Data Processing Agreement (DPA)

This agreement governs the processing of personal data carried out by METEORA, publisher of Brandesk, on behalf of its customers, in accordance with Article 28 of Regulation (EU) 2016/679 (“GDPR”).

Version

1.0

Effective date

October 22, 2026

This translation is provided for information. In case of discrepancy, the French version prevails.

Parties

The Customer: the legal entity that has subscribed to Brandesk, acting as controller.

METEORA, a SARL (French limited liability company) with share capital of €500, registered with the Annecy Trade and Companies Register (RCS) under number 807 875 315, publisher of Brandesk, acting as processor.

This agreement forms an integral part of the Brandesk general terms and conditions (the “Contract”). In the event of a conflict on a matter relating to data protection, it prevails over the Contract.

1. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in Article 4 of the GDPR. In addition:

• Service: the Brandesk platform (email signatures, digital business cards, NFC cards, lead capture, campaigns, analytics) available at app.brandesk.io.
• Employees: the persons whose profile is created in the Service by the Customer, through directory sync, SCIM provisioning, CSV import or manual entry.
• Contacts: the persons who leave their contact details through the “Exchange contact details” form of a digital card.
• Sub-processor: any service provider to which METEORA entrusts all or part of the processing.

2. Purpose and term

METEORA processes the personal data described in Article 3 solely to provide the Service to the Customer. This agreement applies for the entire term of the Contract and thereafter until the data is deleted under the conditions of Article 12.

3. Description of the processing

4. Customer obligations

• The Customer documents its instructions, which consist of the Contract, this agreement and the configuration of the Service (synced fields, fields editable by Employees, assignment rules, CRM connection, webhooks, analytics retention period).
• The Customer has a legal basis for each processing operation and informs Employees of the processing of their data.
• The Customer drafts the consent text presented to Contacts and ensures that it is compliant.
• The Customer ensures the security of its own access (account management, two-factor authentication, SSO).

5. METEORA's obligations

METEORA undertakes to:

• process the data only on documented instructions from the Customer, including with regard to transfers, and to inform the Customer immediately if, in its opinion, an instruction infringes the GDPR;
• not use the data for any other purpose, in particular commercial purposes, and not sell or rent it;
• ensure that persons authorized to process the data are bound by a duty of confidentiality;
• implement the security measures described in Appendix 1;
• assist the Customer in complying with its obligations (data subject rights, security, breach notification, impact assessment);
• maintain a record of the processing activities carried out on behalf of its customers (Article 30(2) of the GDPR).

6. Security

METEORA implements technical and organizational measures appropriate to the risk, described in Appendix 1. These measures may change, provided that the overall level of protection is not reduced.

7. Sub-processors

The Customer authorizes METEORA to engage the sub-processors listed in Appendix 2. METEORA contractually imposes on each of them data protection obligations equivalent to those of this agreement, and remains liable to the Customer for their performance.

METEORA informs the Customer of any addition or replacement at least 30 days in advance. The Customer may object on legitimate data protection grounds; if no solution is found, the Customer may terminate the affected Service without penalty.

8. Location and transfers

The Service's data is hosted in France. METEORA does not transfer data outside the European Union, except where a sub-processor listed in Appendix 2 provides for it; any such transfer is then governed by an adequacy decision or by the European Commission's Standard Contractual Clauses.

Third-party services connected by the Customer (Google Workspace, Microsoft 365, SSO or SCIM identity provider, HubSpot, Salesforce, Pipedrive, webhook recipients) are chosen and contracted by the Customer. Exchanges with these services take place on the Customer's instructions and are governed by its own contracts.

9. Data subject rights

The Service allows the Customer to export and delete the data of an Employee or a Contact. If a person contacts METEORA directly, METEORA forwards the request to the Customer within 5 business days and does not act on it without the Customer's instructions.

10. Data breaches

METEORA notifies the Customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, at the contact address of the account administrator. The notification describes, to the extent possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. The Customer remains solely responsible for notifying the supervisory authority and the data subjects.

11. Impact assessment

At the Customer's request, METEORA provides the information necessary to carry out a data protection impact assessment and, where applicable, the prior consultation of the supervisory authority.

12. Handling of data at the end of the contract

At the end of the Contract, the Customer may export its data for 30 days. METEORA then deletes all of the Customer's personal data within 30 days, unless retention is required by law; backup copies are erased at the end of their rotation cycle, no later than 30 days thereafter. METEORA confirms the deletion in writing upon request.

13. Audit

METEORA makes available to the Customer all information necessary to demonstrate compliance with this agreement. The Customer may have an audit carried out, by itself or by an independent auditor bound by confidentiality, no more than once a year, subject to 30 days' notice, without disrupting the operation of the Service and at its own expense.

14. Liability and governing law

Each party's liability is governed by the Contract and by Article 82 of the GDPR. This agreement is governed by French law. Any dispute falls within the jurisdiction of the competent courts of Annecy.

15. Contact

For any question regarding this agreement or data protection: hello@brandesk.io.

Appendix 1 — Technical and organizational measures

• Encryption in transit: all communications with the Service use HTTPS.
• Encryption of secrets at rest: OAuth tokens, directory and CRM connection credentials, two-factor authentication secrets, SSO and webhook secrets are encrypted (libsodium). Passwords and recovery codes are hashed.
• Data isolation: each request is tied to the user's organization, which is verified on every call; one organization's data is never accessible to another.
• Access control: roles and permissions per organization and per department; two-factor authentication, optionally mandatory; SAML 2.0 and OpenID Connect SSO, optionally mandatory.
• Audit log: administrative actions (employees, signatures, rules, cards, NFC, billing, security) are recorded with their author and an anonymized IP address, and can be viewed and exported by the Customer.
• Abuse protection: rate limiting of login attempts, magic link requests and form submissions; CSRF protection; bot filtering.
• Data minimization: analytics without cookies; the IP address is anonymized and then used only locally to infer the country, without being retained; only the country and device type are recorded. Imported CSV files are deleted after processing.
• Retention: analytics events are automatically deleted after 13 months (configurable period).
• Public pages: digital cards are not indexed by search engines by default. An NFC card contains only a redirect address; it can be deactivated or reported lost at any time, and an Employee who has left is no longer accessible.
• Backups: daily encrypted database backup, retained for 30 days on OVHcloud Object Storage, in France.
• Organization: production access restricted to authorized METEORA personnel, who are bound by confidentiality.

Appendix 2 — Sub-processors

Subscription billing is entrusted to Stripe. METEORA acts as controller solely for the Customer's billing data; no Employee or Contact data is transmitted to Stripe.