Annex B: data processing agreement (GDPR, Article 28)
This agreement covers the personal data the customer places on their Rikochi services, such as their players' accounts or their website's visitors and customers. For this data, the customer is the controller and Olywan SAS acts as processor. It forms part of these terms and applies for the whole term of the contract.
1. Subject of the processing
Olywan hosts, stores and backs up the customer's data and runs the services technically. Olywan does not look at this data or use it for any other purpose.
2. Data and data subjects
The customer alone decides what data they host. It usually includes usernames, nicknames, email and IP addresses, messages and order data about their players, visitors, customers or members. The customer agrees not to host sensitive data without suitable safeguards.
3. Customer instructions
Olywan processes the data only on the customer's documented instructions: these terms and the settings the customer makes in their client area and panel. Olywan tells the customer if an instruction seems to breach the GDPR.
4. Confidentiality
Only authorised Olywan staff can access the services, and only when necessary, for example for work the customer asked for. They are bound by confidentiality.
5. Security
Olywan applies measures suited to the risk: restricted access, encrypted connections, separation between customers' services, DDoS protection and backups. The customer remains responsible for the security of what they install and configure: passwords, plugins, scripts and access rights.
6. Sub-processors
The customer authorises Olywan to use sub-processors for its infrastructure. Current list:
OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: dedicated servers located in France.
Olywan imposes the same data protection obligations on them. It notifies the customer by email at least 30 days before any addition or change; the customer may object by cancelling at no cost before then.
7. Location
The data is hosted in France. Olywan does not transfer it outside the European Union.
8. Assistance to the customer
The customer handles their users' requests (access, correction, erasure) with the tools in their panel. If someone contacts Olywan directly, Olywan forwards the request to the customer. Olywan also helps the customer, as far as possible, with impact assessments and dealings with the CNIL.
9. Data breach
If Olywan finds a breach affecting the customer's data, it notifies the customer by email without undue delay and within 48 hours of becoming aware of it, with the information needed for any notification to the CNIL and to the people affected.
10. End of contract
The customer can retrieve their data for up to 10 days after the due date, from their panel or via SFTP. Olywan then deletes the data, and its backups as they rotate out, unless the law requires it to keep them.
11. Audits
Olywan makes available to the customer the information needed to show compliance with this agreement. The customer may request an audit at their own cost, with 30 days' notice and without access to other customers' data.
12. Customer obligations
The customer warrants that they are entitled to process the data they host, that they inform the people concerned and that they comply with the GDPR in their own use.