Personal data processing agreement

Between

• the customer, the individual or legal entity that has created a Talkieback account and uses it for its applications or websites (the "Controller");

and

• Red Brick Studio, sole proprietorship of Simon Gavelle (EI), 41 rue Jacquemars Giélée, 59800 Lille, France, SIRET 131 744 013 00015, publisher of the Talkieback service (the "Processor").

This agreement forms part of the Talkieback terms of use. In the event of a conflict regarding data protection, it prevails.

Article 1 · Purpose

The Processor processes personal data on behalf of the Controller in order to provide Talkieback: collecting feedback from the users of the Controller's applications, transcribing it, making it available to the Controller's team, enabling replies, and notifying users of replies. The description of the processing is set out in annex I.

Article 2 · Term

This agreement applies for as long as the Processor processes data on behalf of the Controller, and until the data is deleted or returned (article 12).

Article 3 · Instructions

1. The Processor processes the data only on documented instructions from the Controller. These instructions consist of: this agreement, the terms of use, the settings chosen in the Talkieback workspace (retention period, transcription, notifications, webhooks, integrations) and the actions taken in that workspace or through the API.
2. The Processor does not use the data for its own purposes. In particular, it does not use the data for advertising, does not sell it, and does not use it, or allow its subprocessors to use it, to train artificial intelligence models.
3. If the Processor considers that an instruction infringes the GDPR or other data protection rules, it immediately informs the Controller.
4. The Processor may produce aggregated and anonymous usage statistics (number of feedback items, length of messages) to operate, bill and improve the service.

Article 4 · Confidentiality

Persons authorized to process the data at the Processor are bound by confidentiality and access the data only to provide the service, to provide support requested by the Controller, or to ensure security and maintenance.

Article 5 · Security

The Processor implements the technical and organizational measures set out in annex II, appropriate to the risk (article 32 of the GDPR). It may change them, provided that the level of protection is not reduced.

Article 6 · Subprocessors

1. The Controller gives the Processor a general authorization to engage the subprocessors listed in annex III.
2. The Processor informs the Controller of any addition or replacement at least 30 days in advance, by email and in the Talkieback workspace. During this period, the Controller may object on reasonable grounds relating to data protection. If no solution is found together, the Controller may cancel its subscription free of charge and obtain a refund of the paid and unused portion.
3. The Processor imposes on each subprocessor, by contract, data protection obligations at least equivalent to those of this agreement. It remains liable to the Controller for their compliance.

Article 7 · Transfers outside the European Union

1. The data is stored in the European Union.
2. Some subprocessors are established in the United States or access the data from there (annex III). The Processor carries out such transfers only if they are covered by appropriate safeguards: certification of the recipient under the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses (module 3, processor to processor), supplemented where necessary by additional measures.

Article 8 · Data subject rights

1. The Processor provides users, in the panel and in emails, with the means to stop being notified and to delete their feedback without an account. It provides the Controller, in the Talkieback workspace and through the API, with the means to view, export, rectify and delete a user's data.
2. If a person contacts the Processor directly to exercise another right, the Processor forwards the request to the Controller without delay and does not respond to it itself, unless instructed to do so.
3. The Processor assists the Controller in responding to requests within the legal time limits.

Article 9 · Personal data breaches

1. The Processor notifies the Controller of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it, at the email address of the account owner.
2. The notification contains, as soon as they are known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point.
3. The Processor assists the Controller in notifying the CNIL (within 72 hours) and, where necessary, the data subjects.

Article 10 · Assistance

The Processor assists the Controller, to the extent of the information available to it, with data protection impact assessments (article 35), prior consultation of the supervisory authority (article 36) and security (article 32).

Article 11 · Documentation and audits

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with this agreement: this agreement and its annexes, the up-to-date list of subprocessors, and, on request, a written response to a security questionnaire.
2. If this information is not sufficient, the Controller may have an audit carried out, no more than once a year, by itself or by an auditor bound by confidentiality who is not a competitor of the Processor, with 30 days' notice, during business hours, without access to other customers' data. The costs of the audit are borne by the Controller, unless it reveals a material breach by the Processor.

Article 12 · End of processing

1. During the subscription, the Controller may export its data at any time.
2. When the account is closed, the data remains available for export for 30 days, and is then deleted. Backups are erased no later than 30 days afterward.
3. The Processor keeps no copy, unless required by law, in which case it informs the Controller.

Article 13 · Obligations of the Controller

The Controller:

• has a legal basis for the processing and informs its users, in particular by including in its privacy policy the clause provided by the Processor (annex I);
• attaches to feedback, through context or identification, only data that is necessary, and no special categories of data within the meaning of article 9 of the GDPR, nor any banking data or passwords;
• remains responsible for the tools it connects to Talkieback (webhooks, API, integrations) and for what it does with the data it exports from it.

Article 14 · Liability, governing law

Each party's liability is governed by the Talkieback terms of use, within the limits permitted by the GDPR. This agreement is governed by French law; disputes fall within the jurisdiction of the competent courts of Lille.

Annex I · Description of the processing

Clause to include in the Controller's privacy policy, which the Controller adapts and remains responsible for:

Feedback and suggestions. We offer a button to send us a voice or written message. We receive your message (recording and automatic transcript, or text), the page you were on, the last pages visited, technical information about your device, and, if you are signed in, your account identifier and your email address. We use them to understand your feedback, improve {app}, reply to you and notify you of our reply, on the basis of our legitimate interest in handling the feedback you choose to send us. They are kept for {duration} at most. This service is provided by Talkieback (Red Brick Studio, France), our processor, which itself uses service providers for hosting (in the European Union), voice transcription, and sending emails and notifications; some are established in the United States, and these transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework. You can delete your feedback at any time from "My feedback", and exercise your other rights by writing to us at {contact}.

Annex II · Security measures

• Encryption: HTTPS (TLS 1.2 or higher) for all exchanges; data and files encrypted at rest by the hosting provider; web notifications end-to-end encrypted; customers' mobile notification keys encrypted in the database.
• Isolation: each customer accesses only its own apps; the database is never directly exposed, everything goes through the Talkieback API; access rules checked on every request.
• Recordings: private storage, upload and playback through time-limited signed links; no public links.
• Secrets: app and webhook secrets hashed or shown only once; webhook signatures; public key restricted to the declared domains and app identifiers.
• Internal access: administrative access limited to Red Brick Studio, with two-factor authentication on the hosting providers' accounts; access to a customer's data only for support it has requested or for security.
• Abuse: submission limits per user and per day, API quotas, rate limits per IP address.
• Availability: daily database backups by the hosting provider.
• Deletion: automatic purge at the end of the retention period; nightly purge of files without feedback.
• Providers: transcription without retention for training (explicit opt-out on every call); processing agreements with each provider.

Annex III · Subprocessors

Stripe is not a subprocessor under this agreement: it processes the customer's billing data, for which Red Brick Studio is the controller.