Data processing agreement

1. Purpose and roles

For the data the customer manages in pixlova, the customer is the controller and PIXL FACTORY SAS acts as a processor, within the meaning of article 28 of the General Data Protection Regulation (GDPR). This agreement forms part of the terms of sale and applies for the whole term of the subscription.

2. Description of the processing

• Nature and purpose: provision of the pixlova digital signage service.
• Data: identity and email address of invited members, uploaded media (which may contain personal data), scheduling, on-demand screenshots, activity logs.
• Data subjects: members of the customer’s organization and anyone appearing in the displayed content.
• Duration: that of the subscription, then the erasure period set out in article 8.

3. Instructions and confidentiality

The publisher processes this data solely to provide the service and on the customer’s documented instructions, including with regard to transfers outside the European Union. It informs the customer if an instruction appears to infringe the regulations. People authorized to access the data are bound by a duty of confidentiality.

4. Security

The publisher implements technical and organizational measures appropriate to the risk: isolation of each organization’s data, role-based access control, two-factor authentication, encrypted exchanges, password hashing, a log of sensitive actions, regular backups and security updates.

5. Sub-processors

The customer authorizes the use of the sub-processors listed in the privacy policy. The publisher informs the customer by email of any addition or replacement at least thirty (30) days in advance; the customer may object by cancelling their subscription. The publisher imposes on each sub-processor data protection obligations equivalent to those of this agreement.

6. Assistance to the customer

The publisher helps the customer, as far as possible, to respond to requests from data subjects exercising their rights, to ensure the security of the processing and, where applicable, to carry out an impact assessment. Requests should be sent to [email protected].

7. Data breaches

The publisher notifies the customer of any data breach concerning them within forty-eight (48) hours of becoming aware of it, with the information available to enable them to meet their own notification obligations.

8. End of the contract

The customer may retrieve their media before the organization is deleted. When the organization is deleted, the data is erased within thirty (30) days, backups included within the limits of their rotation cycle, unless retention is required by law.

9. Audit

The publisher makes available to the customer the information needed to demonstrate compliance with this agreement. The customer may request an audit, at its own expense, with thirty (30) days’ notice, limited to one audit per year except in the event of a proven breach.