Accord de traitement des données

1. Parties, scope and status

This Data processing agreement (DPA) describes the terms for KHALED AL HARAZI trading as KDPika, SIREN 899816219, 11 AVENUE ARISTIDE BRIAND, 69190 SAINT-FONS, France, to process personal data on the instructions of the developer or organization operating a KDPika workspace (the Customer). Contact: hi@kdpika.com. It applies to licensing data for which the Customer is controller or a duly authorized processor. KDPika is processor or subprocessor for that data. KDPika's own account administration, accounting and security-controller activities are described separately in the Privacy notice.

Before launch: this DPA and its provider/transfer annex must be reviewed, completed and made contractually binding as part of the service agreement. Public display of a draft alone is not execution of an Article 28 agreement, a transfer mechanism or a compliance certification.

2. Processing description and instructions

Subject and duration: hosting and operating software-license issuance, activation, validation, entitlement and device-management records during the subscription and a justified return/deletion period. Processing includes receiving, storing, organizing, retrieving, transmitting within authorized workflows, securing, exporting, restricting and deleting records.

Data subjects: the Customer's application users, buyers, business contacts and authorized personnel. Data categories: contact identifiers, optional customer/company/country references, licensing and feature-entitlement records, device-identifier hashes, device labels, operating-system/application metadata, activation events and related technical logs. Special-category data and criminal-conviction data are not intended for this service and must not be uploaded without a separately agreed lawful arrangement.

Documented instructions consist of this agreement, lawful workspace configuration and API operations, and additional written instructions accepted by KDPika. KDPika processes data only on those instructions, including transfers, unless required by applicable law. In that case, it informs the Customer before processing unless legally prohibited. If an instruction appears to infringe data-protection law, KDPika informs the Customer and may pause the affected processing pending clarification. The Customer must ensure its own lawful basis, notices and authority to instruct processing.

3. Confidentiality and security

People authorized to process data must be bound by confidentiality obligations and receive access only as needed. KDPika applies risk-appropriate technical and organizational measures and reviews them as risks and the service change. Measures include authenticated workspace isolation, access roles, password hashing, protected secrets, TLS, request validation, rate limiting, audit records, maintained software and incident-response procedures. Sensitive API credentials must not be exposed in customer applications.

Before launch, the security annex must also confirm operational backup/restore schedules, access review, monitoring, deletion procedures and provider safeguards. No independent audit report, particular hosting region or recovery-time guarantee is implied where not verified. Changes must not materially reduce the agreed protection without appropriate assessment and contractual handling.

4. Subprocessors

The Customer grants general written authorization only for the providers listed in the completed Service providers annex for relevant processing. KDPika must impose materially equivalent data-protection obligations on each subprocessor and remains responsible for its processor obligations under applicable law. A payment provider acting as independent controller is not automatically a licensing-data subprocessor.

KDPika will give advance notice of an intended addition or replacement, including the provider, processing and location, allowing at least 30 days for a reasoned data-protection objection except where an urgent protective change justifies a shorter period. The parties will seek a safe alternative or resolution; if none is reasonably available, the affected service may be terminated with appropriate treatment of unused prepaid fees. No draft or incomplete annex is treated as approval of unknown transfers.

5. Assistance and data-subject requests

Taking account of the processing and information available, KDPika assists the Customer with access, rectification, erasure, restriction, portability and objection requests, security duties, impact assessments and prior consultation. Where a request relates to Customer-controlled data, KDPika forwards it to the Customer or directs the requester appropriately, unless law requires another response. KDPika does not independently change the Customer's legal basis or decide unrelated rights requests.

The Customer should identify the workspace, relevant records and lawful action requested without supplying unnecessary personal information. Standard export and request tools may be used; non-standard assistance can be scoped and priced reasonably in advance, but charges must not obstruct mandatory obligations.

6. Personal-data breaches

KDPika will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the processed data. Available information will describe the nature of the incident, affected categories and approximate scale where known, likely consequences, protective actions and a contact point. Information may be supplied in stages as investigation proceeds. KDPika cooperates on containment, remediation and notifications; the Customer remains responsible for controller notifications where applicable. KDPika will not delay initial notice solely to await a complete investigation.

7. International transfers

KDPika must not initiate a restricted international transfer without documented instructions and a valid Chapter V mechanism, including appropriate supplementary measures where needed. Where standard contractual clauses are required, the correct parties, modules and annexes must be completed and incorporated. An Article 28 DPA is not itself an international-transfer authorization. Provider contract entities, processing locations and onward-access arrangements must be verified in the annex before live use.

8. Return, deletion and legally required retention

On termination, the Customer may request return of its processed data in an available structured export and deletion of remaining copies, subject to legal retention duties. Instructions and export arrangements should be agreed before access ends. Unless a different lawful arrangement is agreed, KDPika will arrange return or deletion within 30 days of the completed instruction and explain any justified exception. Backups must expire under a documented restricted-access rotation and must not be reused for ordinary processing; restored copies must respect prior deletion instructions.

Before launch: establish the actual backup expiry and end-of-contract deletion procedure. Account deactivation alone is not deletion of all related records. Where law requires retention, KDPika identifies the relevant category and basis, restricts use and deletes when the obligation ends. KDPika may retain its own accounting records as controller under the Privacy notice.

9. Evidence and audits

KDPika will make available information reasonably necessary to demonstrate these obligations and contribute to proportionate audits, including inspections by the Customer or an independent auditor bound by confidentiality. The parties coordinate scope and timing to protect other customers, security and service continuity. Existing relevant evidence may be used first but does not remove a mandatory audit right. No audit may authorize unauthorized access to other workspaces or destructive testing. Regulatory investigations and urgent justified concerns receive appropriate priority.

10. Priority and contact

These processing terms prevail over conflicting general service wording for processor duties; mandatory law and any applicable signed transfer clauses prevail. Liability and remedies remain subject to applicable law and cannot nullify required data-protection obligations. Changes require appropriate documentation and notice. Send instructions, provider objections, breach queries and requests for a completed signed version to hi@kdpika.com.