Confidentiality Agreement

Magileads is committed to:

• client's database which will be given to Magileads for the distribution of email campaigns.
• This same information must be destroyed at the end of the service or at the client's advance request.

In accordance with Article 28 of the CNIL – Subcontracting

• The data is hosted in France by OVH on servers that are dedicated and secure to us.
• Data between the client and Magileads is transferred using SSH and MD5 encryption.

Personal Data Subcontracting Agreement

This contract is concluded between the persons designated below.

The client [name] 

Hereinafter referred to as the data controller .

KA-Group Company – MAGILEADS

40 Rue de Plaisance, 75014 Paris

hereinafter referred to as the subcontractor

Preamble

The client [client name] is responsible for the processing of personal data governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). This regulation is hereinafter referred to as the GDPR .

The processing of personal data is also governed by French law no. 78-17 of 6 January 1978 relating to information technology, files and freedoms (as amended).

The data controller wishes to entrust the processing of personal data to the data processor, in accordance with Article 28 of the GDPR. The parties undertake to comply strictly with the GDPR, which shall apply in all circumstances, notwithstanding any possible stipulation to the contrary.

Subcontractor's Declaration

The subcontractor declares that it provides the necessary guarantees regarding the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the GDPR and guarantees the protection of the rights of the data subject.

Characteristics of the processing of personal data

The data controller defines its characteristics as follows.

Purpose of processing – The purpose of the processing is commercial prospecting.

Duration of treatment – ​​The treatment is carried out from the start of the contract until the end of our partnership.

Nature and purpose of the processing – Automated prospecting .

Type of personal data – B2B contact file .

Categories of people concerned – B2B companies

Obligations and rights of the data controller

The data controller determines the purposes and means of the processing of personal data.

The data controller guarantees that the processing is lawful and that personal data is collected and processed by him in accordance with the GDPR and French law. 

The data controller shall in particular ensure that it provides the required information to the persons concerned by the processing operations, at the time of data collection when personal data are collected from the data subject, or within the required time limits when personal data have not been collected from the data subject, in accordance with Articles 12 to 14 of the GDPR. 

The data controller guarantees the subcontractor against the consequences of any failure by the data controller to comply with its obligations under the GDPR.

The data controller will provide the subcontractor with all the necessary information to enable it to perform its services in compliance with the GDPR and French law.

Subcontractor's obligations

The subcontractor does not determine the purposes and means of the processing. Otherwise, it is considered a data controller with regard to the processing in question.

The subcontractor and any person acting under its authority who has access to personal data may not process such data, except on instructions from the data controller, unless required to do so by European Union law or the law of a Member State.

The processor shall process personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country outside the European Union or to an international organisation, unless required to do so by European Union law or the law of the Member State of the European Union to which the processor is subject; in that case, the processor shall inform the controller of this legal obligation before processing, unless the law concerned prohibits such information for important reasons of public interest.

The subcontractor ensures that persons authorized to process personal data undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality.

The subcontractor takes all measures required under Article 32 of the GDPR.

The subcontractor shall take into account the nature of the processing, assist the controller, by appropriate technical and organisational measures, to the fullest extent possible, in fulfilling its obligation to respond to requests from data subjects to exercise their rights under Chapter III of the GDPR.

The subcontractor assists the controller in ensuring compliance with the obligations set out in Articles 32 to 36 of the GDPR , taking into account the nature of the processing and the information available to the subcontractor.

The subcontractor shall immediately inform the controller if, in its opinion, an instruction constitutes a violation of the GDPR or other provisions of Union or Member State law relating to data protection.

Data retention and destruction

Depending on the choice of the data controller, the processor deletes all personal data or returns it to the data controller at the end of the provision of services relating to the processing, and destroys existing copies, unless European Union law or the applicable law of a Member State requires the retention of personal data.

Audit

The subcontractor shall make available to the controller all the information necessary to demonstrate compliance with the obligations provided for in this contract and to allow the controller or another auditor mandated by the controller to carry out audits, including inspections, and shall contribute to these audits.

Another subcontractor

The subcontractor must meet the following conditions in order to recruit another subcontractor.

The subcontractor shall not engage another subcontractor without the prior written authorization, whether specific or general, of the data controller. In the case of general written authorization, the subcontractor shall inform the data controller of any planned changes concerning the addition or replacement of other subcontractors, thereby giving the data controller the opportunity to object to such changes.

When a processor engages another processor to carry out specific processing activities on behalf of the controller, the same data protection obligations as those set out in this contract are imposed on that other processor by contract or, where appropriate, by means of another legal act under European Union or Member State law, in particular with regard to providing sufficient guarantees concerning the implementation of appropriate technical and organizational measures to ensure that the processing complies with the requirements of the GDPR. If that other processor fails to fulfill its data protection obligations, the original processor remains fully liable to the controller for the other processor's performance of its obligations.

Duration

This contract will remain in effect for the entire duration of the subcontractor's holding of personal data. It will govern the subcontracting of the personal data referred to herein, at all times, including after its termination.

Applicable law and jurisdiction clause

This contract is subject to French law and the exclusive jurisdiction of the courts with territorial jurisdiction for the city of Paris, France.

The following is referred to as the data controller:
Francois KOLLI, DPO – ue.sdaeligam@opd
, KA-Groupe – MAGILEADS,
40 Rue de Plaisance, 75014 Paris

Company Registration Number (RC/SIRET): 848746632
APE Code: 7022Z
VAT Number: FR93 848746632