Data Processing Agreement (DPA)
Processing of personal data under Article 28 GDPR
Last updated:
This Data Processing Agreement ("DPA") forms part of the Terms of Service and applies to the processing, by THE PROCUREMENTOR, a French société par actions simplifiée (SAS) with a share capital of €1,000, registered with the Metz Trade and Companies Register (RCS) under number 130 492 077, with its registered office at 10 rue du Général Devers, 57370 Phalsbourg, France (the "Processor"), of personal data on behalf of your organization (the "Controller") within Procurementor Savings Tracker.
A counter-signable version of this DPA is available on request.
1. Subject matter and roles
The Controller determines the purposes and means of processing the data entered into the Service. The Processor processes that data only on the documented instructions of the Controller, as embodied in the use of the Service and these terms.
2. Nature and duration of processing
- Nature: hosting, storage, organizing, consultation, backup and deletion of data necessary to operate the Service.
- Duration: for the term of the agreement, followed by deletion in line with the retention policy.
3. Categories of data subjects and data
- Data subjects: the organization's users (buyers, team leads, finance validators, administrators) and any supplier contacts recorded.
- Data: names, work email addresses, roles, and business data (initiatives, savings amounts, suppliers, targets, attachments, messages).
4. Processor obligations
- Process data only on the Controller's instructions.
- Ensure confidentiality (personnel bound by confidentiality obligations).
- Implement appropriate technical and organizational measures (see the Security page).
- Assist the Controller in responding to data-subject rights requests.
- Notify the Controller of any personal-data breach without undue delay, within the limits of available information.
- Delete or return the data at the end of the agreement, at the Controller's choice.
- Make available the information needed to demonstrate Article 28 compliance and allow reasonable audits.
5. Sub-processors
The Controller authorizes the sub-processors below. The Processor will inform the Controller of any addition or replacement, giving it the opportunity to object on legitimate grounds.
| Sub-processor | Role | Location |
|---|---|---|
| Supabase Pte. Ltd. | Database, authentication and file storage | Data hosted in the EU (Paris, France) |
| Vercel Inc. | Web application hosting and content delivery network (CDN) | Server code runs in Paris; global delivery network; US company — transfers covered by SCCs |
| Brevo (Sendinblue SAS) | Transactional email delivery (confirmation, invitations, reset) and notification of your contact messages | France (EU) |
6. International transfers
The database, authentication and file storage are hosted in the European Union (Paris, France (EU — eu-west-3)) by Supabase. The application's server code runs on Vercel in the Paris region (cdg1). Vercel is a US company and its delivery network routes requests and serves static content from the point of presence closest to the visitor, so technical data (IP address, access logs) may be processed outside the EU. Those transfers are covered by the applicable data processing agreements and Standard Contractual Clauses (SCCs).
7. Security
Security measures include per-organization data isolation at the database level (RLS), encryption in transit and at rest, an append-only audit log, role-based access enforced in the database, and backups according to the hosting plan. Details are on the Security page.
8. Personal-data breach
In the event of a breach affecting the Controller, the Processor will notify it without undue delay at privacy@theprocurementor.com, with the known details enabling the Controller to meet its own 72-hour notification obligation where applicable.