Data Processing Agreement

1. Parties

Controller: the Customer (the entity having subscribed to the ArtGuard Service and deploying the snippet on its Customer Site(s)), hereinafter "Customer".

Processor: DTech Innovations, sole proprietor, SIREN 982 702 052, seat 105 Chemin de Souleyrol, 84570 Malemort-du-Comtat, France, operating under the trade name ArtGuard, hereinafter "ArtGuard".

2. Subject and duration

This DPA governs processing of personal data carried out by ArtGuard on the Customer's behalf for delivering the ArtGuard Service. It runs for the duration of the main contract (ToS/Sales Terms) and remains in force until all data processed on the Customer's behalf is definitively deleted.

3. Description of processing

3.1 Nature and purpose

• Nature: automated detection of AI widgets/chatbots on Customer Sites, display of an AI Act Art. 50-compliant disclosure, and immutable logging of disclosure events as compliance evidence.
• Purpose: assist the Customer's AI Act Art. 50 compliance and proof obligations.

3.2 Data subjects

End Visitors of Customer Sites.

3.3 Categories of data

• SHA-256 hash of the End Visitor's IP (pseudonym)
• Reduced User-Agent (primary browser, major version, platform only)
• Event timestamp (UTC server clock)
• Event type (disclosure_shown, disclosure_acknowledged)
• Page URL (no identifying query parameters)
• Visitor locale (language)

No direct personal data (name, email, identifier) is processed by ArtGuard. If the Customer were to transmit such data via non-standard use, the Customer would be solely responsible.

3.4 Recipients

• Customer's internal administrators via dashboard.
• ArtGuard's personnel (DTech Innovations and any written mandate), strictly to the extent necessary for Service delivery.
• Subprocessors listed in Annex 1, strictly within their technical scope.

4. Processor obligations

ArtGuard undertakes to:

4.1 Documented instructions

Process personal data only on the Customer's documented instructions, as defined by:

• This DPA;
• The Customer's Service configuration (domain creation, disclosure mode/language choice, etc.);
• Any subsequent written instruction sent officially to dtech.innovations@proton.me.

Any processing beyond what is necessary for Service delivery requires the Customer's express instruction.

4.2 Confidentiality

Ensure all persons authorized to process data on the Customer's behalf are under a confidentiality obligation.

4.3 Security

Implement the technical and organizational measures in Annex 2, in compliance with GDPR article 32.

4.4 Sub-processing

• Only use subprocessors listed in Annex 1, accepted by the Customer under this DPA.
• Notify the Customer by email of any change (add/replace/remove) with at least 30 days' notice.
• The Customer has a reasoned objection right to any new subprocessor. If the objection cannot be resolved by discussion, the Customer may terminate the contract without penalty.
• Contractually impose on subprocessors the same obligations as those in this DPA.

4.5 Data subject rights

Assist the Customer, as far as possible, in responding to data subject requests (access, rectification, erasure) within legal deadlines. Assistance is borne by ArtGuard unless the request is exorbitant.

4.6 Breach notification

Notify the Customer without undue delay and at the latest within 48 hours of becoming aware of a personal data breach affecting data processed on the Customer's behalf. This notification is intended to enable the Customer, as controller, to assess the need to notify and proceed with notification to the competent supervisory authority within the 72-hour deadline imposed by GDPR article 33(1), and where applicable to communicate to data subjects under article 34. The notification to the Customer includes, to the extent then known: nature of the breach, categories and approximate number of data subjects, categories and approximate number of records concerned, likely consequences, and measures taken or planned to address the breach and mitigate its adverse effects.

4.7 Compliance assistance

Assist the Customer with GDPR articles 32-36 obligations (security, notification, DPIA, prior consultation), notably by providing relevant technical documentation.

4.8 Return / deletion at end of processing

At end of Service delivery (termination or expiry), at the Customer's choice, ArtGuard:

• returns data in a structured, commonly used format (CSV / JSON / PDF) via the export function;
• deletes data and any existing copies, subject to legal retention obligations.

Deletion deadline: 30 days maximum after end of delivery, excluding data retained for legal proof or accounting.

4.9 Audit

Make available all information necessary to demonstrate compliance with this DPA, and allow audits, including inspections, by the Customer or a mandated independent third-party auditor.

Audit terms:

• Scheduled audit once per year maximum, or upon proven data breach.
• 30 days' minimum notice.
• Audit cost borne by the Customer, except where the audit reveals a substantial breach by ArtGuard, in which case reasonable audit costs are reimbursed.

Given the multi-tenant SaaS nature, audits cannot expose other tenants' data confidentiality.

5. Controller obligations

The Customer undertakes to:

• Have an appropriate legal basis for processing via the Service (typically legitimate interest in AI Act Art. 50 compliance evidence).
• Provide End Visitors with clear information (Customer Site privacy notice) about ArtGuard use and related processing.
• Configure the Service per its legal obligations (audience-appropriate disclosure language, proportionate display mode).
• Respond to data subject requests within legal deadlines as controller.
• Notify ArtGuard without delay of any data breach known to it involving the Service.

6. Transfers outside the EU

See Annex 1. Non-EU transfers are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented by transfer impact assessment measures where appropriate.

7. Liability

Each Party is liable for damages resulting from breach of its own obligations under this DPA, within the liability caps of the main contract (ToS article 10).

8. Amendment

This DPA may be amended by written Party agreement, or unilaterally by ArtGuard in case of mandatory regulatory evolution, with prior Customer notice.

9. Governing law and jurisdiction

This DPA is governed by French law, subject to the jurisdiction of the courts of ArtGuard's registered seat.

Annex 1 — Subprocessors list

Up-to-date list available at https://artguard.tech/sub-processors.

Annex 2 — Technical and organizational measures (GDPR article 32)

A. Technical measures

• Encryption: TLS 1.2+ in transit; AES-256 at rest (Neon/AWS).
• Pseudonymization: systematic SHA-256 IP hashing; User-Agent reduction.
• Append-only audit trail: audit_event table protected by PostgreSQL trigger refusing UPDATE/DELETE for the application role.
• Multi-tenant isolation: PostgreSQL Row-Level Security (RLS).
• Authentication: magic link, 15-minute lifetime, no permanent password.
• Backups: daily automated Neon backups, 7-day retention, at-rest encryption. Recovery Point Objective (RPO): 24 hours maximum. Recovery Time Objective (RTO): 4 hours for application service restoration after disaster, excluding DNS propagation.
• Availability: continuous monitoring with automatic alerting.
• Penetration testing: commitment to engage an independent security audit firm at least once per year, starting from the first full operating fiscal year. Summary reports (without exploitable technical detail) may be made available to the Customer under NDA, on reasoned request.
• Dependency review: weekly automated CVE audit on dependencies (npm, third-party libraries); patches deployed within 48 hours for Critical severity, within 7 days for High.

B. Organizational measures

• Confidentiality: written confidentiality commitment for any person accessing data.
• Minimization: only strictly necessary data is collected.
• Retention: plan-differentiated durations (30/90/365 days), archive or delete at expiry.
• Subprocessor management: systematic contract review, certification tracking.
• Updates: monthly CVE review and reasonable patching (critical within 48h, high within 7 days).
• Recovery tests: at least one annual restore exercise from backups.

C. Breach-specific measures

• Detection: error monitoring (Sentry), anomaly alerting.
• Notification: documented procedure to notify the Customer within 48 hours.
• Investigation: logs retained at least 12 months for forensic analysis.

Acceptance

This DPA is automatically accepted by the Customer upon subscription, by ticking the dedicated acceptance checkbox in the dashboard.

For regulatory needs, the Customer can download a signed version of the DPA at https://artguard.tech/legal/dpa.

For the Processor (ArtGuard):

DTech Innovations Sole proprietor, SIREN 982 702 052 105 Chemin de Souleyrol, 84570 Malemort-du-Comtat, France dtech.innovations@proton.me

For the Controller (Customer): electronic acceptance via the dashboard.