1. The parties and purpose. This agreement, entered into pursuant to Article 28 of the GDPR and, for a client in the United Kingdom, Article 28 of the UK GDPR, binds the client, as controller, and iasyo, as processor. It applies when the iasyo team, in order to carry out the Done-for-you fixes, accesses a website that contains personal data.
2. The processing.
| Item | Description |
|---|---|
| Nature and purpose | Viewing the administration pages needed to fix the 10 key pages, with no extraction or other use of the data |
| Duration | The duration of Done-for-you; access is removed at the end |
| Data concerned | The data present in the website's administration area: accounts and orders of the website's customers, form messages, user accounts |
| Data subjects | Customers, prospects and users of the client's website |
3. Instructions. iasyo only processes the data on the client's documented instructions: the terms and conditions, the Done-for-you order and the client's written requests in its client area. If iasyo considers that an instruction infringes the GDPR, it informs the client.
4. Confidentiality. The team members who access the website are bound by confidentiality.
5. Security. iasyo implements the measures provided for in Article 32 of the GDPR: access details stored encrypted; viewing after two-factor authentication, each viewing being logged; a dedicated account limited to the necessary rights; no copying or downloading of the website's data; changes recorded with the previous content.
6. Sub-processors. The fixes are carried out by the iasyo team, without subcontracting. The encrypted access details are stored on iasyo's server, hosted by IONOS. iasyo informs the client of any change, and the client may object to it.
7. Assistance. iasyo helps the client to respond to requests from data subjects and to meet its obligations regarding security, breach notification and data protection impact assessments, to the extent of the information available to it.
8. Data breaches. iasyo notifies the client of any personal data breach within 48 hours of becoming aware of it, with the information the client needs for its own notification.
9. End of processing. At the end of Done-for-you, iasyo stops using the access, deletes the login details it holds and confirms this to the client, who deletes the dedicated account on its side. iasyo keeps no data from the website.
10. Audits. iasyo makes available to the client the information needed to demonstrate compliance with this agreement. The client may have an audit carried out, at its own expense, once a year, with 30 days' notice.
11. Location. The data remains on the client's website. The iasyo team accesses it from [pays de l'équipe, dans l'Union européenne].
12. The client's obligations. The client has a legal basis for the processing carried out on its website, creates a dedicated account limited to the necessary rights, and tells iasyo which pages contain sensitive data.
