Data Processing Agreement

Version 1.0 · In force from 22 August 2026 · Article 28(3) of Regulation (EU) 2016/679

We tell customers that a client's procurement team will ask how they govern data and AI. It would be indefensible to fail that questionnaire ourselves. This is the agreement that applies to every ActCovered account: no request needed, no NDA, no sales call. Print it, send it to your DPO, attach it to your vendor file.

Print this agreement

1. The parties and their roles

Controller (“you”, “the Customer”): the organisation holding the ActCovered account.

Processor (“we”, “ActCovered”): EZIOM SAS, SIREN 922 234 216, 200 rue de la Croix Nivert, 75015 Paris, France. Contact for all matters under this agreement: hello@actcovered.com.

You are the controller of the personal data you put into ActCovered — above all your employees' training records. We process it only to provide the service. Separately, we are the controller of our own customer-relationship data (your account email, your billing details); that processing is described in our Privacy Policy and is not governed by this agreement.

2. Subject-matter, duration, nature and purpose

Subject-matter. The hosted provision of ActCovered: an AI systems register, a usage policy generator, an AI-literacy training log, an evidence log and the exports built from them.

Duration. From the creation of your account until it is deleted, plus the deletion window in clause 10. This agreement survives for as long as we hold any of your personal data.

Nature of the processing. Collection, recording, structured storage, organisation, consultation, generation of documents, export and erasure — all by automated means, on servers in France.

Purpose. Solely to provide, secure and support the service you have subscribed to, and for nothing else. We do not use your file to train models, we do not profile your employees, and we do not use your content for our own analytics or marketing.

3. Categories of data subjects and of personal data

ActCovered is not designed for special categories of data under Article 9, nor for criminal-offence data under Article 10, and you agree not to enter them. The free-text fields exist for governance notes, not for HR files: please do not paste performance reviews, health information or disciplinary records into them.

4. Processing on documented instructions

We process your personal data only on your documented instructions, including on transfers. Your instructions are: this agreement, the Terms of Service, and the actions you take in the product — creating a record instructs us to store it, deleting one instructs us to erase it, exporting one instructs us to assemble it.

If we are required by EU or Member State law to process beyond your instructions, we will tell you before doing so, unless that law forbids the notice on important grounds of public interest. If in our view an instruction infringes the GDPR or other data protection law, we will tell you without delay and may suspend that instruction until it is resolved.

5. Confidentiality

Access to your data is limited to the people who need it to run and support the service. Today that is a very short list: the publication director, and no one else has credentials to the production database. Everyone with access is bound by a written confidentiality commitment that survives the end of their engagement. We do not disclose your data to third parties except the sub-processors listed in clause 7, or where a law we are subject to requires it — in which case we will notify you if we are permitted to.

6. Security of processing (Article 32)

Taking into account the state of the art, the costs of implementation and the risks to the individuals concerned, we implement the measures set out in Annex 2. They include, in summary: TLS in transit; passwordless authentication with single-use, short-lived sign-in links; strict per-account data isolation enforced in the application; hashing rather than storage of IP addresses; least-privilege access to the production environment; daily backups held by the host; and logging of the actions that make up your evidence trail.

We review these measures at least once a year and whenever the service changes materially. We will not weaken them during the term of this agreement.

7. Sub-processors

You give a general authorisation for us to engage the sub-processors listed below and published, with the date of the last change, on our sub-processor page. Each is bound by a written contract imposing data protection obligations no less protective than those in this agreement, and we remain fully liable to you for their performance.

Change procedure. Before adding or replacing a sub-processor we will give you at least 30 days' notice, by email to your account address and by updating the sub-processor page. You may object on reasonable data protection grounds within those 30 days by writing to hello@actcovered.com. If we cannot resolve your objection, you may terminate the affected service and receive a pro-rata refund of any fees paid in advance for the unused period — with no penalty, and with your export still available.

8. Assistance with data-subject requests

Most of this is built into the product rather than dependent on our response time. Your account page lets you export everything we hold for your account in a machine-readable file (Articles 15 and 20), edit any record in place (Article 16), and delete your account and its contents outright (Article 17).

Where a request cannot be answered from the product, we will assist you by appropriate technical and organisational measures, insofar as this is possible and taking into account the nature of the processing. Concretely: if one of your employees exercises a right against you and you need our help to locate, correct, restrict, export or erase their record, email hello@actcovered.com and we will respond within 5 business days — free of charge for a proportionate volume of requests.

If a data subject contacts us directly about data you control, we will not answer on your behalf. We will tell them to contact you, and tell you that they got in touch, without undue delay.

We also assist you, on the same terms, with your obligations under Articles 32 to 36 — security, breach notification, data protection impact assessments and prior consultation — taking into account the information available to us.

9. Personal data breaches

We will notify you of a personal data breach affecting your data without undue delay and in any event within 48 hours of becoming aware of it. The notice will describe, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for more information. Where the full picture is not yet available, we will send what we have and follow up in phases rather than waiting.

Notifying your supervisory authority and, where required, the individuals concerned is your decision as controller. We will give you the information you need to make it and to meet the 72-hour deadline in Article 33.

10. Deletion and return on termination

You can export your complete file at any time during the term, from your account page and without asking us — so the “return” half of Article 28(3)(g) is available before termination rather than after it.

When your account is deleted, whether by you or by us, your personal data is erased from the live database immediately and from the host's rotating backups within 30 days. After that we retain no copy, with one exception: invoices and the accounting records attached to them, which French law requires us to keep for 10 years, and the hash of an email address on our suppression list, which exists so that an unsubscribe cannot be accidentally undone. Neither contains your compliance file.

We will confirm the deletion in writing on request.

11. Audit rights

We make available to you all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice, and because we are a small company: send your security questionnaire to hello@actcovered.com and we will complete it within 10 business days at no charge, once per twelve-month period per customer. Before you send one, it is worth checking this page and the sub-processor list — between them they answer most of what a standard questionnaire asks, and they are already dated and public. If that is not enough for your risk assessment, you may request an audit once per twelve-month period — or at any time after a personal data breach affecting your data — on 30 days' written notice, during business hours, without disrupting the service, and subject to confidentiality. You bear the cost of your own auditor; we bear the cost of our participation. Where an audit finds a material non-compliance, we will remedy it at our own expense.

12. International transfers

Your compliance file is stored and processed in the European Union — on servers in France — and we do not transfer it outside the EEA in the ordinary course.

Two of our sub-processors are groups with entities outside the EEA that may access data in the course of support or fraud prevention: Stripe and, for email delivery infrastructure, Brevo. Those transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914), together with the supplementary technical and organisational measures documented by each provider. Copies of the relevant clauses are available from us on request. We will not begin any new category of transfer without notifying you under the procedure in clause 7.

Annex 1 — Details of processing

Consolidated for procurement files: Categories of data subjects and categories of personal data are in clause 3. Nature and purpose are in clause 2. Duration is the life of the account plus the deletion window in clause 10. Special categories: none, and not permitted. Frequency: continuous, for the duration of the subscription. Controller: the Customer. Processor: EZIOM SAS. Sub-processors: clause 7 and the sub-processor page.

Annex 2 — Technical and organisational measures (Article 32)

• Encryption in transit. All traffic to the site and the application is served over TLS; HTTP requests are redirected. Email is submitted to our relay over authenticated TLS.
• Authentication. Passwordless. Sign-in is by a single-use token that expires within minutes, is invalidated on use, and is stored hashed. There are no user passwords to leak, reuse or phish from a database.
• Access control in the application. Every query for account data is scoped to the signed-in account; there is no cross-account read path in the product, and no shared "admin view" of customer files.
• Least privilege in operations. Production database credentials are held by the publication director alone. Access is used for maintenance and incident response only, and is not a routine part of support.
• Data minimisation by design. IP addresses are stored only as a salted SHA-256 hash, which supports abuse detection without retaining an identifier. The Readiness Check keeps an email, five answers and a score — nothing more. Suppression lists store hashes, not addresses.
• Integrity of evidence. Generated policies carry a SHA-256 content hash and a version number, and the evidence log records events with server-side timestamps, so the record cannot be quietly rewritten after the fact.
• Backups and restoration. The host takes daily backups of the database, retained on a rotating window and restorable on request. Backups inherit the deletion window in clause 10.
• Availability. The service runs on managed shared hosting with the provider's own redundancy and monitoring; we monitor a health endpoint and email deliverability.
• Software maintenance. The application runs a supported framework and PHP version, and security updates to dependencies are applied promptly.
• Anti-abuse. Public endpoints — the Readiness Check and the sign-in form — are rate limited per address and per origin, and protected against automated submission.
• Organisational. Confidentiality commitments for anyone with access; a documented breach procedure with the 48-hour notice in clause 9; and an annual review of this annex.