensure that any natural person acting under its authority or under that of a Subprocessor, who has access to Personal Data, does not process them except on the instructions of the Service Provider, unless required to do so.

The Data Subject concerned by Processing may define instructions relating to the retention, erasure and communication of their Personal Data after their death. These instructions may be general or specific.

The Data Subject concerned by Processing also has a right of access, objection, rectification, erasure and, under certain conditions, portability of their Personal Data. The Data Subject has the right to withdraw their consent at any time if consent is the legal basis for the processing.

The request must state the surname and first name, email or postal address of the data subject, and be signed and, in case of doubt, accompanied by valid proof of identity.

They may exercise these rights by contacting: Julien Guiard – julien@maintenance-wp.fr

Where the Processing concerns the Client’s employees, it is the Client’s responsibility to inform them directly of their rights.

4 – Personal data processed by the Service Provider as a Processor

Within the framework of the Contract, the Service Provider may be required to carry out Processing of Personal Data as a Processor, on

behalf of the Client, who alone defines the purposes and means of the Processing.

4.1 Characteristics of the Processing

The Client’s instructions according to which the Service Provider must carry out the Data Processing are those set out in these Special Terms and Conditions.

However, they may be supplemented, amended or updated by the Client at any time in writing.

The processing operations may have the following purposes :

  • website redesign, website audit
  • maintenance of the Client’s website (Onboarding, preventive, corrective, evolutionary, support service, ad hoc support, reversibility)

The Processing instructions may be as follows :

  • log in to the website administration interface
  • log in to the server to copy the website and data to the development server
  • log in to the client’s third-party tools
  • carry out an audit of the existing setup
  • perform migrations on servers (development and production)
  • perform backups
  • store usernames and passwords for access to the site, server, and the client’s third-party tools
  • carry out tests
  • make the necessary fixes
  • carry out the necessary preventive maintenance operations (backups, cleanup, updates, security monitoring, tests)
  • assist the client in using the site
  • provide support services
  • install/uninstall and configure third-party software and technologies (cookies, plugins), which may sometimes result in data transfers to third-party recipients, including outside the EU
  • set up connectors or APIs between the client’s site/software and other software used by the client, which may sometimes result in data transfers to third-party recipients, including outside the EU
  • install and configure the client’s site
  • set up server access
  • set up databases
  • configure an email address
  • subscribe to an SSL certificate in the name and on behalf of the client and install it
  • delete Data (e.g.: spam)
  • transfer Data to third-party recipients, including outside the EU
  • grant access to Data to third-party recipients, including outside the EU
  • Carry out development work (enhancements) on the site
  • ensure data reversibility (in particular data exports)

Processing may consist of:

  • consultation, extraction, recording, modification (updating), hosting, structuring, organization, matching / interconnection, retention / archiving, transmission, / dissemination, erasure / destruction.

The Data Subjects may be :

  • internet users, the Client’s customers, the Client’s employees, its subscribers, or the Client’s prospects.

The types of Data processed may be :

Data stored on the Client’s software. This may also include Data stored on the Client’s server as well as on any other software used by the Client. This Data may be as follows:

  • Civil status, identity, identification data, images (surname, first name, address, photograph, date and place of birth, etc.)
  • Connection data (IP addresses, logs, device identifiers, login identifiers, timestamp information, etc.)
  • Location data (movements, GPS, GSM data, etc.)
  • Economic and financial information (income, financial situation, banking data, etc.)
  • Professional life (CV, professional status, education, training, distinctions, diplomas, etc.)
  • Personal life (lifestyle habits, family situation, etc.)
  • Potentially Sensitive Data

The Data retention periods are as follows :

  • Backup Data is retained for a maximum of 90 days
  • Other Data is retained for the duration of the contractual relationship and then for 5 years

The Client is informed that the contact person for personal Data protection is Julien Guiard – julien@maintenance-wp.fr

4.2 Client’s Obligations

The Client, in its capacity as Data Controller, undertakes to comply with all the obligations incumbent upon it pursuant to the Personal Data protection Regulations, such as, in particular, the obligations to inform the Data Subjects, any authorization requests, the existence of legal bases for the Processing, etc.

When the Client instructs the Service Provider to install, uninstall, configure software, technologies, APIs, or communicate Data that may result in transfers of Data to third-party recipients, including outside the EU, the Client undertakes to verify in advance that the intended transfers comply with the Regulations. The Client also ensures that these transfers are subject to appropriate safeguards as well as supplementary measures to guarantee a level of protection essentially equivalent to that provided in the European Economic Area.

The Controller shall indemnify the Processor against any judgment, as well as any financial consequences to which the latter may be exposed as a result of non-compliance with the obligations incumbent upon it.

4.3 Obligations of the Service Provider

The Service Provider, in its capacity as Processor, undertakes to strictly comply with all obligations incumbent upon it under the Regulations on the protection of Personal Data. The Service Provider’s obligations are specified below.

Compliance with processing instructions

The Service Provider undertakes to comply strictly with the Client’s written instructions regarding the use that may be made of Personal Data. In particular, the Service Provider shall refrain from carrying out any Processing of Personal Data that has not been expressly requested by the Client in a written instruction.

Use of onward subcontracting

The Client is informed and accepts, under a general authorization, that the Processor may use onward subcontractors within the framework of this Contract.

Where the Processor engages another processor to carry out specific Processing activities on behalf of the Controller, equivalent Data protection obligations to those set out in this Agreement shall be imposed on that other processor by contract. Where that other processor fails to fulfill its Data protection obligations, the Processor shall remain liable to the Controller for the performance of that other processor’s obligations.

The list of sub-processors is made available to the Client upon written request. The Processor undertakes to inform the Controller of the addition or change of a processor by email as soon as possible, if this change has a negative impact on any Processing of its Data.

The Controller shall make any comments or objections in writing within fifteen days of receiving this information. Failing a response within this period, the Controller acknowledges that it has thereby accepted the said new processor and the change to the Processing of its Data. The Processor shall provide the Controller with any information enabling the compliance of the sub-processor with the requirements of the Regulations to be established.

Processor’s obligation to help and assist

The Processor shall take into account the nature of the Processing and assist the Controller, by appropriate technical and organizational measures, in fulfilling its obligation to respond to requests made to it by Data Subjects in order to exercise their rights provided for in Chapter III of the GDPR.

The Processor shall assist the Controller in ensuring compliance with the obligations provided for in Articles 32 to 36, taking into account the nature of the Processing and the information available to it.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this article.

Audit 

The Client may, at its own expense, carry out or have carried out, by any service provider of its choice subject to professional secrecy, during the performance of this agreement, audits relating to the Service Provider’s compliance with its obligations concerning the processing of Personal Data under this Agreement.

The Client undertakes to notify the Service Provider in writing of any audit assignment with at least ten (10) calendar days’ notice, providing the purpose of the assignment, the planned duration of the assignment, it being specified that this may not exceed 4 days, and the names of the appointed experts.

The Parties shall mutually agree on the scheduling of the audit, with the auditor undertaking to cause minimal disruption to the performance of the Services.

A copy of the audit report prepared by the auditor shall be provided to each party and shall be jointly reviewed by the Parties, who undertake to meet for this purpose.

If this audit confirms a breach by the Service Provider of its obligations, the Service Provider shall bear the audit costs and implement, at its own expense, the necessary corrective measures within thirty (30) working days from the delivery of the audit report. Except as provided above, the Client shall bear all costs it incurs in connection with the audits. Failing correction within the said period, the Client may terminate this agreement and the Initial Contract for cause under the conditions set out in the Initial Contract.

Confidentiality obligation

The Processor is bound by a confidentiality obligation and undertakes not to disclose, whether free of charge or for consideration, the Personal Data to any third party whatsoever, except for the purposes of the Contract and on the instructions of the Controller.

The Processor ensures that the persons authorized to process the Personal Data undertake to respect the confidentiality of the Personal Data or are subject to an appropriate statutory obligation of confidentiality.

Notification in the event of a Personal Data breach

The Processor undertakes to notify the Controller as soon as possible and, as soon as it becomes aware of it, of any breach or security flaw affecting the Personal Data and to provide the Controller with the information necessary to enable it to inform the supervisory authority and, if necessary, the Data Subjects.

Authorization of transfers of Personal Data outside the European Union

The Client hereby gives the Service Provider express instruction to carry out or have carried out, through a sub-processor, transfers of Personal Data outside the European Union, including to the United States.

The Service Provider undertakes to ensure that the transfers are carried out in accordance with the Regulations.

Where Data transfers are carried out pursuant to Article 46, the Service Provider ensures that such transfers are subject to appropriate safeguards and are documented in accordance with the provisions of Article 30(2) of the GDPR. In this regard, and where necessary, the Client authorizes the Service Provider to sign, in its name and on its behalf, with sub-processors, SCCs (European Commission Standard Contractual Clauses) relating to the Data.

Security measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in order to prevent any loss, damage, alteration, or unauthorized access to the Data.

The Processor shall take measures to ensure that any natural person acting under its authority who has access to Personal Data does not process it except on instructions from the Client, unless required to do so by Union law or the law of a Member State.

Register of processing activities

The Processor shall keep the register of Processing activities available to the Client and/or the supervisory authority and shall provide it upon simple request.

Last updated on 03/31/2024