Data Processing Agreement (DPA) — Livada Clarté

Between: the Customer (the “Controller”)

and: Florin Livada, sole trader, Castellane 04120, France, SIRET 44198112300025, [email protected] (the “Processor” or “Livada”).

Article 1 — Purpose

To define the terms under which Livada processes, on the Customer's behalf, any personal data contained in the content the Customer sends it for the performance of the Livada Clarté service.

Article 2 — Duration

This agreement applies for the whole duration of the Clarté subscription and until the data is deleted or returned (article 9).

Article 3 — Nature and purpose

Nature: reading, comparison and analysis of texts (official website, texts of the Google and Booking.com listings provided by the Customer), producing a report, sending it by email. Purpose: to provide the Livada Clarté service. Livada acts only on the Controller's documented instructions (this agreement, the Terms and the information entered at order).

Article 4 — Categories of data and data subjects

Data: website addresses, establishment listing texts, texts of Google listings provided by the Customer, the Customer's name and email, reports produced. This content may incidentally contain personal data (name or contact details of the manager or staff, possibly names appearing in reviews). Data subjects: managers, staff and customers of the establishment, only to the extent they are mentioned. The Controller undertakes not to submit sensitive data within the meaning of art. 9 GDPR.

Article 5 — Livada's obligations (art. 28.3 GDPR)

Livada undertakes to: (a) process the data only on the Controller's documented instructions, including for transfers, unless required by law; (b) ensure the confidentiality of authorised persons; (c) implement appropriate technical and organisational measures (art. 32); (d) comply with the conditions for sub-processing (article 6); (e) assist the Controller in responding to data-subject requests; (f) assist it with security, breach notification and impact assessments; (g) delete or return the data at the end of the service (article 9); (h) make available the information necessary to demonstrate compliance with this agreement and allow reasonable audits (article 7).

Article 6 — Sub-processors

The Controller authorises Livada to use the following sub-processors: Anthropic, PBC (United States, standard contractual clauses incorporated in its data processing terms) for analysis of texts by an artificial intelligence model; Brevo (France) to send emails; Cloudflare, Inc. (United States, EU edge preferred) for hosting and storage. Livada informs the Controller of any addition or replacement and lets it object on legitimate grounds. Livada imposes equivalent obligations on its sub-processors and remains liable for their performance. Lemon Squeezy (Merchant of Record) processes payment data on its own behalf and is not a sub-processor of Livada.

Article 7 — Audit

The Controller may, at its own expense and after reasonable notice, verify compliance with this agreement by questionnaire or documentation, at most once a year unless an incident occurs.

Article 8 — Transfers outside the European Union

Transfers to the United States (notably to Anthropic) are governed by the European Commission's standard contractual clauses (art. 46 GDPR) incorporated in the sub-processor's data processing terms, and/or by the EU-US Data Privacy Framework adequacy decision where the importer is certified.

Article 9 — Fate of the data

At the end of the subscription, the texts and addresses provided by the Customer are deleted within 90 days; reports sent are kept for 12 months then deleted, unless a legal retention obligation applies.

Article 10 — Data breach

Livada notifies the Controller of any data breach without undue delay after becoming aware of it.