Data Processing Agreement (DPA)

Article 1. Purpose, scope and order of precedenceCopy Anchor Link

1.1. Purpose. This data processing agreement (the "DPA") is the contract required by Article 28(3) of Regulation (EU) 2016/679 (the "GDPR"). It governs the processing of personal data carried out by iAdvize SAS ("iAdvize") on behalf of the Customer as part of the AI Shopping Assistant v3 (the "Service").

1.2. Link to the Terms. The DPA forms an integral part of the general terms of use of the Service (the "Terms"), into which it is incorporated by their Article 7.2. It applies to every organization that has accepted the Terms, including during the pilot, from that acceptance and in the absence of any other agreement.

1.3. Exclusions. The DPA does not apply to the processing for which iAdvize is the controller, described in its privacy policy: account management, sign-in and security, security of the change log, product emails and feedback sent from the dashboard.

1.4. Order of precedence. In matters of personal data protection, the DPA prevails over the Terms. The provisions of a separate written agreement, within the meaning of Article 1.1 of the Terms, relating to personal data prevail over the DPA within the limits of their subject matter, as do the special conditions of Article 7.5 of the Terms. None of those provisions may reduce the level of protection required by Article 28 GDPR.

1.5. Applicable version. The applicable version is the one published at iadvize.ai/legal/dpa on the date the Terms were accepted, then any later version that has entered into force in accordance with Article 13.3.

Article 2. DefinitionsCopy Anchor Link

2.1. The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them by Article 4 GDPR. Terms defined in Article 1.1 of the Terms have the same meaning in the DPA.

2.2. In addition:

• "French Data Protection Act": French law no. 78-17 of 6 January 1978, as amended.
• "Customer Data": the personal data processed by iAdvize on behalf of the Customer as part of the Service, described in Annex 1.
• "Sub-processor": any third party to which iAdvize, or one of its Sub-processors, entrusts all or part of the processing of Customer Data.
• "Sub-processors Page": the dated list of Sub-processors published at iadvize.ai/legal/subprocessors.
• "Customer Site": the merchant site or sites on which the Customer installs the assistant.

Article 3. Roles of the PartiesCopy Anchor Link

3.1. For the processing described in Annex 1, the Customer is the controller and iAdvize the processor.

3.2. The Customer determines the purposes of the processing by installing and configuring the assistant on the Customer Site and by using the Service. iAdvize does not process Customer Data for any other purpose.

3.3. Where the Customer itself acts on behalf of another controller, it warrants that it has that controller's authorization; iAdvize is then a sub-processor of the Customer.

Article 4. Documented instructionsCopy Anchor Link

4.1. iAdvize processes Customer Data only on the Customer's documented instructions (Article 28(3)(a) GDPR). Such instructions consist of the Terms, the DPA, the Customer's configuration of the Service and any written request from an administrator of its organization.

4.2. iAdvize immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. It may suspend that instruction until the Customer confirms or amends it.

4.3. Where Union or Member State law requires iAdvize to carry out processing not covered by the instructions, iAdvize informs the Customer before the processing, unless that law prohibits it on important grounds of public interest.

4.4. No training and derived material. iAdvize does not use Customer Data to train artificial intelligence models, whether its own or those of its Sub-processors. Zero data retention and the prohibition on use for training are enabled for every model call, subject to a model provider's retention of requests flagged by its abuse-detection systems. Material derived from Customer Data, within the meaning of Article 6.3 of the Terms, is used only to improve the Customer's assistant; derived material that contains Customer Data or from which it can be reconstructed is deleted with it. The Customer authorizes iAdvize to produce from Customer Data aggregated, anonymized statistics that identify neither the Customer, nor its Shoppers, nor its catalog.

Article 5. Customer obligationsCopy Anchor Link

5.1. Legal basis and information. The Customer warrants that it has a legal basis, within the meaning of Article 6 GDPR, for each processing operation described in Annex 1, and that it informs data subjects in accordance with Articles 13 and 14 GDPR. iAdvize makes available to it a data-use notice for Shoppers, to which the Customer refers in its own privacy policy.

5.2. Consent. The Customer collects, through its consent management tool, the Shoppers' prior consent where the law requires it (Article 82 of the French Data Protection Act). It connects that tool to the objection command documented by iAdvize (integration documentation), so that a Shopper's refusal or withdrawal of consent is honored by the assistant. Attaching orders to sessions or conversations is not implemented as of the version date of the DPA; if it is, it will only take place where a consent signal is sent by that tool, and the DPA will be amended under Article 13.3.

5.3. Sensitive data. The Service is not designed to process data falling under Articles 9 and 10 GDPR. The Customer shall not configure the Service to collect or infer such data. Any derogation requires a separate written agreement and triggers the special conditions of Article 7.5 of the Terms, under which the Customer warrants that it can rely on an exception in Article 9(2) GDPR.

5.4. Transparency. The Customer shall not remove, hide or make illegible the statement informing Shoppers that they are interacting with an AI system (Article 50(1) of Regulation (EU) 2024/1689; Articles 4.2 and 5.6 of the Terms).

Article 6. Confidentiality and securityCopy Anchor Link

6.1. Authorized personnel. iAdvize ensures that the people authorized to process Customer Data have committed to confidentiality or are under a statutory obligation of confidentiality (Article 28(3)(b) GDPR). Access is limited to the people who need it to provide, maintain or secure the Service. Where an authorized iAdvize administrator signs in to the dashboard in place of a User, at the User's request or to investigate a security incident, the session is limited to sixty (60) minutes and logged with the administrator's identity and the stated reason.

6.2. Security measures. iAdvize implements the technical and organizational measures described in Annex 2, appropriate to the risk (Article 32 GDPR). It may change them provided the overall level of security is not reduced.

6.3. Security of the Customer's access. The Customer remains responsible for the security of its own access to the Service, in particular the management of administrator accounts and API keys (Article 3 of the Terms).

Article 7. Sub-processorsCopy Anchor Link

7.1. General authorization. The Customer gives iAdvize a general written authorization to engage the Sub-processors listed on the Sub-processors Page in the version in force on the date the Terms were accepted (Article 28(2) GDPR). For each of them, the page states the service provided, the data processed, the location of the processing and, where applicable, the safeguard for the transfer.

7.2. Chain of sub-processing. iAdvize contractually imposes on each Sub-processor data protection obligations equivalent to those of the DPA (Article 28(4) GDPR). Where a Sub-processor itself works through its own sub-processors, in particular the model and web search providers called through Vercel's AI Gateway, those are identified on the Sub-processors Page and bound by equivalent obligations. iAdvize remains fully liable to the Customer for the performance of their obligations.

7.3. Notice. iAdvize informs the Customer, by email to the administrators of its organization, of any addition or replacement of a Sub-processor at least thirty (30) days before that Sub-processor starts processing, and publishes the dated version of the Sub-processors Page.

7.4. Objection. During that period, the Customer may object to the change, on reasonable data protection grounds, by email to privacy@iadvize.com. The Parties then seek a solution in good faith. Failing agreement before the effective date, the Customer may end the Terms under their Article 10.3, without penalty.

7.5. Urgency. Where the security or continuity of the Service requires it, or to comply with a legal obligation, iAdvize may replace a Sub-processor without waiting for the thirty (30) day period to expire. It then informs the Customer without delay, and the right to object in Article 7.4 runs from that notice.

Article 8. Transfers outside the European Economic AreaCopy Anchor Link

8.1. iAdvize transfers Customer Data outside the European Economic Area only in compliance with Chapter V GDPR: an adequacy decision, including the EU-US Data Privacy Framework for certified entities, the European Commission's standard contractual clauses, or another safeguard under Article 46 GDPR.

8.2. The safeguard applicable to each Sub-processor and the processing that may take place outside the European Union, including the transit of model requests through Vercel's gateway and the retention of requests flagged for abuse, are listed on the Sub-processors Page.

Article 9. Assistance to the CustomerCopy Anchor Link

9.1. Data subject rights. Taking into account the nature of the processing, iAdvize assists the Customer, through appropriate technical and organizational measures, in responding to requests to exercise the rights in Articles 15 to 22 GDPR (Article 28(3)(e) GDPR). Where a data subject contacts iAdvize directly, iAdvize informs the person, forwards the request to the Customer without delay and does not answer it itself, unless the Customer instructs otherwise.

9.2. Security, impact assessment and prior consultation. iAdvize assists the Customer in complying with the obligations in Articles 32 to 36 GDPR, by providing the information it holds about the Service, in particular for a data protection impact assessment (Article 28(3)(f) GDPR).

9.3. AI Act. As provider of the AI system, iAdvize designs the Service so that Shoppers are informed that they are interacting with an AI system (Article 50(1) of Regulation (EU) 2024/1689). On request, it provides the Customer with the information useful for complying with the Customer's own obligations under that regulation.

9.4. Cost. Assistance going beyond providing information and existing documentation may be charged on the basis of a quote accepted in advance, unless it results from a breach by iAdvize.

Article 10. Personal data breachCopy Anchor Link

10.1. iAdvize notifies the Customer of any personal data breach affecting Customer Data without undue delay after becoming aware of it (Article 33(2) GDPR), by email to the administrators of its organization.

10.2. The notification includes, to the extent available, the information required by Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, a contact point, the likely consequences, and the measures taken or proposed. Information not yet available is provided in phases as soon as it becomes available.

10.3. iAdvize takes reasonable measures without delay to contain the breach and limit its effects. It documents the breach and assists the Customer in notifying the supervisory authority and, where applicable, in communicating it to data subjects (Articles 33 and 34 GDPR).

10.4. Notification by iAdvize does not constitute an admission of fault or liability.

Article 11. AuditsCopy Anchor Link

11.1. iAdvize makes available to the Customer the information necessary to demonstrate compliance with the obligations in Article 28 GDPR (Article 28(3)(h) GDPR). The Customer relies first on that information: Service documentation, written answers to a security questionnaire and, where they exist, audit reports or certifications.

11.2. Where that information is insufficient, the Customer may have an audit carried out, by itself or by an independent auditor who is not a competitor of iAdvize and is bound by confidentiality. The audit is notified at least thirty (30) days in advance, together with its scope. It takes place no more than once in any twelve (12) month period, during business hours, without disrupting the Service and without access to other customers' data.

11.3. The annual limit and the notice period do not apply to an audit requested by a supervisory authority or following a data breach affecting Customer Data.

11.4. The audit is at the Customer's expense, unless it reveals a material breach by iAdvize of its obligations. The report is confidential and shared with iAdvize, which remedies the breaches found within a period agreed between the Parties.

11.5. This Article applies whether or not the Customer has entered into another contract with iAdvize. Where a contract in force between the Parties contains an audit clause more favorable to the Customer, that clause applies to the Service.

Article 12. End of the Service: return and deletionCopy Anchor Link

12.1. Return. When the Terms end, for whatever reason, including at the end of the pilot, the Customer may retrieve its conversations through the Service's REST API for three (3) months, using an API key of its organization (Article 10.4 of the Terms).

12.2. Deletion. At the end of that period, iAdvize deletes the Customer Data and the derived material containing it within thirty (30) days. Deleted data may remain for up to thirty-five (35) additional days in the database backups, until they are overwritten.

12.3. Legal retention. The deletions in this Article do not apply to data that Union or Member State law requires to be retained (Article 28(3)(g) GDPR). Such data remains protected by the DPA until it is deleted.

12.4. Certification. On the Customer's written request, iAdvize certifies the deletion in writing.

Article 13. Liability, term, amendment, governing lawCopy Anchor Link

13.1. Liability. Each Party's liability under the DPA is subject to the conditions and limits of Article 9 of the Terms, to the extent permitted by law. Those limits do not affect the rights of data subjects under Article 82 GDPR.

13.2. Term. The DPA applies for as long as iAdvize processes Customer Data, including during the periods set out in Article 12.

13.3. Amendment. iAdvize may amend the DPA under Article 11 of the Terms: notice by email to the administrators of the organization at least thirty (30) days before any significant amendment takes effect, and publication of the dated version. An amendment required by law or by a supervisory authority may take effect within the period they set.

13.4. Governing law and jurisdiction. The DPA is governed by French law. Disputes fall within the jurisdiction of the courts designated in Article 12.8 of the Terms, after the attempt at amicable settlement provided for there.

13.5. Language. The DPA is drawn up in French and English. In the event of any discrepancy, the French version prevails.

Annex 1. Description of the processingCopy Anchor Link

The processing is carried out on behalf of the Customer, from the Customer Site and the Service dashboard, for the term of the Terms plus the periods in Article 12. Data falling under Articles 9 and 10 GDPR is excluded, except under special conditions (Article 5.3).

Processing operations: collection, hosting, analysis, generation of answers by AI models, web search, consultation, return and deletion. The Sub-processors and the location of processing are listed on the Sub-processors Page.

Annex 2. Technical and organizational measuresCopy Anchor Link

Only measures actually in place are described (Articles 28(3)(c) and 32 GDPR). No certification is claimed.