Data processing agreement (DPA)

This data processing agreement (the "DPA") governs the processing, by Iwana acting as a processor, of personal data on behalf of the professional user, acting as the controller, in accordance with Article 28 of the GDPR. It supplements the Terms of sale (/cgv) and the Privacy policy (/privacy).

Roles of the parties

The professional user is the controller of their own clients' data entered into the service. Iwana acts as a processor and processes this data only on the controller's documented instructions, in particular to provide the service.

Purpose, duration and nature of the processing

The purpose of the processing is the provision of the Iwana service (calendar, clients, interventions, quotes, invoices, communications) and it lasts for the duration of the contractual relationship.

• Categories of persons: end clients, contacts and, where applicable, members of the organisation.
• Categories of data: identity and contact details, appointment and intervention data, billing data, exchanges and attachments.

Obligations of the processor

• Process the data only on the controller's documented instructions.
• Ensure the confidentiality of the persons authorised to process the data.
• Implement appropriate security measures (Article 32 of the GDPR).
• Assist the controller in responding to requests to exercise data subjects' rights.
• Assist the controller with security, breach notifications and impact assessments (Articles 32 to 36).
• Make available the information necessary to demonstrate compliance with Article 28 and allow audits.

Sub-processors

The controller authorises the use of sub-processors to perform the service, in particular the host [À COMPLÉTER: name], Sentry (monitoring), Google Maps (mapping) and Brevo (emails and SMS). Iwana informs the controller of any change and imposes equivalent obligations on these sub-processors.

Transfers outside the European Union

Any transfer of data outside the European Union is governed by appropriate safeguards, in particular the European Commission's standard contractual clauses.

Data breach

Iwana notifies the controller of any personal data breach as soon as possible after becoming aware of it, and provides the information useful for managing the incident.

Fate of the data at the end of the contract

At the end of the relationship, Iwana deletes or returns the data at the controller's choice, subject to legal retention obligations (in particular accounting ones). The controller can export their data from their space at any time.