Data Processing Agreement

This agreement is entered into between Horizon Makers, a sole proprietorship (entreprise individuelle) registered under SIREN number 898 931 738 (“the Publisher”), and any organisation that has opened a KiteDeck account (“the Client”). It is annexed to and forms an integral part of the Terms of Sale. It applies as soon as the account is opened, without any further signature.

1. Roles of the parties

For the personal data the Client enters or collects in the Service about its own customers, the Client is the controller and the Publisher is the processor, within the meaning of Article 28 of Regulation (EU) 2016/679 (“GDPR”). The Client's account and commission data, for which the Publisher is itself the controller, is covered by the Privacy Policy and not by this agreement.

2. Description of the processing

• Subject matter and purpose: providing the cruise management Service described in the Terms of Sale.
• Nature of the operations: hosting, recording, organisation, consultation, alteration, sending messages (reminders, campaigns, confirmations), publishing the booking page, export and erasure.
• Data subjects: the Client's customers and prospects, cruise participants, recipients of its messages.
• Categories of data: identity and contact details; bookings, deposits and entries (without bank card numbers); number, expiry date and copy of the travel document; riding level, weight, equipment, dietary requirements, insurance, notes and consent to marketing communications.
• Duration: the term of the contract, then thirty days after the account closure request (section 9), subject to the automatic retention periods described in section 3.

The Service is not designed to receive special categories of data (health, religious beliefs, etc.). If the Client enters any, for instance in a dietary requirement or a note, it ensures it is entitled to do so and limits itself to what is strictly necessary.

3. The Client's instructions

The Publisher processes the data only on documented instructions from the Client. These instructions consist of the Terms of Sale, this agreement and the Client's use of the Service and its settings. The Client accepts the automatic retention periods described in the Privacy Policy (in particular, anonymisation of a customer record three years after their last cruise, and erasure of travel document copies twelve months after it): they constitute instructions.

The Publisher does not process the data for its own purposes. It immediately informs the Client if, in its opinion, an instruction infringes applicable law, or if the law requires it to process the data otherwise, unless that law prohibits informing the Client.

4. Confidentiality

The Publisher ensures that any person authorised to access the data is bound by confidentiality, through a contractual commitment or a statutory obligation. It accesses the data only to the extent necessary for the operation of the Service or for support requested by the Client.

5. Security

The Publisher implements the technical and organisational measures required by Article 32 GDPR, including:

• encryption of communications in transit;
• segregation of each organisation's data at database level;
• mandatory two-factor authentication for all members of an organisation, and passwordless sign-in;
• private storage of travel document copies, accessible only to members of the organisation concerned;
• database backups by the hosting provider, on a fourteen-day rotation;
• access and security logs kept for twelve months at most.

6. Sub-processors

The Client authorises the Publisher to engage the following sub-processors:

• Vercel — application hosting, in Ireland;
• Supabase — database, authentication and storage, in Ireland;
• Resend — email delivery;
• Upstash — caching and rate limiting, in the European Union;
• Sentry — technical monitoring and error logging, in the European Union;
• browser push services — delivery of push notifications to the Client's members;
• Anthropic — the in-app help assistant (members' questions only, never the Client's data);
• OVH, in France, and Google — internal tracking of feature requests raised through the assistant.

The Publisher imposes on each of them, by contract, data protection obligations equivalent to those of this agreement, and remains liable to the Client for their compliance. It informs the Client by email of any addition or replacement at least thirty days in advance. The Client may object on reasonable grounds relating to data protection; if no solution is found, it may close its account at no cost.

The following are not sub-processors of the Publisher: the Stripe account the Client connects to the Service to collect its deposits, and the third-party services the Client connects itself (Brevo, for example). They are governed by the contracts the Client has entered into directly with those providers.

7. Transfers outside the European Union

The data is hosted in the European Union. Any transfer to a third country, in particular for email delivery or a provider's support access, relies on a safeguard provided for in Chapter V GDPR: an adequacy decision, including the EU–US Data Privacy Framework for certified providers, or failing that the European Commission's standard contractual clauses.

8. Assistance to the Client

• Data subject rights: the Service lets the Client view, rectify, export and delete its customers' data. If a person contacts the Publisher directly, the Publisher forwards the request to the Client without answering it itself, unless instructed otherwise.
• Impact assessments and prior consultation of the supervisory authority: the Publisher provides, on request, the information available to it.
• Personal data breaches: the Publisher notifies the Client of any personal data breach affecting it without undue delay and no later than forty-eight hours after becoming aware of it. It describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. It supplements this information as it becomes available.

9. End of the contract

The Client may export all of its data at any time from the Account page, as an archive of CSV files. After requesting the closure of its account, it has thirty days to carry out this export or withdraw its request. At the end of that period, the Publisher erases the data processed on the Client's behalf, including copies of travel documents. The data disappears from backups when they expire, within fourteen days at the latest. The Publisher keeps only what the law requires it to retain.

10. Audit

The Publisher makes available to the Client the information necessary to demonstrate compliance with this agreement. The Client may have an audit carried out, no more than once a year, with thirty days' notice, at its own expense, by an auditor bound by confidentiality who is not a competitor of the Publisher. The audit may not give access to the data of the Publisher's other clients. An audit requested by a supervisory authority is not subject to these limits.

11. The Client's obligations

The Client determines the purposes of its processing and has a legal basis for each of them. It informs data subjects in accordance with Articles 13 and 14 GDPR, obtains their consent where required (for its marketing campaigns, in particular) and enters only the data that is necessary.

12. General provisions

In the event of any conflict with the Terms of Sale, this agreement prevails in all matters relating to the protection of personal data. The limitation of liability set out in the Terms of Sale applies to this agreement, to the extent permitted by law. It is governed by French law and subject to the courts designated in the Terms of Sale. It ends with the contract, except for the obligations which by their nature survive it (section 9).