Data processing agreement

This page is a translation; the French version is authoritative.

Version of 19 October 2026.

This agreement applies article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), between the Customer, the controller, and the Publisher, Ghislain Levrat, sole trader, SIREN 999 243 322, the processor. It forms part of the terms and conditions and is accepted with them; a signed copy is provided to any Customer who asks for one. For personal data, it prevails over them.

1. Subject matter and duration

The Publisher processes personal data on the Customer’s behalf in order to provide it with Escouade online: the Escouade application and its Meet, Mail, Social and Tools applications, with Prescriptio when it is included in the plan. The processing lasts as long as the contract, then until the return and deletion set out in article 12.

2. Nature and purposes

The hosting, storage, indexing, search and AI analysis of the Customer’s records, emails, documents and meetings; sending and receiving its emails; recording, transcribing and summarising its meetings; preparing and scheduling its posts; relaying events between its applications. All of this for the uses the Customer configures, and those alone.

3. Data and data subjects

The data: identity and contact details, positions and professional data, the content of emails and their attachments, documents, audio recordings, meeting transcripts and minutes, voice in voice mode, notes, tasks and CRM records, users’ connection data. The data subjects: the Customer’s users, its customers, prospects, suppliers and partners, their contacts, and the participants in its meetings.

The service is not designed for the special categories of data of article 9 of the GDPR, and its hosting is not certified for health data. The Customer only puts such data into it after checking the legal basis for doing so.

4. The Customer’s instructions

The Publisher processes the data only on the Customer’s documented instructions: the terms and conditions, this agreement and the settings of its workspace, such as the connectors linked, the AI providers chosen, the ingestion rules and the users’ rights. It uses the data for no other purpose, does not sell it and trains no AI model with it. If an instruction seems to it to infringe the GDPR, it informs the Customer without delay.

5. Confidentiality

Only the persons the Publisher authorises access the data, to the extent necessary for the service, and they are bound by confidentiality. The Publisher only opens a session in the Customer’s workspace at the Customer’s written request, limited in time and logged, or to comply with a legal obligation.

6. Security

The Publisher implements the measures of article 32 of the GDPR described in the annex, and keeps them up to date.

7. Subprocessors

The Customer authorises the Publisher to use the subprocessors on the Subprocessors page, each for the function stated there. The Publisher imposes on them, by contract, data protection obligations equivalent to those of this agreement, and remains liable to the Customer for their performance.

It announces any addition or replacement at least one month in advance, by email to administrators and on that page. The Customer may object on grounds relating to data protection; failing agreement, it terminates without penalty before the announced date, and amounts paid for a period not served are refunded. A provider that the Customer chooses itself, such as an AI model of another origin, is brought into service by that choice.

8. Transfers outside the European Union

Workspaces are hosted in France. A transfer outside the European Union only takes place to the subprocessors on the list that say so, governed by an adequacy decision or by the European Commission’s standard contractual clauses, or, for a provider the Customer chooses itself, on its instruction and with full knowledge of the facts.

9. Data subjects’ rights

The workspace’s tools let the Customer find, export, correct and delete a person’s data. The Publisher forwards to it without delay any request it receives directly, without answering it itself, and helps it answer within the GDPR time limits.

10. Personal data breaches

The Publisher notifies the Customer of any personal data breach without undue delay, and at the latest forty-eight hours after becoming aware of it, with what it knows of its nature, the data and persons affected, its likely consequences and the measures taken or proposed. It supplements the information as it goes, so that the Customer can notify the CNIL within seventy-two hours.

11. Assistance to the Customer

The Publisher provides the Customer with the information it needs for the security of processing, its impact assessments and any prior consultation of the CNIL (articles 32 to 36 of the GDPR).

12. End of processing

At the end of the contract, the Customer retrieves its data through the export of its workspace (terms and conditions, article 13). The Publisher then deletes it at most ninety days after the account is closed, backups included, unless a legal obligation requires it to be kept, and confirms the deletion to any Customer who asks.

13. Audit

The Publisher makes available to the Customer the information needed to demonstrate compliance with this agreement. It accepts one audit per year, at the Customer’s expense, carried out by the Customer or by an auditor bound by secrecy who is not a competitor of the Publisher, with thirty days’ notice and without access to other customers’ data.

14. The Escouade account and Escouade hub

For the Escouade account itself, that is the organisations, the members, sign-in, consumption and billing, the Publisher is the controller: the privacy policy applies. For the events that the relay passes between the Customer’s applications, which may concern persons such as prospects or contacts, it is a processor and this agreement applies.

In Escouade hub, installed on the Customer’s own server, the Publisher receives, by design, no personal data. This agreement only applies there to an intervention the Customer requests in writing, limited in time and logged, during which the Publisher accesses its data.

Annex: security measures

Hosting: a dedicated server in France, at Scaleway, whose firewall only accepts web traffic from Cloudflare, and Scaleway’s object storage in Paris for the documents of paid workspaces. Communications: encrypted with TLS.

Database: each workspace is isolated by a row-level security policy that the database enforces on the application; mailbox connection tokens and API keys are encrypted.

Access: role-based, set by the Customer; two-factor authentication offered on the account; fourteen-day sessions; an operations log. Administration: reserved to the Publisher.

Backup: every day, verified, kept for fourteen days. AI: named providers, hosted in Europe by default; OCR and vectorisation run on the Publisher’s server.