Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between:

• BarnRecords, SASU, registered in France under SIREN 982 485 260, with registered office at 24 rue de la Sablonnière, 91410 Les Granges-le-Roi, France (“okokumo”, “Processor”, “we”); and
• The customer identified in the Agreement (“Customer”, “Controller”, “you”),

each a “Party”, together the “Parties”.

This DPA reflects the requirements of Regulation (EU) 2016/679 (“GDPR”) and applies whenever okokumo processes Personal Data on Customer's behalf in connection with the okokumo infrastructure monitoring service (the “Service”).

1. Definitions

Terms defined in the GDPR (including “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Supervisory Authority”) have the same meaning in this DPA. “Sub-processor” means any processor engaged by okokumo to process Personal Data on Customer's behalf.

2. Subject Matter and Duration

okokumo processes Personal Data as a Processor, on documented instructions from Customer, for the duration of the Agreement and for the purposes set out in Annex I. On termination, Section 9 (Deletion and Return of Data) governs.

3. Scope and Instructions

3.1. okokumo processes Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country, unless required to do so by EU or Member State law — in which case okokumo informs Customer of that legal requirement before processing, unless the law prohibits this.

3.2. The Agreement, this DPA, and Customer's configuration of the Service (e.g. the URLs, alert-channel destinations, and contact details Customer enters) constitute Customer's complete instructions to okokumo as of the effective date. Any additional or different instruction requires the Parties' written agreement, including as to any additional fees.

3.3. okokumo shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

4. Confidentiality

okokumo ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to what is necessary to provide the Service.

5. Security of Processing (Art. 32 GDPR)

Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects, okokumo implements the technical and organizational measures described in Annex II.

6. Sub-processors

6.1. Customer grants okokumo a general authorization to engage the Sub-processors listed in Annex III as of the effective date.

6.2. okokumo shall notify Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, giving Customer the opportunity to object on reasonable, documented data-protection grounds. If the Parties cannot resolve the objection, Customer may terminate the affected part of the Service without penalty.

6.3. Where okokumo engages a Sub-processor, it imposes data protection obligations on that Sub-processor equivalent to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. okokumo remains fully liable to Customer for a Sub-processor's failure to fulfil its data protection obligations.

7. International Transfers

okokumo's infrastructure is hosted in France (Scaleway, fr-par region). As of the effective date, Personal Data processed in connection with the Service does not leave the European Economic Area except as disclosed in Annex III. Any future transfer outside the EEA will only occur on an adequate legal basis (adequacy decision, Standard Contractual Clauses, or another GDPR-recognized safeguard), and okokumo will update Annex III accordingly.

8. Assistance to Customer

Taking into account the nature of the processing and the information available to it, okokumo assists Customer, insofar as reasonably possible, with:

• (a) responding to requests from Data Subjects exercising their GDPR rights (access, rectification, erasure, restriction, portability, objection) — where the Service provides self-service tools to Customer for this purpose, okokumo directs the request there first;
• (b) Customer's data protection impact assessments and prior consultations with a Supervisory Authority, where required by Art. 35–36 GDPR;
• (c) compliance with Customer's obligations under Art. 32–34 GDPR (security, breach notification), including via Section 9 below.

okokumo may charge a reasonable fee for assistance beyond what is reasonably possible at no cost, notified to Customer in advance.

9. Personal Data Breach Notification

okokumo notifies Customer without undue delay, and in any case within 72 hours of becoming aware, after confirming a Personal Data Breach affecting Customer's Personal Data. The notification describes, to the extent then known: the nature of the breach, categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed. okokumo cooperates with Customer and provides further information as it becomes available.

10. Deletion and Return of Data

On termination of the Agreement, okokumo, at Customer's choice, deletes or returns all Personal Data processed on Customer's behalf, and deletes existing copies, within 30 days — unless EU or Member State law requires okokumo to retain some or all of the Personal Data, in which case okokumo isolates it and continues to protect it under this DPA.

11. Audit Rights

okokumo makes available to Customer all information reasonably necessary to demonstrate compliance with this DPA and Art. 28 GDPR, and allows for and contributes to audits, including inspections, conducted by Customer or an auditor mandated by Customer, on reasonable prior written notice (at least 30 days) and no more than once per 12-month period absent a Personal Data Breach or documented regulatory requirement. Customer bears its own audit costs; okokumo may charge for time spent beyond a reasonable initial scope.

12. Liability

Liability under this DPA is governed by the liability provisions of the Agreement, subject to any liability caps or exclusions that cannot be limited under applicable law.

13. Governing Law

This DPA is governed by French law, without prejudice to Customer's rights under the GDPR and the jurisdiction of the competent Supervisory Authority.

Annex I — Description of Processing

Annex II — Technical and Organizational Measures

• Hosting on Scaleway infrastructure located in France (fr-par region); a second, EU-based probe region for monitoring redundancy only (no Personal Data storage there beyond transient check-execution results).
• Encryption in transit: TLS on all customer-facing endpoints; Let's Encrypt-issued certificates, auto-renewed.
• Passwords stored as salted hashes (bcrypt); never stored or logged in plaintext.
• Session-based authentication with secure, httponly cookies.
• Multi-tenant data isolation enforced at the application layer: every business record is scoped to an organization ID, and every query is organization-scoped.
• Webhook alert payloads are HMAC-signed so recipients can verify authenticity.
• Infrastructure provisioned and changes tracked via version-controlled Terraform; deploys via CI/CD with an audit trail (Git history).
• Automated daily backups of the production database (Scaleway Managed PostgreSQL backup service).
• Access-control policy: production access (servers, Scaleway console, database) is restricted to okokumo's founder; access for any future employee or contractor would be granted and revoked solely by the founder.
• Incident response: the founder is paged on detection of an infrastructure or security incident, investigates and remediates, and notifies affected Customers within 1 hour if Personal Data is implicated, in addition to the 72-hour breach notification in Section 9.

Annex III — Sub-processors