Data processing agreement

01Parties and purpose

This agreement is concluded between the business client ("the controller") and Benchmaven SAS, 22 Rue de Rathsamhausen, 67100 Strasbourg, France ("the processor"). It forms part of the contract created by accepting a quote and our terms and conditions, and prevails over them for everything concerning the processing of personal data on the client's behalf. It is deemed accepted, with its annexes, on the date the quote is accepted.

It applies when the client entrusts us with recording, editing or storing the voice and data of people they bring in: audiobook narrators, podcast guests, voice actors, session musicians. It does not cover data we collect for ourselves (quote requests, invoicing), described in our privacy policy.

02Definitions

The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in Article 4 of Regulation (EU) 2016/679 (GDPR). "Applicable regulations" means the GDPR and French Law No. 78-17 of 6 January 1978. "Sub-processor" means any provider we use to process the client's data. Other terms have the meaning given in our Terms.

03Instructions and scope of processing

We process the data only as necessary for the service described in the quote, in accordance with this agreement and the client's written instructions, including regarding transfers outside the European Union. If an instruction seems to us to breach the regulations, we inform the client immediately. We do not process the data for other purposes, except where required by law, in which case we would inform the client before processing where the law allows.

We do not sell the data, do not use it for our own purposes and do not use it to train artificial intelligence systems.

04Our commitments

• The two team members authorised to process the data are bound by confidentiality and informed of their obligations.
• We implement the technical and organisational measures of Article 32 GDPR, described in Annex B, taking into account the state of the art, costs, the nature, scope, context and purposes of processing, and the risks. These measures may evolve but never fall below the level of Annex B.
• We help the client, as far as possible, to respond to data subject requests and to meet its obligations regarding security, notification, impact assessment and prior consultation (Articles 32 to 36).
• We make available to the client the information needed to demonstrate compliance with this agreement.

05Client's commitments

The client warrants that the processing has a legal basis, that it has informed the data subjects and, where necessary, obtained their authorisation, in particular that of performers under Article L.212-3 of the French Intellectual Property Code. It sends us only the data needed for the service and gives its instructions in writing. It applies appropriate security measures on its side.

The assistance provided for in this agreement is included when it remains simple. Substantial assistance (on-site audit, detailed impact assessment, return in a particular format) may be charged at reasonable cost, on a prior quote.

06Sub-processors

The client gives us general authorisation to use sub-processors. On the date of this agreement, we use a single sub-processor:

We inform the client by email at least 30 days before any addition or replacement. The client may object in writing, on reasonable grounds, within 10 working days. If the service cannot be performed without that provider, the client may terminate the part concerned and we refund sums paid for the part not performed. Each sub-processor is bound by a contract imposing equivalent obligations; we remain liable to the client for their performance.

We do not transfer the client's data outside the European Economic Area. Any future transfer could only take place after informing the client in writing and on the basis of a mechanism provided for in Articles 45 to 49 GDPR.

07Data subject requests

If a data subject contacts us directly, we forward the request to the client without delay and do not reply ourselves, unless instructed by the client or required by law. At the client's request, we rectify, delete, restrict or export the data concerned.

08Audit

On request, we provide the client with the information reasonably needed to demonstrate compliance with this agreement. If this is not sufficient, the client may carry out, at its own expense, an audit covering only its data, during our opening hours, with at least four weeks' notice except in the case of a proven breach, and without disrupting other clients' sessions. The auditor is bound by confidentiality. These arrangements organise the right to audit without limiting it.

09Personal data breach

We notify the client of any personal data breach affecting it without undue delay and no later than 48 hours after becoming aware of it, by email and phone. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. We take reasonable steps to limit its effects and help the client meet its obligations to notify the CNIL and the data subjects.

10Cooperation

We promptly inform the client of any request from an authority or any complaint concerning it, unless prohibited by law. The parties cooperate with the CNIL on request. If a change in regulations requires this agreement or our measures to be amended, we propose it within a reasonable time; failing agreement, the client may end the part of the service that has become non-compliant.

11Liability

Each party's liability under this agreement is governed by our Terms, without prejudice to Articles 82 and 83 GDPR. We are liable for sub-processors as for ourselves. The same loss cannot be compensated twice.

12Term, deletion and return

This agreement applies for the whole duration of the service and of the session archiving. Sessions are kept for 6 months after the last session, unless the client instructs otherwise in writing. At the end of this period, or earlier at the client's written request, we return the data in a standard audio format or delete it, as chosen by the client within 30 days after the end of the service. Backup copies are overwritten as they rotate, no later than three months after deletion of the active data, unless the law requires retention.

13General provisions

If a clause is void, the others remain in force and it is replaced by the closest valid provision. This agreement is governed by French law; disputes fall within the jurisdiction set out in our Terms, namely, between businesses, the commercial chamber of the Strasbourg judicial court. This English text is a translation: the French version prevails.

14Annex A — Description of processing

15Annex B — Security measures