DPA / GDPR

Data Processing Agreement — Winstory

ARTICLE 1 — PARTIES AND ROLE

This agreement applies where the professional customer is controller and Winstory processes data on its behalf, on documented instructions. It does not cover processing for which Winstory itself is controller, including billing, platform security and proof of acceptance. Winstory is not processor for all data. That processing is not covered by this agreement alone.

ARTICLE 2 — SUBJECT MATTER

The subject matter is performance of the Campaign and of the services ordered: hosting of content provided, routing of requested generations, and related support. The duration is that of the contract, then the periods for return or deletion.

ARTICLE 3 — INSTRUCTIONS

Winstory processes only on the customer’s documented instructions, including for transfers, except where the law requires otherwise. It informs the customer if an instruction appears unlawful, and may suspend the contested instruction.

ARTICLE 4 — CONFIDENTIALITY

Persons authorised to process are bound by confidentiality. That obligation survives the end of their task.

ARTICLE 5 — SECURITY

Winstory applies proportionate technical and organisational measures: access control, encryption in transit where the channel allows it, logging, backups and logical separation of Campaigns. Detail is in the measures annex. It is not presented as an exhaustive certified catalogue.

ARTICLE 6 — SUBPROCESSORS

The customer authorises the further subprocessors needed for the service, including hosting, the database and the AI providers actually used for its instructions. The list published with the contract is not stated to be complete beyond those categories. Winstory informs of a significant change and allows the customer to object on a legitimate ground related to data protection. Winstory imposes equivalent obligations on the subprocessor.

ARTICLE 7 — ASSISTANCE TO DATA SUBJECTS

Taking into account the nature of the processing, Winstory assists the customer in responding to data subjects, by appropriate technical measures, within a time compatible with the customer’s deadline.

ARTICLE 8 — BREACH

Winstory notifies the customer of a personal-data breach of which it becomes aware, without undue delay, with the information it has so that the customer can notify the authority and the persons if the law requires it.

ARTICLE 9 — DPIA

Winstory assists the customer, to the extent of the service, with a data-protection impact assessment (DPIA) or a prior consultation, by providing information on the processing it carries out. The assessment remains the controller’s.

ARTICLE 10 — DELETION AND RETURN

At the end, Winstory, at the customer’s choice, returns or deletes the data processed on its behalf, then destroys copies, except where the law requires retention. Backups expire on their cycle.

ARTICLE 11 — AUDIT

The customer may audit compliance with this agreement, at most once a year except after an incident, on reasonable notice, itself or by an independent auditor bound by secrecy, without access to other customers’ data. Winstory may substitute a relevant audit report.

ARTICLE 12 — TRANSFERS

If a subprocessor is outside the European Economic Area, the transfer relies on an adequacy decision or on clauses that bind that subprocessor, where that mechanism exists for it. Winstory does not state that all data remain in the European Union.

ARTICLE 13 — CATEGORIES

The data are those the customer or participants provide for the Campaign: professional identity, brief, content, prompts requested by the customer. The persons are the customer’s contacts and the participants the customer causes to be processed.

ARTICLE 14 — MINORS

The customer does not request processing of minors’ data without a legal basis. Winstory may refuse that instruction.

ARTICLE 15 — LOCATION

Places of processing depend on the subprocessors used for the Campaign. They are stated to the customer on request, within the information held.

ARTICLE 16 — LIABILITY

Each party is liable for its obligations under the general data protection regulation. The cap in the professional terms does not limit what that regulation forbids to limit.

ARTICLE 17 — WISTORY’S OWN DATA

Security logs and payment evidence for which Winstory is controller are not returned as if they were the customer’s data, subject to the rights of persons.

ARTICLE 18 — COOPERATION WITH THE AUTHORITY

Winstory cooperates with the competent authority at the customer’s request or where the law obliges it directly.

ARTICLE 19 — SEVERABILITY

If a clause is contrary to the regulation, it is replaced by the rule of that regulation. The rest stands.

ARTICLE 20 — LAW

French law applies, without setting aside the European regulation. The courts of Paris have jurisdiction between professionals.

ARTICLE 21 — TERM OF THE AGREEMENT

The agreement follows the service contract. Obligations of confidentiality, deletion and liability for facts that have arisen survive.

ARTICLE 22 — ORDER

If there is a conflict about processing on the customer’s behalf, this agreement prevails over the commercial terms. It does not prevail over the law.

ANNEX — MEASURES

Access control, authentication, encryption in transit where the channel allows it, logging, backups and separation of Campaign environments. These measures are proportionate to the service and may evolve without a substantial reduction in level.

ANNEX — DETAILED CATEGORIES

Professional identity data, contact details, brief, files provided, prompts requested by the customer, technical generation metadata. Persons: the customer’s contacts and participants covered by the instruction. No special-category data is processed on the customer’s behalf except under an express and lawful instruction.

ANNEX — SUBPROCESSORS

Categories used according to the service ordered: HTTP hosting, database and storage, payment where the customer uses it through the platform, AI providers actually called. The exact identity is communicated with the customer’s contract file. This annex does not claim to list a closed register beyond those categories.