Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Suitra Terms of Service between the customer ("you", the controller) and AZINOVE SAS (Société par actions simplifiée), RCS Strasbourg 897 432 324, 13 Rue de Dahlenheim, 67200 Strasbourg, France ("Azinove", the processor). It applies whenever Azinove processes personal data on your behalf through Suitra. If this DPA and the Terms conflict on data protection, this DPA prevails.

2. Subject matter, nature and duration

Azinove processes personal data to provide Suitra: a workspace where the customer manages its sales pipeline, contacts, activities, quotations, invoices and payments, including, on the Pro plan and only when a user asks for it, AI drafting (quotation lines from a description or a photo, leads and contacts from a pasted message, follow-up and payment-reminder emails, tidied call notes, plain-words list filters, opportunity summaries and next steps) sent through the Vercel AI Gateway to the model provider listed in section 7. The processing consists of collecting, storing, organising, displaying, exporting and deleting the data you put into the service, and, only when you use them, the AI features of a paid plan. Processing lasts as long as your account, plus the deletion period in section 10.

3. Personal data and data subjects

Categories of personal data you may store:

• Identity and contact details of the people and companies in the CRM: names, job titles, email addresses, phone numbers, postal and delivery addresses, websites, SIREN numbers
• Commercial data: opportunities (stage, expected revenue, probability, deadlines, tags, lost reasons), quotations, orders, invoices and payments (amounts, dates, methods, references)
• Free text written by the customer’s users: internal notes, chatter messages, activity summaries and the change history of records, which may contain any information the users choose to write
• The customer’s own users: name, email address, the records assigned to them and the messages they write
• The customer’s company identity printed on documents: legal name, address, SIRET, VAT number, IBAN and BIC (personal data when the customer is a sole trader)

Categories of data subjects:

• The customer’s prospects and customers, and the people who work for them
• The customer’s own team members who use the workspace
• Any other person the customer’s users mention in records, notes or documents

You must not store special categories of data (Article 9 GDPR) or data about criminal convictions unless the service is configured for it and you have a legal basis.

4. Your instructions

Azinove processes the data only on your documented instructions: these Terms, this DPA and the settings and actions you take in Suitra. If Azinove believes an instruction infringes data protection law, it will tell you. If EU or French law requires other processing, Azinove will inform you first unless the law forbids it.

5. Confidentiality

Everyone at Azinove authorised to access the data is bound by confidentiality and accesses it only to run, support or secure the service.

6. Security (Article 32)

• All traffic is encrypted in transit (HTTPS/TLS).
• Every record is tied to your workspace or account, and every query is scoped to it, so other customers cannot read your data.
• Data is hosted with providers that encrypt it at rest and keep backups (see the subprocessors below).
• Production access is limited to the people who need it, with individual accounts and multi-factor authentication.
• Where IP addresses are only needed for abuse protection, they are stored hashed.

7. Subprocessors

You give Azinove general authorisation to use the subprocessors below. Azinove imposes data protection obligations on them equivalent to this DPA and remains liable for them. Azinove will announce any new subprocessor at least 30 days in advance on this page; you may object on reasonable data protection grounds and, if no solution is found, close your account with a pro-rata refund of prepaid fees.

8. Transfers outside the EU

When a subprocessor processes data outside the EU/EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, as shown in the table.

9. Assistance and breach notification

• The service lets you view, correct, export and delete the data, so you can answer data subject requests yourself. Azinove forwards any request it receives directly and helps you if you need more.
• Azinove helps you with security, impact assessments and consultations with a supervisory authority (Articles 32–36) as far as its role allows.
• Azinove notifies you of a personal data breach affecting your data without undue delay, and at the latest within 48 hours of becoming aware of it, with the information you need for your own notification.

10. Deletion at the end of the service

You can export your data at any time from the account page. An admin can delete the workspace at any time from Account & data: every record is then deleted from the live database at once, and copies in the database host’s backups expire within 90 days. Azinove keeps no copy of your invoices after deletion, so export them first: keeping them for 10 years is your obligation as the business that issued them. Data that the law obliges Azinove itself to keep (for example its own invoices to you) is kept only for that purpose and period.

11. Information and audits

Azinove makes available the information needed to show compliance with this DPA. You may audit compliance once a year, on 30 days' written notice, at your cost, by yourself or an independent auditor bound by confidentiality, preferably by questionnaire and documentation.

12. Contact

Data protection questions: dpo@cleverai.ai. This DPA follows the liability and governing-law clauses of the Terms of Service.