Treflex – Data Processing Agreement (Art. 28 GDPR) and TOMs (DRAFT v0.2, 2026-10-07)

Part A – Data processing agreement

Parties: the Customer (controller) and [Provider] (processor).

1. Subject, nature and duration: provision of the Treflex Service (storing and processing colour QC data, photos, records and user accounts) for the duration of the main contract.
2. Categories of data subjects: the Customer's employees and other users. Categories of personal data: names, work emails, roles, login and activity data (audit log), and any personal data contained in notes or photos entered by the Customer. No special categories of personal data are intended; the Customer will not enter them.
3. Instructions: we process the data only on the Customer's documented instructions (the contract and use of the Service). We tell the Customer if we think an instruction violates data protection law.
4. Confidentiality: persons authorised to process are bound to confidentiality.
5. Security: we implement the measures in Part B and review them regularly.
6. Sub-processors: the Customer authorises: Supabase [entity] (database, auth, storage; data stored in the EU, Ireland, eu-west-1), IONOS [entity] (hosting of the app files; data centre in France), Resend [entity] (email sending; EU region Ireland, eu-west-1). We inform the Customer of intended changes [30] days in advance; the Customer may object on reasonable grounds. We impose the same obligations on sub-processors.
7. Assistance: we help the Customer with data subject requests, security, breach notification, impact assessments and consultation with authorities, as far as reasonable, [at no charge / at cost].
8. Breach notification: we notify the Customer without undue delay, in any case within [48] hours after becoming aware of a personal data breach, with the information we have.
9. Return and deletion: at the end of the contract the Customer can export its data; afterwards we delete it as set out in the terms, unless law requires retention.
10. Audits: the Customer may verify compliance, primarily through documentation and certifications of our providers; on-site audits with [30] days' notice, during business hours, without disruption, and subject to confidentiality.
11. Transfers outside the EU/EEA only with a lawful safeguard (see Privacy Policy section 5).
12. Liability: according to Article 82 GDPR and the main contract. Governing law: French law; courts as in the main contract.

Part B – Technical and organisational measures (TOMs)

Confidentiality
- Access control to the application by individual login; roles (operator, moderator, admin) with different rights.
- Tenant separation: database row-level security restricts every query to the user's own company; photo storage separated per company folder and private, accessed via short-lived signed links.
- Passwords: minimum 10 characters with lowercase, uppercase and digits, stored hashed by the authentication service; [multi-factor authentication for administrators: planned/available].
- Administrative access to our infrastructure restricted to authorised persons, protected with [2FA].
- Encryption in transit (TLS/HTTPS) and at rest (provider disk encryption).

Integrity
- Audit log of relevant actions (who, what, when).
- Role changes restricted to administrators and enforced in the database.
- Input validation in the app and database constraints.

Availability and resilience
- Hosted at providers with redundant infrastructure; [automatic database backups with __ days retention]; [documented restore test on __].
- Export functions allow customers to keep their own copies.
- Monitoring of errors via application logs and in-app problem reports.

Procedures
- Data protection and security responsibilities: [name/role].
- Incident response: detection, assessment, customer notification within [48] hours, documentation.
- Review of access rights and provider list at least [yearly].
- Careful change handling: tested releases, ability to restore the previous app version.
- Deletion process at contract end (see terms).

Organisational
- Confidentiality obligations for staff and contractors; need-to-know access.
- Provider selection with data processing agreements and security documentation.