Skip to content

Data processing agreement

Last updated: [date TO BE CONFIRMED]

Draft document — to be reviewed by a lawyer.

When your organisation sends traces to WYRLO, it remains the controller and WYRLO acts as a processor. Article 28 of the GDPR requires a contract between the two. Here is what it covers.

What the agreement covers

In line with article 28 of the GDPR, the agreement sets out:

  • processing only on your documented instructions;
  • confidentiality obligations for the people authorised to process the data;
  • the security measures in place;
  • the conditions for engaging sub-processors;
  • help with responding to requests to exercise data subject rights;
  • assistance in the event of a data breach and with impact assessments;
  • deletion or return of the data at the end of the agreement;
  • the information made available to demonstrate compliance, including audits.

Subject matter of the processing

  • Nature: checking your RAG’s answers, computing the confidence level, adjusting settings every night and producing the weekly report.
  • Data: questions, passage excerpts and answers (the traces), masked before storage; account data for your organisation.
  • Data subjects: users of your RAG and members of your organisation [categories TO BE CONFIRMED].
  • Your documents are never stored.

Duration

The agreement applies for as long as you use the service.

Traces are kept for 30 days by default, then deleted; your organisation can choose 30, 90 or 180 days. [Time limit for deleting data at the end of the agreement: TO BE CONFIRMED]

Security measures

  • hosting in the European Union (Paris);
  • masking of traces before storage;
  • strict isolation between organisations, enforced by access rules at database level;
  • API keys stored only as a hashed fingerprint;
  • activity log of sensitive actions;
  • encryption [scope TO BE CONFIRMED].

These measures are described in detail on the Security page.

Sub-processors

  • Supabase: database and functions, eu-west-3 region (Paris). Address: [TO BE CONFIRMED]
  • Vercel: web application hosting, functions in the cdg1 region (Paris). Address: [TO BE CONFIRMED]

[Full list, prior notice of changes and right to object: TO BE CONFIRMED]

Getting the agreement

The agreement is sent on request [address TO BE CONFIRMED].