Data processing agreement (DPA)

This data processing agreement (the “DPA”) is entered into between T2ND SAAS, a SASU with share capital of €1,000, registered with the RCS of Lille Métropole under no. 107 995 631, whose registered office is at 34 place du Général de Gaulle, Bureau 3, 59800 Lille (the “Publisher”, processor), and the customer holding an organization on the cocoPIM service (the “Customer”, controller), as defined in the Terms of Use and Sale.

The DPA forms an integral part of the Terms of Use and Sale (Article 11): it applies automatically as soon as they are accepted, without a separate signature. A signable copy is available on request at contact@cocopim.fr. In the event of a conflict between the DPA and the Terms of Use and Sale on a data protection matter, the DPA prevails.

In accordance with Article 28 of the GDPR, the DPA governs the processing of personal data that the Publisher carries out on behalf of the Customer in the course of providing the cocoPIM service. The processing operations concerned are described in Annex 1.

Processing operations for which the Publisher acts as a controller do not fall within the scope of the DPA: management of cocoPIM user accounts (identity, authentication, preferences), billing and the commercial relationship, platform security. These processing operations are described in the Privacy Policy.

The terms “Customer”, “Service”, “Customer Data”, “Organization” and “User” have the meaning given to them in the Terms of Use and Sale. The terms “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meaning given to them in Article 4 of the GDPR. “Customer Personal Data” means the personal data contained in the Customer Data or processed on behalf of the Customer under Annex 1.

• The Customer is the controller of the Customer Personal Data: it determines the purposes and ensures that it has a valid legal basis and the necessary rights over the data it imports into the Service.
• The Publisher acts exclusively as a processor, on the documented instructions of the Customer (Article 4), and does not use the Customer Personal Data for any purpose of its own.
• As the Service is intended for the management of product information, the Customer undertakes not to import into it any sensitive data (Art. 9 GDPR) or data falling within highly personal categories; the Service is not designed for such processing.

The Publisher processes Customer Personal Data only on documented instructions from the Customer. The initial documented instructions consist of the Terms of Use and Sale, this DPA and the use of the Service's features by the Customer and its Users (settings, imports, exports, activation of optional features such as AI assistance or SSO). If the Publisher considers that an instruction infringes the GDPR, it informs the Customer without delay. If Union or Member State law requires a processing operation, the Publisher informs the Customer before that processing, unless prohibited by law.

The Publisher guarantees that the persons authorized to process Customer Personal Data are bound by a confidentiality obligation (contractual or statutory), are trained in data protection and access the data only to the extent strictly necessary for their duties (principle of least privilege, logged access).

The Publisher implements the technical and organizational measures described in Annex 2, appropriate to the risk of the processing operations described in Annex 1. It keeps them in line with the state of the art throughout the term of the contract and may change them only without any substantial reduction in the level of protection.

The Customer grants a general authorization for the use of the sub-processors listed in Annex 3. The Publisher:

• imposes on each sub-processor, by written contract, obligations equivalent to those of this DPA (Art. 28.4) and remains fully liable to the Customer for their performance;
• informs the Customer of any addition or replacement with a notice period of 30 days (notification by email and update of Annex 3), during which the Customer may object in writing on legitimate grounds relating to data protection;
• in the event of a well-founded objection to which no reasonable solution can be found, allows the Customer to terminate the subscription concerned without penalty, with a pro rata refund for the remaining period, as a deliberate exception to Article 7 of the Terms of Use and Sale (termination forced upon the Customer, product decision of 2026-08-05).

The payment provider Stripe is not a sub-processor under the DPA: it is involved in billing, a processing operation for which the Publisher is the controller, and also acts as an independent controller for its own regulatory obligations (see the Privacy Policy). Likewise, the Customer's identity provider (IdP) for SSO is an independent third party chosen and operated by the Customer, and not a sub-processor of the Publisher (Annex 1, processing C).

• Data subject rights: taking into account the nature of the processing, the Publisher assists the Customer through appropriate measures (full self-service export of the Customer Data in standard formats, rectification and deletion functions in the Service, self-service GDPR export for Users). If a data subject contacts the Publisher directly about a processing operation described in Annex 1, the Publisher refers them to the Customer and informs the Customer without undue delay.
• Articles 32 to 36: the Publisher assists the Customer, to a reasonable extent and taking into account the information available to it, with security, breach notification, and any data protection impact assessments (DPIAs) and prior consultations.

The Publisher notifies the Customer of any personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, with a target of 48 hours, so as to enable the Customer to meet its own 72-hour deadline for notification to the supervisory authority (Art. 33). The notification describes, to the extent of the information available (supplemented in phases where applicable): the nature of the breach, the categories and approximate volume of data and of data subjects concerned, the likely consequences, and the measures taken or proposed. The Publisher documents the breach and cooperates with the Customer; it does not communicate about the breach on behalf of the Customer without the Customer's consent, unless required by law.

Customer Personal Data is hosted in France (Annex 2) and processed exclusively within the European Economic Area (EEA). The Publisher makes no transfer outside the EEA of this data and uses only sub-processors that process it within the EEA (Annex 3); any transfers by those sub-processors' own sub-processors are governed by the safeguards of Article 46 of the GDPR (standard contractual clauses). The sole exception is the support email service (Annex 3), for data that the Customer chooses to send us by email. Any change would follow the procedure of Article 7.

Flows that the Customer triggers towards recipients of its choosing (connectors to its online stores and software, webhooks, REST and GraphQL APIs, exports, SSO identity provider) do not constitute transfers by the Publisher: they fall under the Customer's instructions and its relationship with those recipients (Annex 1, processing C for SSO).

The Publisher makes available to the Customer the information necessary to demonstrate compliance with this DPA: security documentation (Security page, Annex 2), answers to a reasonable audit questionnaire (once per 12-month period). The Customer may also have an audit carried out, at most once a year and subject to 30 days' prior written notice, by itself or by an independent third party that is not a competitor of the Publisher, during business hours, without access to the data of the Publisher's other customers, at the Customer's own expense. The findings are confidential.

Throughout the term of the contract and until the account is actually closed, the Customer may export all of its Customer Data on a self-service basis (standard formats, Terms of Use and Sale, Art. 10), without any subscription, payment or quota condition.

Events triggering deletion. The Publisher deletes the Customer Personal Data upon closure of the account, whatever the cause: request by the Customer, expiry or termination of its subscription, termination for breach, or expiry of the free trial not followed by a subscription or by the choice of the free Discovery plan. In the latter case, closure takes place 15 days after the end of the trial, after the five notices provided for in Article 5.8 of the Terms of Use and Sale. Unless the Customer gives written instructions to the contrary, no retention continues beyond that point.

Procedure. Deletion becomes final and irreversible at the end of the 30-day restoration window that follows closure (Terms of Use and Sale, Art. 10), that is, for an unconverted trial, no later than 45 days after the trial ends. Customer Personal Data is removed from backup copies at the end of their rotation cycle, which does not exceed 30 days (OVHcloud managed PostgreSQL offering: automatic, daily and encrypted backups, with a current retention of 2 days, which may be extended to 14 or 30 days depending on the plan subscribed; same period as in the Privacy Policy, §5); no restoration from backup is intended to reintroduce deleted data. This does not apply to data that the Publisher must retain under a legal obligation (in particular accounting obligations), nor to the proof that the notices were sent, which is retained without the email address in clear text (Privacy Policy, §5).

Upon written request made before deletion, the Publisher first returns a copy of the Customer Data.

The parties' liability under the DPA follows the regime of Article 14 of the Terms of Use and Sale (cap included), without prejudice to the mandatory rules of the GDPR (Art. 82). The DPA takes effect together with the Terms of Use and Sale and remains in force for as long as the Publisher processes Customer Personal Data. Any substantial amendment follows the amendment procedure of the Terms of Use and Sale (Art. 16).

A. Hosting and management of Customer Data (main processing)

• Nature and purpose: hosting, structuring, enrichment, export and distribution of the Customer's product information (features of the Service).
• Data: catalog content imported or created by the Customer. The catalog may contain incidental personal data (e.g., supplier contacts, names in product records), under the Customer's responsibility. Content of support requests (free text, attachments).
• Data subjects: any person mentioned in the Customer Data (business contacts, third parties).
• Duration: period of use of the Service, then until the account is closed; final deletion at the end of the 30-day restoration window that follows closure (Article 12). Where the account originates from an unconverted free trial, closure takes place 15 days after the end of the trial (Terms of Use and Sale, Art. 5.8), that is, final deletion no later than 45 days after the trial ends.

B. Catalog AI assistance (optional feature)

• Nature and purpose: generation of marketing content, suggestion of attributes and translation of product values, triggered by the User or by an AI field rule that the User has configured.
• Data: catalog content and generation context sent to the language model provider (Annex 3). Recommendation: do not enter personal data in the AI context fields.
• Safeguards: European provider; no training of the models on the Customer's data (use of calls for training purposes disabled on our account); no retention of requests or responses beyond the time needed to generate them (“zero data retention” option granted by the provider and active). These safeguards rest on the provider's data processing agreement, on the configuration of our account and on the technical scope described in Annex 3; the Publisher reviews them whenever its integration changes.

C. Federated authentication: enterprise SSO (optional feature)

• Nature and purpose: authenticating the members of the Customer's organization through its identity provider (IdP), provisioning accounts on the fly and logging sign-ins for security purposes.
• Data: stable IdP identifier, email address seen at the last sign-in, sign-in timestamps, SSO security logs. Data stored in the EU; security logs retained for a rolling 12 months.
• Customer's responsibilities for its IdP: the Customer remains solely responsible for the quality of the data asserted by its IdP (including email verification), for provisioning and revoking access (no automatic deprovisioning), for the security configuration of its IdP (MFA, access policies), for designating a fallback access before enforcing SSO, and for the safeguards governing any IdP hosted outside the EU. The IdP is not a sub-processor of the Publisher.

D. AI assistance usage statistics

• Nature and purpose: recording each AI assistance credit consumed and reporting it to the owner of the organization, in order to manage the shared monthly quota. The tracking is not intended for the individual assessment of Users.
• Data: identifier of the User who made the request (first and last name displayed, never the email address), date and time, AI function, trigger (request or saving of a product), space, product and channel concerned, number of credits. No text sent to or produced by the AI.
• Data subjects: Users of the Customer's organization.
• Access: Users holding the “AI usage” permission (the owner by default), limited to the spaces in which they hold it; each viewing is logged. The Publisher's staff are never identified by name.
• Duration: identity of the requesting User erased after 90 days; records retained for a rolling 12 months, then deleted; identity erased immediately upon deletion of the User's account.
• Customer's obligations: inform the Users concerned before enabling the view by name (a template text is provided in the documentation (in French)) and not use this data for any purpose other than the purpose set out above.

• Hosting in France (European Union), with a professional hosting provider whose Public Cloud scope is certified ISO/IEC 27001 (supplemented by the ISO/IEC 27017 standard, cloud security, and the ISO/IEC 27018 standard, protection of personal data) and ISO/IEC 27701, covered by SOC 1 and SOC 2 Type II attestation reports (SSAE 18) and certified as a Health Data Host (HDS, Hébergeur de Données de Santé).
• Encryption in transit (TLS) of all communications with the Internet and with the managed data services (database, cache, object storage); internal flows confined to the platform's private network, isolated from the Internet; infrastructure secrets managed in a dedicated vault, never stored in clear text.
• Per-customer isolation: strict isolation of each organization through several independent layers of defense, down to the database.
• Access control: password authentication confirmed by a one-time code sent by email, two-factor authentication available, single sign-on (SSO SAML 2.0 / OpenID Connect) with the Customer's directory, fine-grained permissions by role and by workspace, systematic server-side checks.
• Traceability: audit log of sensitive actions, viewable by the Customer's administrators; internal access limited to what is strictly necessary and logged.
• Backups of the database, made daily and replicated in a second data center in France, and a documented restoration procedure.
• Minimization and purges: automatic purges of technical data (logs, notifications), erasure or anonymization upon deletion of an account.
• Secure development: systematic security reviews, tests reproducing attack scenarios, responsible disclosure process (Security page).

• OVHcloud (OVH SAS), France. Hosting of the Service and of the Customer Data. Location: France. Transfers outside the EU: none. Data processing agreement applicable under Article 28 of the GDPR, incorporated by reference into the OVHcloud terms of service (the “Annexe Traitement de données à caractère personnel”, i.e., the personal data processing annex).
• Mistral AI, France. Language model provider (“La Plateforme”) for catalog AI assistance, when the User triggers an assistance request or when an AI field rule that the User has configured applies. Training on the Customer's data: none. Retention of requests and responses: none beyond their generation (“zero data retention” active). Data processing agreement applicable under Article 28 of the GDPR, incorporated by reference into the provider's terms. Location: European Economic Area (infrastructure in France, Sweden and Norway, inference within the EEA). Transfers outside the EEA: none attributable to the Publisher for Customer Personal Data, as the provider's US API endpoint is not used (API address controlled by the Service); any transfers by the provider's own sub-processors are governed by standard contractual clauses. The list of the provider's sub-processors is published in its trust center; the Publisher is subscribed to its updates.
• Brevo (France): sending of the Service's transactional emails (sign-in and sign-up codes, notifications). Location: European Union. Data processing agreement applicable under Article 28 of the GDPR, incorporated by reference into the provider's terms.
• Google (Google Cloud EMEA Ltd), Ireland. Business email (Google Workspace) for the @cocopim.fr addresses, including support: only for data that the Customer chooses to send us by email. Location: European Union (data storage). Any transfers to Google LLC (United States) are governed by the European Commission's standard contractual clauses and the Data Privacy Framework certification. Data processing agreement applicable under Article 28 of the GDPR, incorporated by reference into the provider's terms.

The version of this list currently in force is published on this page; any change is notified in accordance with Article 7.