{"id":336,"date":"2025-06-26T16:36:38","date_gmt":"2025-06-26T13:36:38","guid":{"rendered":"https:\/\/mapsly.com?page_id=336"},"modified":"2026-07-31T20:07:48","modified_gmt":"2026-07-31T17:07:48","slug":"dpa","status":"publish","type":"page","link":"https:\/\/mapsly.com\/fr\/dpa\/","title":{"rendered":"ADDENDA DE TRAITEMENT DES DONN\u00c9ES MAPSLY"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Addendum au traitement des donn\u00e9es<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Last updated: July 31, 2026. This version supersedes the version last updated September 15, 2023.<\/i><\/p>\n\n

Le pr\u00e9sent avenant relatif au traitement des donn\u00e9es (\u00ab DPA \u00bb) est un accord entre vous et l'entit\u00e9 que vous repr\u00e9sentez (\u00ab Client \u00bb, \u00ab vous \u00bb ou \u00ab votre \u00bb) et Mapsly LLC (\u00ab MAPSLY \u00bb). Ce DPA compl\u00e8te les Conditions d'utilisation de MAPSLY disponibles \u00e0 https:\/\/mapsly.com\/terms<\/a>, as updated from time to time between Customer and MAPSLY, or other agreements between Customer and MAPSLY that govern Customer\u2019s use of the MAPSLY Services (the \u201cAgreement\u201d). \u201cCustomer\u201d refers to the entity defined as \u201cUser\u201d under the MAPSLY Terms of Service. This DPA applies to the extent MAPSLY processes Customer Data on Customer\u2019s behalf in providing the Services.<\/p>\n\n

D\u00e9finitions. Tous les termes en majuscules utilis\u00e9s dans cette DPA auront les significations qui leur sont attribu\u00e9es ci-dessous, sauf d\u00e9finition contraire dans l'Accord :<\/p>\n\n

\u201cAPI\u201d<\/span><\/b> signifie une interface de programmation d'application.<\/p>\n\n

\u201cApplicable Data Protection Law\u201d<\/span><\/b> means all laws and regulations applicable to and binding on the processing of Customer Data by a party, including, as applicable, the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (\u201cFADP\u201d), and applicable United States federal and state privacy laws (including the California Consumer Privacy Act, as amended).<\/p>\n\n

\u201cBinding Corporate Rules\u201d<\/span><\/b> a le sens qui lui est donn\u00e9 dans le RGPD.<\/p>\n\n

\u201cController\u201d<\/span><\/b> a le sens qui lui est donn\u00e9 dans le RGPD.<\/p>\n\n

\u201cController-to-Processor Clauses\u201d<\/span><\/b> d\u00e9signe les clauses contractuelles types entre les Responsables de traitement et les Sous-traitants pour les transferts de donn\u00e9es, telles qu'approuv\u00e9es par la D\u00e9cision d'ex\u00e9cution de la Commission europ\u00e9enne (UE) 2021\/914 du 4 juin 2021.<\/p>\n\n

\u201cCustomer Data\u201d<\/span><\/b> means the Personal Data that is uploaded to or generated within the Services under Customer\u2019s MAPSLY accounts, excluding the End-User account and usage information described in Section 1.5.<\/p>\n\n

\u201cData Privacy Framework\u201d or \u201cDPF\u201d<\/span><\/b> means, together, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, as administered by the U.S. Department of Commerce.<\/p>\n\n

\u201cDocumentation\u201d<\/span><\/b> signifie la documentation en vigueur \u00e0 ce moment pour les Services situ\u00e9e \u00e0 https:\/\/help.mapsly.com<\/a> (et tous les emplacements successeurs d\u00e9sign\u00e9s par MAPSLY).<\/p>\n\n

\u201cEEA\u201d<\/span><\/b> signifie l'Espace \u00e9conomique europ\u00e9en.<\/p>\n\n

\u201cEnd Users\u201d<\/span><\/b> d\u00e9signe les utilisateurs du compte Mapsly du Client, y compris les employ\u00e9s et les contractants du Client qui ont \u00e9t\u00e9 assign\u00e9s par le Client \u00e0 utiliser Mapsly.<\/p>\n\n

\u201cGDPR\u201d<\/span><\/b> d\u00e9signe le R\u00e8glement 2016\/679 du Parlement europ\u00e9en et du Conseil du 27 avril 2016 relatif \u00e0 la protection des personnes physiques \u00e0 l'\u00e9gard du traitement des donn\u00e9es \u00e0 caract\u00e8re personnel et \u00e0 la libre circulation de ces donn\u00e9es, abrogeant la Directive 95\/46\/CE (R\u00e8glement g\u00e9n\u00e9ral sur la protection des donn\u00e9es).<\/p>\n\n

\u201cMAPSLY Network\u201d<\/span><\/b> d\u00e9signe les serveurs, les \u00e9quipements r\u00e9seau et les syst\u00e8mes logiciels h\u00f4tes (par exemple, les pare-feux virtuels) qui sont sous le contr\u00f4le de MAPSLY et sont utilis\u00e9s pour fournir les Services.<\/p>\n\n

\u201cMAPSLY Setup console\u201d<\/span><\/b> signifie la section Configuration dans le service Mapsly disponible sous \u00ab Configuration \u00bb dans le menu principal.<\/p>\n\n

\u201cPersonal Data\u201d<\/span><\/b> signifie des donn\u00e9es personnelles, des informations personnelles, des informations permettant d'identifier une personne ou tout autre terme \u00e9quivalent (chacun tel que d\u00e9fini dans la Loi applicable sur la protection des donn\u00e9es).<\/p>\n\n

\u201cProcessing\u201d<\/span><\/b> a la signification qui lui est donn\u00e9e dans le RGPD et \u00ab traiter \u00bb, \u00ab traite \u00bb et \u00ab trait\u00e9 \u00bb seront interpr\u00e9t\u00e9s en cons\u00e9quence.<\/p>\n\n

\u201cProcessor\u201d<\/span><\/b> a le sens qui lui est donn\u00e9 dans le RGPD.<\/p>\n\n

Clauses processeur \u00e0 processeur<\/span><\/b> means the standard contractual clauses between Processors for Data Transfers, as approved by the European Commission Implementing Decision (EU) 2021\/914 of 4 June 2021.<\/p>\n\n

Incident de s\u00e9curit\u00e9<\/span><\/b> signifie une violation de la s\u00e9curit\u00e9 de MAPSLY entra\u00eenant la destruction, la perte, la modification accidentelle ou ill\u00e9gale, la divulgation non autoris\u00e9e ou l'acc\u00e8s aux Donn\u00e9es Clients.<\/p>\n\n

Contr\u00f4les de service<\/span><\/b> d\u00e9signe les contr\u00f4les, y compris les fonctions et les caract\u00e9ristiques de s\u00e9curit\u00e9, que les Services fournissent, comme d\u00e9crit dans la Documentation.<\/p>\n\n

\u201cStandard Contractual Clauses\u201d<\/span><\/b> means (i) the Controller-to-Processor Clauses, or (ii) the Processor-to-Processor Clauses, as applicable in accordance with Sections 9.2.1 and 9.2.2, as supplemented, where applicable, by the UK Addendum (for Data Transfers subject to the UK GDPR) and by the Swiss adaptations described in Section 9.2.4 (for Data Transfers subject to the FADP).<\/p>\n\n

Pays tiers<\/span><\/b> means a country outside the EEA, the United Kingdom, or Switzerland not recognized by the European Commission (or, as applicable, by the competent United Kingdom or Swiss authorities) as providing an adequate level of protection for personal data (as described in the GDPR, the UK GDPR, or the FADP, as applicable).<\/p>\n\n

\u201cUK Addendum\u201d<\/span><\/b> means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, in force 21 March 2022.<\/p>\n\n

\u201cUK GDPR\u201d<\/span><\/b> means the GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.<\/p>\n\n

1. Data Processing<\/h2>\n\n

1.1 Scope and Roles.<\/span><\/b> Cette DPA s'applique lorsque MAPSLY traite les Donn\u00e9es Client. Dans ce contexte, MAPSLY agira en tant que Sous-traitant pour le Client, qui peut agir soit en tant que Responsable du traitement, soit en tant que Sous-traitant des Donn\u00e9es Client.<\/p>\n\n

1.2 Customer Controls.<\/span><\/b> Le Client peut utiliser les Contr\u00f4les de Service pour l\u2019aider \u00e0 respecter ses obligations en vertu de la Loi applicable sur la protection des donn\u00e9es, y compris ses obligations de r\u00e9pondre aux demandes des personnes concern\u00e9es. En tenant compte de la nature du traitement, le Client convient qu'il est peu probable que MAPSLY prenne connaissance du fait que les Donn\u00e9es Client transf\u00e9r\u00e9es dans le cadre des Clauses contractuelles types sont inexactes ou obsol\u00e8tes. N\u00e9anmoins, si MAPSLY prend connaissance que les Donn\u00e9es Client transf\u00e9r\u00e9es dans le cadre des Clauses contractuelles types sont inexactes ou obsol\u00e8tes, elle informera le Client sans d\u00e9lai indu. MAPSLY coop\u00e9rera avec le Client pour effacer ou rectifier les Donn\u00e9es Client inexactes ou obsol\u00e8tes transf\u00e9r\u00e9es dans le cadre des Clauses contractuelles types en fournissant les Contr\u00f4les de Service que le Client peut utiliser pour effacer ou rectifier les Donn\u00e9es Client.<\/p>\n\n

1.3 Details of Data Processing.<\/span><\/b><\/p>\n\n

1.3.1 Subject matter.<\/span><\/b> L'objet du traitement des donn\u00e9es dans le cadre de ce DPA est les Donn\u00e9es Client.<\/p>\n\n

1.3.2 Duration.<\/span><\/b> The processing continues for the Term of the Agreement and thereafter for the limited period necessary to return, delete, or lawfully retain Customer Data in accordance with Section 11.<\/p>\n\n

1.3.3 Purpose.<\/span><\/b> La finalit\u00e9 du traitement des donn\u00e9es en vertu de ce DPA est la fourniture des Services initi\u00e9s par le Client de temps \u00e0 autre.<\/p>\n\n

1.3.4 Nature of the processing.<\/span><\/b> Compute, storage, geocoding, routing, synchronization with Customer\u2019s connected systems, and such other Services as described in the Documentation and initiated by Customer from time to time, including, where Customer uses AI-based features of the Services, processing by AI model providers engaged as Sub-processors solely to provide the Services to Customer. MAPSLY does not use Customer Data to train generalized artificial intelligence or machine learning models.<\/p>\n\n

1.3.5 Type of Customer Data.<\/span><\/b> Customer Data uploaded to or generated within the Services under Customer\u2019s MAPSLY accounts, which may include contact and CRM records, addresses and other location data (including precise geolocation of End Users where Customer enables location tracking, check-in, or similar features), photos, notes, form responses, audio recordings and transcripts (where Customer uses voice or AI-based features), and automation and activity data.<\/p>\n\n

1.3.6 Categories of data subjects.<\/span><\/b> The data subjects could include Customer\u2019s customers, prospects and leads, employees, suppliers and End Users.<\/p>\n\n

1.4 Compliance with Laws.<\/span><\/b> Chaque partie se conformera \u00e0 toutes les lois, r\u00e8gles et r\u00e9glementations qui lui sont applicables et obligatoires dans l'ex\u00e9cution de ce DPA, y compris la loi applicable en mati\u00e8re de protection des donn\u00e9es.<\/p>\n\n

1.5 Mapsly as Controller.<\/span><\/b> Customer acknowledges that Mapsly collects certain information about Customer\u2019s End Users \u2014 such as account, authentication, billing, support, and usage information \u2014 as described in the MAPSLY Privacy Policy (currently published at https:\/\/mapsly.com\/privacy-policy<\/a>). To the extent Mapsly determines the purposes and means of processing such information, Mapsly acts as an independent Controller of that information and processes it in accordance with the MAPSLY Privacy Policy and Applicable Data Protection Law; such information is not Customer Data processed under this DPA. Mapsly may disclose such information internally and to its service providers for legitimate business purposes relating to the operation, support, and improvement of the Services, such as billing, account management, technical support, and product development.<\/p>\n\n

2. Customer Instructions<\/h2>\n\n

The parties agree that this DPA and the Agreement (including Customer providing instructions via configuration tools such as the MAPSLY Setup console and APIs made available by MAPSLY for the Services) constitute Customer\u2019s documented instructions regarding MAPSLY\u2019s processing of Customer Data (\u201cDocumented Instructions\u201d). MAPSLY will process Customer Data only in accordance with Documented Instructions (which if Customer is acting as a Processor, could be based on the instructions of its Controllers). Additional instructions outside the scope of the Documented Instructions (if any) require prior written agreement between MAPSLY and Customer, including agreement on any additional fees payable by Customer to MAPSLY for carrying out such instructions. Where an additional instruction is required for Customer\u2019s compliance with Applicable Data Protection Law and the parties are unable, within thirty (30) days, to reasonably agree on its implementation and any applicable fees, Customer may terminate the affected Services by written notice, and MAPSLY will refund Customer the prepaid fees prorated for the unused portion of the then-current Billing Period for the terminated Services. Taking into account the nature of the processing, Customer agrees that it is unlikely MAPSLY can form an opinion on whether Documented Instructions infringe Applicable Data Protection Law. If MAPSLY forms such an opinion, it will immediately inform Customer, in which case, Customer is entitled to withdraw or modify its Documented Instructions.<\/p>\n\n

3. Confidentiality of Customer Data<\/h2>\n\n

MAPSLY n'acc\u00e9dera pas, n'utilisera pas et ne divulguera pas \u00e0 des tiers les Donn\u00e9es Client, sauf, dans chaque cas, dans la mesure n\u00e9cessaire pour maintenir ou fournir les Services, ou pour se conformer \u00e0 la loi ou \u00e0 une ordonnance valide et contraignante d'une autorit\u00e9 gouvernementale (comme une assignation ou une ordonnance judiciaire). Si une autorit\u00e9 gouvernementale adresse \u00e0 MAPSLY une demande de Donn\u00e9es Client, MAPSLY tentera de rediriger l'autorit\u00e9 gouvernementale afin qu'elle demande directement ces donn\u00e9es au Client. Dans le cadre de cet effort, MAPSLY pourra fournir \u00e0 l'autorit\u00e9 gouvernementale les coordonn\u00e9es de base du Client. Si MAPSLY est contraint de divulguer les Donn\u00e9es Client \u00e0 une autorit\u00e9 gouvernementale, il informera raisonnablement le Client de cette demande afin de lui permettre de demander une ordonnance de protection ou un autre recours appropri\u00e9, sauf si MAPSLY est l\u00e9galement interdit de le faire.<\/p>\n\n

4. Confidentiality Obligations of MAPSLY Personnel<\/h2>\n\n

MAPSLY interdit \u00e0 son personnel de traiter les donn\u00e9es clients sans autorisation de MAPSLY. MAPSLY impose \u00e0 son personnel des obligations contractuelles appropri\u00e9es, notamment en mati\u00e8re de confidentialit\u00e9, de protection des donn\u00e9es et de s\u00e9curit\u00e9 des donn\u00e9es.<\/p>\n\n

5. Security of Data Processing<\/h2>\n\n

5.1<\/span><\/b> MAPSLY has implemented and will maintain the appropriate technical and organizational measures to ensure the security and confidentiality of the Customer Data, as described in Annex A (Technical and Organizational Measures) to this DPA and in accordance with Mapsly\u2019s security standards described in this DPA and within the MAPSLY Privacy Policy. MAPSLY may update the measures described in Annex A from time to time, provided that no update materially reduces the overall security of the Services.<\/p>\n\n

5.2 Customer Responsibilities and Optional Security Features.<\/span><\/b> MAPSLY met \u00e0 disposition de nombreux Contr\u00f4les de Service que le Client peut choisir d'utiliser pour renforcer davantage la s\u00e9curit\u00e9 des Donn\u00e9es Client. Le Client est responsable de (a) l'utilisation s\u00e9curis\u00e9e des Services, y compris la s\u00e9curisation des identifiants d'authentification de son compte, (b) la protection de la s\u00e9curit\u00e9 des Donn\u00e9es Client lors de leur transit vers et depuis les Services, (c) la prise de toutes les mesures appropri\u00e9es pour chiffrer ou sauvegarder de mani\u00e8re s\u00e9curis\u00e9e les Donn\u00e9es Client t\u00e9l\u00e9charg\u00e9es sur les Services, (d) la configuration correcte des Services et des Contr\u00f4les de Service, et (e) la prise d'autres mesures que le Client juge ad\u00e9quates pour garantir la s\u00e9curit\u00e9, la protection et la suppression des Donn\u00e9es Client.<\/p>\n\n

5.3 Security Incident Notification.<\/span><\/b><\/p>\n\n

5.3.1 Security Incident.<\/span><\/b> MAPSLY informera (a) le Client d'un Incident de S\u00e9curit\u00e9 sans d\u00e9lai injustifi\u00e9 apr\u00e8s avoir pris connaissance de l'Incident de S\u00e9curit\u00e9, et (b) prendra les mesures appropri\u00e9es pour g\u00e9rer l'Incident de S\u00e9curit\u00e9, y compris les mesures visant \u00e0 att\u00e9nuer tout effet n\u00e9gatif r\u00e9sultant de l'Incident de S\u00e9curit\u00e9.<\/p>\n\n

5.3.2 MAPSLY Assistance.<\/span><\/b> Pour permettre au Client de notifier un Incident de S\u00e9curit\u00e9 aux autorit\u00e9s de surveillance ou aux personnes concern\u00e9es (le cas \u00e9ch\u00e9ant), MAPSLY coop\u00e9rera avec le Client et l'assistera en incluant dans la notification les informations concernant l'Incident de S\u00e9curit\u00e9 que MAPSLY est en mesure de communiquer au Client, en tenant compte de la nature du traitement, des informations disponibles pour MAPSLY, et de toute restriction \u00e0 la divulgation des informations, telles que la confidentialit\u00e9. En tenant compte de la nature du traitement, le Client convient qu'il est le mieux plac\u00e9 pour d\u00e9terminer les cons\u00e9quences probables d'un Incident de S\u00e9curit\u00e9.<\/p>\n\n

5.3.3 Unsuccessful Security Incidents.<\/span><\/b> Le client accepte que :<\/p>\n\n

(i) an unsuccessful Security Incident will not be subject to this Section 5.3. An unsuccessful Security Incident is one that results in no unauthorized access to Customer Data or to any of MAPSLY\u2019s equipment or facilities storing Customer Data, and could include, without limitation, pings and other broadcast attacks on firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents; and<\/p>\n\n

(ii) MAPSLY\u2019s obligation to report or respond to a Security Incident under this Section 5.3 is not and will not be construed as an acknowledgment by MAPSLY of any fault or liability of MAPSLY with respect to the Security Incident.<\/p>\n\n

5.3.4 Communication.<\/span><\/b> La ou les notifications d'incidents de s\u00e9curit\u00e9, le cas \u00e9ch\u00e9ant, seront envoy\u00e9es \u00e0 un ou plusieurs administrateurs du Client par tout moyen choisi par MAPSLY, y compris par e-mail. Il incombe uniquement au Client de s'assurer que les administrateurs du Client maintiennent des informations de contact pr\u00e9cises dans la console de configuration MAPSLY et garantissent une transmission s\u00e9curis\u00e9e \u00e0 tout moment.<\/p>\n\n

5.3.5 Notification Obligations.<\/span><\/b> Si MAPSLY informe le Client d'un Incident de S\u00e9curit\u00e9, ou si le Client prend connaissance d'une destruction, d'une perte, d'une alt\u00e9ration, d'une divulgation non autoris\u00e9e ou d'un acc\u00e8s non autoris\u00e9 aux Donn\u00e9es du Client, le Client sera responsable de (a) d\u00e9terminer s'il existe une obligation de notification ou autre en vertu de la Loi applicable sur la Protection des Donn\u00e9es et (b) prendre les mesures n\u00e9cessaires pour se conformer \u00e0 ces obligations. Cela ne limite pas les obligations de MAPSLY en vertu de la pr\u00e9sente Section 5.3.<\/p>\n\n

6. Sub-processing<\/h2>\n\n

6.1 Authorized Sub-processors.<\/span><\/b> Customer provides general authorization to MAPSLY\u2019s use of sub-processors to provide processing activities on Customer Data on behalf of Customer (\u201cSub-processors\u201d) in accordance with this Section. The MAPSLY website (currently posted at https:\/\/mapsly.com\/sub-processors\/<\/a>) lists Sub-processors that are currently engaged by MAPSLY. At least 30 days before MAPSLY engages a Sub-processor, MAPSLY will update the applicable website and provide Customer with a mechanism to obtain notice of that update. To object to a Sub-processor, Customer can: (i) cease using the functionality of the MAPSLY Service for which MAPSLY has engaged the Sub-processor, or (ii) terminate the Agreement pursuant to its terms. If Customer objects to a new Sub-processor on reasonable grounds relating to data protection and the parties are unable to resolve the objection within thirty (30) days, Customer may terminate the Agreement with respect to the affected Services by written notice, and MAPSLY will refund Customer the prepaid fees prorated for the unused portion of the then-current Billing Period following the effective date of termination. If the affected functionality cannot reasonably be separated from the remainder of the Services, Customer may terminate the Agreement in its entirety on the same terms.<\/p>\n\n

6.2 Sub-processor Obligations.<\/span><\/b> Lorsque MAPSLY autorise un Sous-traitant comme d\u00e9crit dans la Section 6.1\u00a0:<\/p>\n\n

(i) MAPSLY will restrict the Sub-processor\u2019s access to Customer Data only to what is necessary to provide or maintain the Services in accordance with the Documentation, and MAPSLY will prohibit the Sub-processor from accessing Customer Data for any other purpose;<\/p>\n\n

(ii) MAPSLY will enter into a written agreement with the Sub-processor and, to the extent that the Sub-processor performs the same data processing services provided by MAPSLY under this DPA, MAPSLY will impose on the Sub-processor the same contractual obligations that MAPSLY has under this DPA; and<\/p>\n\n

(iii) MAPSLY will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause MAPSLY to breach any of MAPSLY\u2019s obligations under this DPA.<\/p>\n\n

7. MAPSLY Assistance with Data Subject Requests<\/h2>\n\n

En tenant compte de la nature du traitement, les Contr\u00f4les de Service sont les mesures techniques et organisationnelles par lesquelles MAPSLY aidera le Client \u00e0 remplir ses obligations de r\u00e9pondre aux demandes des personnes concern\u00e9es en vertu de la Loi sur la Protection des Donn\u00e9es applicable. Si une personne concern\u00e9e fait une demande \u00e0 MAPSLY, MAPSLY transmettra rapidement cette demande au Client d\u00e8s qu'elle aura identifi\u00e9 que la demande provient d'une personne concern\u00e9e dont le Client est responsable. Le Client autorise en son nom, et au nom de ses responsables lorsqu'il agit en tant que Sous-traitant, MAPSLY \u00e0 r\u00e9pondre \u00e0 toute personne concern\u00e9e qui fait une demande \u00e0 MAPSLY, pour confirmer que MAPSLY a transmis la demande au Client. Les parties conviennent que l'utilisation par le Client des Contr\u00f4les de Service et la transmission par MAPSLY des demandes des personnes concern\u00e9es au Client conform\u00e9ment \u00e0 cette section repr\u00e9sentent l'\u00e9tendue et la port\u00e9e de l'assistance requise du Client.<\/p>\n\n

8. Compliance Verification<\/h2>\n\n

8.1 MAPSLY Audits.<\/span><\/b> MAPSLY uses external auditors to verify the adequacy of its security measures. This audit: (a) will be performed at least annually; (b) will be performed according to a widely recognized standard (such as SOC 2 Type II); (c) will be performed by independent third-party security professionals at MAPSLY\u2019s selection and expense; and (d) will result in the generation of an audit report (\u201cReport\u201d), which will be MAPSLY\u2019s Confidential Information.<\/p>\n\n

8.2 Audit Reports.<\/span><\/b> \u00c0 la demande \u00e9crite du client, et \u00e0 condition que les parties disposent d'un NDA applicable, MAPSLY fournira au client une copie du Rapport afin que ce dernier puisse v\u00e9rifier raisonnablement la conformit\u00e9 de MAPSLY \u00e0 ses obligations en vertu de ce DPA.<\/p>\n\n

8.3 Privacy Impact Assessment and Prior Consultation.<\/span><\/b> Tenant compte de la nature du traitement et des informations disponibles pour MAPSLY, MAPSLY assistera le Client dans le respect de ses obligations en mati\u00e8re d'\u00e9valuations d'impact sur la protection des donn\u00e9es et de consultation pr\u00e9alable en fournissant les informations mises \u00e0 disposition par MAPSLY en vertu de la pr\u00e9sente Section 8.<\/p>\n\n

9. Transfers of Personal Data<\/h2>\n\n

9.1 Locations.<\/span><\/b> MAPSLY stores and processes Customer Data within the MAPSLY Network in the USA. MAPSLY personnel and Sub-processors may remotely access Customer Data from other countries in which they operate solely as necessary to provide, maintain, and support the Services; any such access constitutes a Data Transfer governed by this Section 9. MAPSLY will not otherwise transfer Customer Data outside of the EEA, the United Kingdom, Switzerland, and the USA except as necessary to provide the Services initiated by Customer, or as necessary to comply with the law or valid and binding order of a governmental body.<\/p>\n\n

9.2 Application of Standard Contractual Clauses.<\/span><\/b> Subject to Section 9.3, the Standard Contractual Clauses will only apply to Customer Data subject to the GDPR, the UK GDPR, or the FADP that is transferred, either directly or via onward transfer, to any Third Country (each a \u201cData Transfer\u201d).<\/p>\n\n

9.2.1<\/span><\/b> Lorsque le Client agit en tant que Responsable du traitement, les Clauses du Responsable au Sous-traitant s'appliqueront \u00e0 un Transfert de Donn\u00e9es.<\/p>\n\n

9.2.2<\/span><\/b> Lorsque le Client agit en tant que Sous-traitant, les Clauses Sous-traitant \u00e0 Sous-traitant s'appliqueront \u00e0 un Transfert de Donn\u00e9es. Compte tenu de la nature du traitement, le Client convient qu'il est peu probable que MAPSLY connaisse l'identit\u00e9 des Responsables du Client car MAPSLY n'a pas de relation directe avec les Responsables du Client et, par cons\u00e9quent, le Client remplira les obligations de MAPSLY envers les Responsables du Client en vertu des Clauses Sous-traitant \u00e0 Sous-traitant.<\/p>\n\n

9.2.3<\/span><\/b> For Data Transfers subject to the UK GDPR, the Standard Contractual Clauses apply as supplemented by the UK Addendum, completed as set forth in Section 9.4.<\/p>\n\n

9.2.4<\/span><\/b> For Data Transfers subject to the FADP, the Standard Contractual Clauses apply with the following adaptations: (i) references to the GDPR are to be read as references to the FADP; (ii) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; (iii) the term \u201cMember State\u201d is interpreted to include Switzerland, so that data subjects in Switzerland may enforce their rights in their place of habitual residence; and (iv) references to EU law are to be read as references to Swiss law where the transfer is exclusively subject to the FADP.<\/p>\n\n

9.3 Alternative Transfer Mechanism.<\/span><\/b> To the extent MAPSLY has adopted a valid alternative transfer mechanism recognized under Applicable Data Protection Law \u2014 including MAPSLY\u2019s certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework \u2014 such mechanism will apply to a Data Transfer in place of the Standard Contractual Clauses for so long as it remains valid. If such alternative mechanism is invalidated, suspended, withdrawn, or otherwise ceases to provide a lawful basis for a Data Transfer, the Standard Contractual Clauses (as completed in Section 9.4) will automatically apply to that Data Transfer without further action by either party. MAPSLY will maintain its Data Privacy Framework certification for so long as it relies on the Data Privacy Framework for Data Transfers.<\/p>\n\n

9.4 Completion of the Standard Contractual Clauses.<\/span><\/b> For each Data Transfer to which the Standard Contractual Clauses apply, the Standard Contractual Clauses are deemed completed as follows: (i) Module Two (transfer controller to processor) applies where Customer acts as a Controller, and Module Three (transfer processor to processor) applies where Customer acts as a Processor; (ii) in Clause 7, the optional docking clause does not apply; (iii) in Clause 9, Option 2 (general written authorisation) applies, and the time period for prior notice of Sub-processor changes is thirty (30) days, in accordance with Section 6.1; (iv) in Clause 11, the optional language does not apply; (v) in Clauses 17 and 18, the governing law and the competent courts are those of Ireland; and (vi) Annex I of the Standard Contractual Clauses is deemed completed with the information set out in Annex B to this DPA, Annex II is deemed completed with Annex A to this DPA, and Annex III is deemed completed with the Sub-processor list referenced in Section 6.1. Where the UK Addendum applies: Table 1 is deemed completed with the parties\u2019 details under the Agreement; Table 2 with the Standard Contractual Clauses as completed above; Table 3 with the Annex information above; and, for Table 4, neither party may end the UK Addendum as set out in Section 19 of the UK Addendum.<\/p>\n\n

10. Termination of the DPA<\/h2>\n\n

This DPA will continue in force until the termination of the Agreement (the \u201cTermination Date\u201d).<\/p>\n\n

11. Deletion of Customer Data<\/h2>\n\n

Upon termination or expiration of the Agreement, MAPSLY shall delete Customer Data from its active systems at Customer\u2019s request, and in any event not later than within a 90-day period after termination, except and to the extent MAPSLY is required by applicable law to retain some or all of the Customer Data, in which case MAPSLY shall securely isolate this Data, protect it from any further processing, and delete it in accordance with applicable retention periods. Customer Data held in backup systems will be deleted or overwritten in the ordinary course of MAPSLY\u2019s backup rotation cycles following deletion from active systems and will be protected from any further processing until deleted.<\/p>\n\n

12. Duties to Inform<\/h2>\n\n

Lorsque les Donn\u00e9es Client deviennent sujettes \u00e0 une confiscation lors de proc\u00e9dures de faillite, d'insolvabilit\u00e9 ou de mesures similaires par des tiers pendant leur traitement par MAPSLY, MAPSLY informera le Client sans d\u00e9lai indu. MAPSLY notifiera, sans d\u00e9lai indu, toutes les parties concern\u00e9es par cette action (par exemple, les cr\u00e9anciers, le syndic de faillite) que toutes les Donn\u00e9es Client faisant l'objet de ces proc\u00e9dures sont la propri\u00e9t\u00e9 du Client et rel\u00e8vent de sa responsabilit\u00e9, et que les Donn\u00e9es Client sont \u00e0 la disposition exclusive du Client.<\/p>\n\n

13. Entire Agreement; Conflict; Amendment<\/h2>\n\n

This DPA incorporates the Standard Contractual Clauses by reference. Except as amended by this DPA, the Agreement will remain in full force and effect. If there is a conflict among the Standard Contractual Clauses, this DPA, and the Agreement concerning the processing of Customer Data, the Standard Contractual Clauses will control first, this DPA will control second, and the Agreement will control third. For all other matters, the Agreement controls. Nothing in this document varies or modifies the Standard Contractual Clauses. This DPA may be amended in accordance with Section 14.1 of the Agreement, provided that MAPSLY will provide Customer with advance notice of any amendment that materially reduces the protections afforded to Customer Data under this DPA.<\/p>\n\n

14. Google Workspace API Data<\/h2>\n\n

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.<\/p>\n\n

Annex A \u2014 Technical and Organizational Measures<\/h2>\n\n

MAPSLY maintains the following technical and organizational measures to protect Customer Data. MAPSLY may update these measures from time to time, provided that no update materially reduces the overall security of the Services.<\/p>\n\n