Data Processing Agreement (DPA) — AI4PLAN

In force from 27 August 2026

Translation provided for information only. This Data Processing Agreement is drafted in French. Only the French version is legally binding (T&Cs, art. 1).

1. Parties

Controller

The Customer, as defined in the Terms and Conditions of Sale (T&Cs).

Processor

AI4PLAN SAS – SIRET: 847 604 873 00020 8B rue Michelet, 92150 Suresnes rgpd@ai4plan.com

2. Purpose and duration

This DPA frames the processing carried out by AI4PLAN on behalf of the Customer, in accordance with article 28 of the GDPR and within the limits set by the T&Cs, which prevail in the event of conflict — without that precedence being capable of defeating the mandatory obligations arising under the GDPR.

Duration: identical to the main contract.

3. Purposes of the processing

AI4PLAN processes the data solely for:

• the performance of the AI4PLAN SaaS service;
• the technical processing of imported files;
• the generation of the Outputs;
• support, maintenance and incident resolution;
• technical monitoring, security and abuse prevention;
• technical logging.

Any additional purpose requires an instruction complying with the T&Cs.

Anonymisation. AI4PLAN may anonymise the data processed on behalf of the Customer. Data so anonymised, which no longer permits a natural person to be identified, ceases to be personal data and falls outside the scope of this DPA; its use is governed by article 10.5 of the T&Cs, in particular for the purposes of improving AI4PLAN’s Software and algorithms.

4. Categories of data

• business identification data;
• technical logs and access logs;
• metadata;
• data contained in imported files.

Special categories of data. The Service is not designed for the processing of the special categories of data referred to in article 9 of the GDPR, nor of data relating to criminal convictions and offences referred to in article 10. AI4PLAN has neither the capacity nor the means to identify them within imported files.

A Customer who introduces such data into the Service remains solely responsible for it: it is for that Customer to have a valid legal basis, to have carried out, where applicable, the required impact assessment, and to inform AI4PLAN beforehand so that appropriate protective measures may be considered. The consequences of an unreported introduction fall under article 14.

5. Data subjects

• the Customer’s employees;
• the Customer’s partners or contributors;
• any person appearing in imported files.

6. Obligations of the Processor (AI4PLAN)

AI4PLAN undertakes to:

1. process the data in accordance with written instructions complying with the T&Cs;
2. refuse any instruction that is unlawful, impossible or not contractually covered;
3. restrict access to authorised persons alone, and ensure that they are bound by an obligation of confidentiality, contractual or statutory, covering the data processed;
4. implement the security measures set out in this DPA;
5. document the compliance of the processing.

Any request going beyond the contractual perimeter may require a quotation or an amendment, in accordance with the T&Cs.

7. Sub-processors

AI4PLAN may have recourse to processors falling within the following categories:

• cloud hosting;
• technical monitoring;
• storage and backup;
• transactional emailing;
• support and ticketing;
• IT security;
• conversational agent made available within the Service.

The Customer gives AI4PLAN a general authorisation to have recourse to sub-processors falling within these categories. The list of names in force is communicated on request.

AI4PLAN contractually imposes on each of its sub-processors data protection obligations equivalent to those of this DPA, and remains fully liable to the Customer for the performance of their obligations.

AI4PLAN informs the Customer of any addition or replacement of a sub-processor, at least thirty (30) days before it is implemented. The Customer may object in writing, giving reasons, within that period; failing a reasonable alternative solution, either party may then terminate the Subscription on the terms of article 6 of the T&Cs. The Customer acknowledges that an objection may limit all or part of the Service’s functionality.

8. Security of processing

AI4PLAN applies:

• encryption of communications;
• segregation of environments;
• access management on a least-privilege basis;
• backups;
• monitoring and alerting;
• hardening of environments.

The Customer remains responsible for:

• the security of its workstations and access rights;
• the management of its user accounts;
• its own internal configurations.

These obligations are complementary to the undertakings of the T&Cs and the ToU.

9. Notification of breaches

AI4PLAN shall notify the Customer of any personal data breach concerning it, without undue delay after becoming aware of it, in accordance with article 11.8 of the T&Cs.

The notification describes the nature of the breach, the categories and approximate volume of data and of data subjects concerned, the likely consequences, and the measures taken or proposed to remedy it. Where such information cannot be provided at the outset, it is communicated in phases as it becomes available.

AI4PLAN provides the Customer with the reasonable assistance necessary for the discharge of its own obligations under articles 33 and 34 of the GDPR.

10. GDPR assistance

AI4PLAN provides reasonable assistance concerning:

• data subjects’ rights;
• impact assessments.

Any additional or exceptional assistance may be charged for on the terms provided for in the T&Cs.

AI4PLAN does not warrant the Customer’s GDPR compliance.

11. Audits

AI4PLAN makes available to the Customer the information necessary to demonstrate compliance with the obligations laid down in article 28 of the GDPR.

The Customer may have an audit carried out, by itself or by an independent auditor it appoints and who is not a competitor of AI4PLAN, on the following conditions:

• the request is made in writing with at least thirty (30) days’ notice;
• the audit takes place during working hours, without disrupting operation of the Service, and no more than once a year, save in the event of an established security incident or an order from a supervisory authority;
• the auditor is bound by an obligation of confidentiality;
• AI4PLAN may satisfy the request by communicating existing audit reports, certifications or attestations, where these cover the perimeter concerned;
• intrusive audits, in particular penetration tests and direct access to systems, require AI4PLAN’s prior written agreement and may be refused on grounds of security or of confidentiality towards its other customers.

The costs of the audit are borne by the Customer. Time devoted by AI4PLAN beyond reasonable assistance may be charged for on the terms of article 10.

12. Transfers outside the EU

The Customer’s data — imported files, Outputs, accounts and application logs — is hosted in a European Union region of AI4PLAN’s infrastructure provider.

Certain technical resources necessary to the delivery of the Service, in particular those attached to the content delivery network, are administered from a region located in the United States, and that network serves content from points of presence distributed worldwide. The resulting access logs may contain technical data such as IP addresses.

Such processing and transfers are framed by the data processing agreement entered into by AI4PLAN with its infrastructure provider, which incorporates the standard contractual clauses approved by the European Commission, supplemented by appropriate additional technical measures.

The conversational agent made available within the Service is supplied by a provider established in Canada. Exchanges addressed to it are processed by that provider in its capacity as sub-processor, under a data processing agreement incorporating the standard contractual clauses approved by the European Commission.

The Customer acknowledges that these transfers are necessary to the performance of the Service.

13. End of contract

On termination of the Agreement, AI4PLAN shall, at the Customer’s choice, return or delete the data processed on its behalf, within the periods and in accordance with the arrangements provided for in article 6.4 of the T&Cs.

Failing a choice expressed by the Customer within the period set therein, the data is deleted.

AI4PLAN may retain pseudonymised technical logs for security and evidential purposes, together with data whose retention is required of it by its legal, accounting and tax obligations.

14. Obligations of the Customer

The Customer warrants:

• the lawfulness of the data imported and the existence of a legal basis for its processing;
• compliance with the obligations incumbent on it in the event of the introduction of special categories of data, on the terms of article 4;
• the security of its own environment;
• the absence of unlawful use or use not complying with the service.

The Customer shall indemnify AI4PLAN for any damage resulting from:

• unlawful or illicit data;
• the unreported introduction of special categories of data;
• a breach attributable to the Customer;
• non-compliant use.

These obligations supplement those provided for in the T&Cs and the ToU.

15. Liability

As between the parties, AI4PLAN’s liability under this DPA is aligned with the regime and the caps of article 9 of the T&Cs, with no specific additional limitation.

This stipulation is without effect on the right of data subjects to obtain compensation from the controller or the processor on the terms of article 82 of the GDPR, nor on penalties imposed by a supervisory authority.

16. Contractual hierarchy

In the event of conflict between the contractual documents, the order of precedence is that set out in article 1 of the T&Cs: the T&Cs, then the special conditions agreed in writing, then this DPA, then the ToU, then the SLA.

This DPA supplements the T&Cs as regards matters relating to the processing of personal data.

17. GDPR contact

rgpd@ai4plan.com

18. Conclusion of the Agreement

This DPA is drawn up in writing in electronic form, in accordance with article 28(9) of the GDPR. It forms a component of the Agreement and is accepted by the Customer at the same time as the T&Cs, on the terms and in accordance with the evidential arrangements provided for in article 1 thereof.

No handwritten signature is required. AI4PLAN may nevertheless, at the Customer’s request, draw up a signed copy of this DPA.

The Parties acknowledge that this DPA supplements the T&Cs and applies within the limits they define.