PrivacyboardData processing agreement
Last validated 3 November 2026
Parties
Processor: Privacyboard, 3 Ter Avenue Jeanne d'Arc, 94170, Le Perreux Processor contact: antoine@unmake.io Controller: [CUSTOMER LEGAL NAME AND ADDRESS] Effective date: [DATE OF SIGNATURE]
Purpose and scope
This agreement applies to the processing of personal data by the processor on behalf of the controller in the course of the service described below. It forms part of the agreement between the parties for that service and is intended to meet the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR).
Service
Privacyboard takes care of your privacy policy, your providers and your customers’ privacy requests, so you can get on with your business. Free to set up.
Processing instructions
The processor processes personal data only on documented instructions from the controller, including instructions relating to transfers to a third country or an international organization, unless required to do so by law. In that case, the processor informs the controller of that legal requirement before processing, unless the law prohibits it. The processor informs the controller immediately if, in its opinion, an instruction infringes data protection law.
Confidentiality
The processor ensures that the persons authorized to process the personal data are bound by a duty of confidentiality, by contract or by law.
Security
The processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures in place at the effective date are described in Annex 2.
Personal data breaches
The processor notifies the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and provides the information the controller needs to meet its own notification obligations.
Subprocessors
The controller gives general authorization for the use of the subprocessors listed below. The processor informs the controller of any intended addition or replacement, so that the controller can object. The processor imposes on each subprocessor the same data protection obligations as in this agreement, and remains fully liable to the controller for the performance of its subprocessors. Only confirmed processors used for client services are listed below. Review other providers separately. Vercel — Host business websites, online services or other company systems. — US Supabase — Provide database, authentication and file storage for enabled Supabase services. — France Resend — Deliver transactional emails such as account notifications and password resets. — US Google Analytics — Measure website or service usage and understand visitor interactions. — US
International transfers
The processor transfers personal data outside the European Economic Area only on the controller's documented instructions or where required by law, and only with the safeguards required by Chapter V GDPR. Some subprocessors process data outside the European Economic Area (Vercel, Resend, Google Analytics). For these transfers, the processor relies on standard contractual clauses approved by the European Commission.
Assistance to the controller
Taking into account the nature of the processing, the processor assists the controller, by appropriate technical and organizational measures, in responding to requests from individuals exercising their rights, and forwards without delay any such request it receives. The processor also assists the controller in ensuring compliance with its obligations on security, personal data breach notification, data protection impact assessments and prior consultation.
Return or deletion
At the end of the service, and at the controller's choice, the processor deletes or returns all personal data and deletes existing copies, unless the law requires storage of the data. Deletion procedure: We manually delete personal data upon request.
Audit and information
The processor makes available to the controller all information necessary to demonstrate compliance with this agreement, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor mandated by it, on reasonable notice.
Duration
This agreement applies for as long as the processor processes personal data on behalf of the controller, and until that data has been returned or deleted. Retention during the service: Contract duration + 12 months
Annex 1 - details of processing
Subject matter and purpose: Privacyboard takes care of your privacy policy, your providers and your customers’ privacy requests, so you can get on with your business. Free to set up. Data categories: Names, Email addresses, Account identifiers, Website & device data, Documents & attachments, Payment details Data subjects: Your clients’ customers, users or employees Processing carried out for clients: Service delivered on behalf of clients — Provide the service to clients and process their data only on their documented instructions Duration: Contract duration + 12 months
Annex 2 - security measures
Multi-factor authentication for administrative access Regular backups Encryption of personal data in transit and at rest Hosting region: France
Signatures
For the processor: name, title, date, signature For the controller: name, title, date, signature