Data Processing Agreement
Introduction
This agreement governs the processing of personal data by revzper SAS (processor) on behalf of the customer (controller).
1. Scope and Instructions
The processor shall process personal data only on written instructions provided via a secure channel and recorded in the controller's processing records. revzper SAS shall confirm receipt of instructions and document all compliance actions taken in response. The processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality. The processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The processor shall assist the controller in ensuring compliance with obligations.
2. Source Code and Repository Metadata
Where the controller submits them for analysis, the personal data processed under this Agreement include source code and repository metadata: file paths, commit subjects, dates and counts, and configuration lines, which may identify the controller's contributors, and the names, process numbers and start times of programs running on the controller's computers.
Ref: GDPR Art. 28(3)
3. No Training on Personal Data
revzper SAS does not use personal data processed under this Agreement to train or fine-tune AI models. Fine-tuning a model for the controller requires a separate written agreement with the controller and is carried out only on data the controller has explicitly designated for that purpose. The only exception is feedback a user sends through an application after ticking, for that feedback, a separate box that is unticked every time and never ticked for the user. revzper SAS then processes that feedback as a controller, on the basis of the user's consent: it removes the secrets and the data identifying a person before the feedback joins a dataset; it uses that dataset only to test, train and fine-tune the AI models that serve the platform's features for all users, never a model built for another customer; it may have the training carried out by an AI provider in the European Union acting as its processor, under a contract that forbids that provider to use the dataset for itself; and it keeps each item for at most one year. The controller remains responsible for its users being entitled to share the content they attach to their feedback.
Ref: GDPR Art. 28(3)(a), GDPR Art. 28(10)
4. Post-Termination Actions
Upon termination of this Agreement or the controller's instructions, revzper SAS shall:
Default Actions
- Delete all personal data within 30 days of termination, unless otherwise instructed in writing by the controller.
- Return all personal data to the controller in a structured, commonly used, and machine-readable format, if requested in writing by the controller within 15 days of termination.
- Provide written certification to the controller confirming the completion of deletion or return, including the date and method of action.
- Allow the controller to verify compliance with this clause upon reasonable request.
Additional Obligations
- revzper SAS shall not retain any personal data beyond the completion of the above actions unless required by law.
Processing Location and Sub-processors
All processing of personal data under this Agreement takes place within the European Union. Personal data is hosted in France (Paris region) by Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France. Payment data is processed by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, as an independent controller under its own terms. AI features are processed by Microsoft Ireland Operations Limited, Dublin, Ireland (Microsoft Foundry, Azure OpenAI Service, European Union data zone deployments on a resource in France) and by Mistral AI SAS, 15 rue des Halles, 75001 Paris, France (La Plateforme, data hosted in the European Union), as sub-processors. An AI provider configured at the controller's request is named to that controller before use. revzper SAS informs the controller before engaging any other sub-processor.
2. AI Providers and Models Chosen by the Controller
Where the controller, or a user acting for it, has an AI feature served by an AI provider configured with the controller's or the user's own account, or by a model running on the controller's own equipment, that provider or model is engaged by the controller and is not a sub-processor of revzper SAS; revzper SAS at most passes the requests to it. The controller is responsible for that choice, for its agreement with that provider and for the lawfulness of the resulting transfer of personal data, whatever the role in the service of the user who made it, including creator or administrator.
Ref: GDPR Art. 24, GDPR Art. 28(2)