Data processing agreement

The Publisher processes the data on behalf of the Customer, only to provide ChiptunePRO. The agreement lasts as long as the Customer's account, then until the data is erased as set out in section 11.

Hosting, recording, organising, consulting, modifying, displaying, sending and deleting data, so that the Customer can:

The Customer undertakes not to record in ChiptunePRO sensitive data (health, opinions, offences...) that is not needed for their business.

The Publisher processes the data only on the Customer's documented instructions. The terms of sale, this agreement and the Customer's use of ChiptunePRO features constitute these instructions. The Publisher informs the Customer if it considers an instruction to infringe data protection law.

The Publisher does not use this data for its own purposes. It does not sell it and does not use it to market to the Customer's customers.

Only the Publisher, and any person it may authorise who is bound by confidentiality, may access the data, and only when needed for the service, for support requested by the Customer or to comply with the law.

The Publisher applies the following measures, suited to the size of its business:

The Customer authorises the Publisher to use the following sub-processors. Stripe, which processes subscription payments, receives no data about the Customer's customers.

The Publisher imposes equivalent data protection obligations on each of them. It informs the Customer by email at least 30 days before adding or replacing a sub-processor; the Customer may object by cancelling their subscription at no cost before that date.

The Customer can view, correct, export or delete the data themselves in ChiptunePRO. If the Publisher receives a request directly from a data subject, it forwards it to the Customer without delay and does not answer it itself unless instructed by the Customer.

Within its means, the Publisher helps the Customer answer these requests, keep the data secure and, where needed, carry out an impact assessment.

The Publisher notifies the Customer of any personal data breach without undue delay after becoming aware of it, by email, with the information available: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences and measures taken or proposed. It adds to this information as it becomes available.

It is up to the Customer, as controller, to notify the supervisory authority and, where applicable, the data subjects.

Before deleting their account, the Customer can export their invoices from the invoicing module and ask contact@chiptunepro.com for a copy of their other data in a common format.

When the account is deleted (30 days after the request), the Publisher erases the data. Backup copies are overwritten as they rotate. The Publisher keeps no data about the Customer's customers, unless required by law.

On reasonable request, the Publisher provides the Customer with the information needed to demonstrate compliance with this agreement. An audit may be carried out by the Customer or by an independent auditor bound by confidentiality, at most once a year except after a data breach, with 30 days' notice, at the Customer's expense, and without disrupting the service or exposing other customers' data.

The Customer can place this text next to the contact form or simulator embedded on their website, completing it:

"The information you enter is intended for [garage name], the controller, to answer your request. It is hosted by ChiptunePRO, its technical provider, in the European Union. You can exercise your rights of access, rectification and erasure with [garage name] at [email]."