Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) applies to any service provided by elionis in the course of which elionis processes personal data on behalf of the Client. It forms an integral part of the contract between elionis and the Client whenever the General Terms applicable to the service (the General Terms of Membership (CGA) or the CGSU), the Membership Form, the quote, or any other contractual document refers to it.

1. Parties and capacity of the parties

The “Client” means the natural or legal person identified in the Membership Form or in the applicable service contract. For the processing covered by this DPA, the Client acts as controller or, where applicable, as processor on behalf of its own clients.

“elionis”, a simplified joint-stock company (SAS) with share capital of €25,000, whose registered office is located at 19, rue Maryse Bastié – 94490 Ormesson-sur-Marne, registered with the Créteil Trade and Companies Register (RCS) under number 484 736 103, acts as processor when it processes personal data on behalf of, and on the documented instructions of, the Client.

2. Purpose and scope

This DPA sets out the conditions under which elionis processes personal data on behalf of the Client in connection with the Services, in accordance with Regulation (EU) 2016/679 of April 27, 2016 (“GDPR”), in particular Article 28 thereof, and with applicable French data protection regulations.

Depending on the scope actually subscribed to by the Client, it supplements the applicable CGA or CGSU, the Membership Form, quotes, technical documentation, and other contractual appendices. The CGA and the CGSU are separate and independent contractual frameworks: this DPA applies to each of them where it is expressly referred to therein. In the event of a conflict specifically concerning the protection of personal data, the mandatory provisions of the GDPR prevail.

3. Description of the processing

4. Instructions of the Client

elionis processes personal data only on the documented instructions of the Client, including with regard to data transfers, unless processing is required by European Union law or French law. In that case, elionis informs the Client of that legal requirement before processing, unless prohibited by law.

Documented instructions arise in particular from the Contract, support requests and tickets, the Client’s written requests, and configurations carried out at its request. If elionis considers that an instruction infringes the applicable data protection regulations, it informs the Client as soon as possible.

5. Confidentiality and authorized persons

elionis ensures that the persons authorized to process personal data are bound by an appropriate obligation of confidentiality and access the data only to the extent necessary to perform their duties. Access rights are granted on a need-to-know basis and are subject to appropriate control measures.

6. Security of processing

Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks to the rights and freedoms of individuals, elionis implements appropriate technical and organizational measures in accordance with Article 32 of the GDPR.

• encryption of communication, administration, interconnection, and transfer flows, depending on the use cases concerned;
• access control, authorization management, and authentication;
• firewalls, network segmentation, and system protection measures;
• protection against malware and security controls;
• monitoring, logging, and analysis of security events;
• redundancy, backup, and restorability check mechanisms appropriate to the Service;
• procedures designed to ensure the confidentiality, integrity, availability, and resilience of systems.

The detailed technical and organizational measures may be described in a security appendix, in the technical documentation of the Service, or on a dedicated elionis page. They may change to take account of the state of the art, provided that they do not substantially reduce the overall level of protection applicable to the Service.

7. Health data hosting

Where the subscribed Services involve hosting personal health data on behalf of the Client and fall within the applicable certification scope, elionis provides the Services in compliance with the health data hosting (HDS) requirements corresponding to its certified scope. The applicable location, architecture, and technical characteristics are specified in the contractual and technical documentation of the Service.

8. Sub-processors

The Client grants elionis a general authorization to engage sub-processors where necessary to provide the Services. elionis informs the Client in advance of any significant addition or replacement of a sub-processor involved in the processing of personal data, so as to allow the Client to raise a reasoned objection based on data protection grounds.

elionis imposes on each relevant sub-processor data protection obligations offering a level of protection at least equivalent to that required by this DPA for the services entrusted to it. elionis remains liable to the Client for the performance of its sub-processors’ data protection obligations under the conditions set out in the GDPR.

The list or categories of applicable sub-processors may be communicated to the Client or published on a contractual medium or on a dedicated page kept up to date by elionis.

As of the date of this version, OPCORE acts as a sub-processor of elionis for the data center hosting of the infrastructure concerned. The list or categories of sub-processors may change in accordance with the prior notice and objection procedures provided for in this DPA.

9. Transfers outside the European Economic Area (EEA)

elionis gives preference to processing and hosting data within the European Union. No transfer of personal data to a third country or an international organization is carried out on behalf of the Client without complying with the requirements of Chapter V of the GDPR and, where required, with the Client’s documented instructions.

10. Assistance to the Client and data subjects’ rights

Taking into account the nature of the processing, elionis assists the Client, insofar as possible and through appropriate technical and organizational measures, to enable it to respond to requests from data subjects exercising their rights.

Where elionis directly receives a request from a data subject concerning data processed on behalf of the Client, it forwards the request to the Client as soon as possible and does not respond on the merits, unless instructed by the Client or required by law.

11. Compliance assistance

Taking into account the nature of the processing and the information available to it, elionis provides the Client with reasonable assistance in complying with the applicable obligations relating to security, personal data breach notification, data protection impact assessments and, where applicable, prior consultation of the supervisory authority.

Services that go beyond the assistance normally included in the Services and require specific work may be subject to a quote or to additional billing, without prejudice to the mandatory obligations incumbent on elionis in its capacity as processor.

12. Personal data breaches

elionis notifies the Client, as soon as possible after becoming aware of it, of any personal data breach affecting the data processed on its behalf. To the extent such information is available, the notification includes the relevant details enabling the Client to meet its own obligations under Articles 33 and 34 of the GDPR.

elionis cooperates reasonably with the Client in analyzing the incident, limiting its consequences, and documenting the corrective measures.

elionis notifies the Client of any personal data breach concerning the processing carried out on its behalf, without undue delay after becoming aware of it, and provides the Client with the available information useful for fulfilling its own obligations.

13. Backups and return of data

The infrastructure backup mechanisms implemented by elionis are primarily intended to ensure the technical protection and restorability of the operated infrastructure. Their existence does not give the Client direct access to the backup tools or media.

In the absence of a subscription to an individual backup service, the Client may nevertheless send elionis a one-off, reasonable request for the return of its backed-up information. Subject to the data being present in the available backups, and to its integrity and technical usability, elionis may extract or return it in a technically usable format. This operation does not constitute an on-demand restoration commitment included in the base package and may be subject to additional billing.

The applicable retention, frequency, location, and restoration characteristics are those provided for by the Service and its technical documentation. A dedicated backup service may be subscribed to separately by the Client.

Exceptional requests for return or restoration that fall outside the scope of the subscribed Service may be subject to additional billing, at the current intervention rate or based on a prior quote, depending on the nature of the intervention.

14. Handling of data at the end of the Services

Support tickets and telephone call recordings are, in principle, retained for twelve (12) months. Certain items may be retained longer where a specific purpose justifies it, in particular for handling complex cases, establishing or preserving evidentiary or legal records, or training needs. In such cases, retention is limited to the period necessary for the purpose concerned and is subject to reassessment.

At the end of the Services and at the Client’s choice, elionis returns or deletes the personal data processed on its behalf, as well as any existing copies, unless a legal obligation requires their retention. The practical arrangements for reversibility, the available formats, timeframes, and any costs are governed by the Contract and the subscribed services.

15. Documentation, audits, and demonstration of compliance

elionis makes available to the Client the information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR and contributes to the audits reasonably necessary for such demonstration.

Except in the event of a security incident, a request from a competent authority, or a specific legitimate reason, any on-site audit is organized with reasonable prior notice, during business hours, so as not to disrupt the Services and in compliance with the security and confidentiality obligations applicable to other clients and to shared infrastructure. The specific costs of an audit requested by the Client may be charged to the Client where they exceed the supporting documentation and controls normally made available, subject to mandatory legal obligations.

Audits, assistance requests, or specific work exceeding elionis’s legal obligations or the scope of the subscribed Services may be subject to additional billing, at the current intervention rate or based on a prior quote.

16. Obligations of the Client

The Client remains responsible for the lawfulness of the processing it entrusts to elionis, for determining the purposes and legal bases, for informing data subjects, for managing their rights and, more generally, for complying with the obligations incumbent upon it as controller.

The Client undertakes to transmit to elionis only the data necessary for the subscribed Services and to provide instructions that are lawful, documented, and consistent with the contractual scope.

17. Liability

The liability of the parties under this DPA is assessed in accordance with the GDPR, the applicable regulations, and the provisions of the Contract, and no contractual clause may exclude or limit any liability that cannot lawfully be excluded or limited.

18. Term and entry into force

This DPA enters into force at the same time as the Contract to which it relates and remains applicable for as long as elionis processes personal data on behalf of the Client. Obligations which, by their nature, must survive the end of the Contract, in particular those relating to confidentiality and the handling of data, remain applicable.

19. Version and availability

This DPA is published and accessible at the permanent address: https://elionis.fr/accord-relatif-au-traitement-des-donnees-personnelles-dpa/

Each version of the DPA is identified by a version number and an effective date. elionis retains previous versions so that the version applicable to a given contractual relationship can be determined.

Data protection point of contact: Thomas SERRE, elionis GDPR Lead – dpo@elionis.fr.

Version 1.2 – September 2026. This DPA is a cross-cutting document, independent of the CGA and the CGSU, to which each of these contractual frameworks may refer separately. It may be made available electronically at a single permanent address communicated in the CGA, the CGSU, the Membership Form, the quote, or any other contractual document. The version applicable to the Client is the one identified in the Contract or in force on the date the Contract was accepted, subject to any amendments made necessary by legal or regulatory changes.

Appendix A – Technical and organizational measures

The measures below constitute a general baseline. The measures actually applicable depend on the subscribed Service and the associated technical documentation.