In short
- This agreement applies automatically to Business customers (short-let managers, agents, advisers) who enter personal data about their own clients in Airbopti, for example a name on a PDF memo.
- For that data, you are the controller and we are your processor under article 28 GDPR.
- It is part of the terms: no signature is needed. If you need a signed copy, email legal@airbopti.celarli.com.
The French version of this agreement prevails in case of discrepancy.
1. Parties
- The Customer: the Business customer holding the Airbopti account, acting as controller.
- The Processor: [to be completed], [to be completed] ([to be completed]), publisher of Airbopti.
2. Subject matter and duration
The Processor processes the data described below only to provide the Airbopti service to the Customer, for the whole subscription, and then for the time needed to delete it (section 9).
3. Description of the processing
| Item | Details |
|---|---|
| Nature of the operations | Hosting, storage, viewing, analysis calculations, PDF memo generation, link sharing at the Customer's request, backup, deletion |
| Purpose | Let the Customer analyse properties and prepare memos for their own clients |
| Data subjects | The Customer's clients and prospects |
| Personal data | Name of the Customer's client, the Customer's company name, notes entered, financing details entered (down payment, term, rate, tax bracket) |
| Special-category data | None. The Customer agrees not to enter any |
4. Customer instructions
The Processor processes the data only on the Customer's documented instructions. These instructions are the terms, this agreement and the Customer's use of the service's features. If an instruction appears to breach the GDPR, the Processor informs the Customer without delay.
5. Confidentiality and security
- People authorised to access the data are bound by confidentiality and only access it as their work requires.
- The Processor implements the technical and organisational measures listed in the appendix to ensure security appropriate to the risk (article 32 GDPR).
6. Sub-processors
The Customer gives general authorisation to use the sub-processors listed in the privacy policy (hosting, Google Cloud, Stripe, Twilio, Mailjet). The Processor imposes data protection obligations on each of them at least equivalent to this agreement.
The Processor informs the Customer by email of any addition or replacement at least 30 days in advance. The Customer may object on legitimate data protection grounds; failing agreement, the Customer may cancel the subscription free of charge before the change.
7. Transfers outside the European Union
Where a sub-processor processes data outside the European Union, the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
8. Assistance to the Customer
The Processor helps the Customer, as far as possible:
- to answer data subject requests: the Customer can edit, export and delete the data from the account; any request received directly by the Processor is forwarded without delay;
- to keep the processing secure and, where needed, carry out a data protection impact assessment;
- in case of a personal data breach: the Processor notifies the Customer within 48 hours of becoming aware of it, with the information available so the Customer can notify the CNIL and, where relevant, the data subjects.
9. End of the contract
The Customer can export their data at any time from the account. When the account is deleted, or at the end of the periods set out in the privacy policy, the data is deleted; encrypted backups are erased within 30 days. The Processor keeps no copy, unless the law requires it.
10. Audits
The Processor makes available to the Customer the information needed to show compliance with this agreement. The Customer may have an audit carried out, at most once a year and at its own cost, with 30 days' notice, by an independent auditor bound by confidentiality, without disrupting the service or compromising other customers' security.
11. Liability and governing law
The parties' liability is governed by the terms. This agreement is governed by French law.
Appendix: security measures
- Encrypted connections (HTTPS/TLS) and secure cookies.
- Sign-in with a Google account, with no password stored by Airbopti; SMS verification available.
- Long random access tokens (API, extension), regenerable by the user at any time; encrypted sign-in cookie.
- Access to Google Cloud services through workload identity federation, with no service key stored on servers.
- Data separated by account, with an ownership check on every access.
- Limited, logged administrator access with read-only viewing.
- Encrypted backups, kept for 30 days.
- Rate limiting on exposed interfaces.
- Automatic deletion according to the published retention periods.