Data Processing Agreement (DPA)

In the event of a discrepancy, the French version prevails, subject to any mandatory rules applicable to the customer. The reference version is available at /fr/legal/dpa.

Version 2.2 — In force from 13 September 2026

1. Parties and scope

This data processing agreement, hereinafter the "DPA", forms part of the LinkyFlow Terms concluded between:

• the Business Customer using LinkyFlow, acting as controller or as processor on behalf of another controller, hereinafter the "Customer"; and
• GOLDEN F, a French société par actions simplifiée unipersonnelle located at 21 avenue Pasteur, 92400 Courbevoie, France, RCS Nanterre 998 971 410, acting as processor, hereinafter "GOLDEN F".

The DPA applies only to the extent that GOLDEN F processes, on behalf of the Customer, personal data contained in the Customer Data or coming from connected Providers.

Processing for which GOLDEN F itself determines the purposes, in particular account management, billing, the general security of the Service and its legal obligations, falls under the privacy policy and not under this DPA.

2. Duration

The DPA takes effect at the same time as the LinkyFlow contract and remains applicable for as long as GOLDEN F processes personal data on behalf of the Customer, including during the limited period necessary for its return, deletion or the expiry of backups.

3. Subject matter, nature and purposes

GOLDEN F processes the data solely in order to:

• connect the Providers chosen by the Customer;
• receive, query, transform, transmit and display the requested data;
• carry out the queries, tasks, exports and actions requested by the Customer;
• provide hosting, maintenance, security and support for the Service;
• follow written instructions compatible with the contract and the regulations.

Operations may include collection, consultation, organisation, transmission, temporary transformation, encryption, limited caching, deletion and, where the Customer enables it, sending a write instruction to the Provider.

GOLDEN F does not use this data for advertising, resale, training an artificial intelligence model or any incompatible purpose of its own.

4. Data subjects and data concerned

Depending on the Providers and the Customer's choices, the data subjects may be the Customer's employees, representatives, customers, prospects, suppliers, partners, users, account holders or counterparties.

The data may include:

• identity, contact details and professional identifiers;
• account and order information;
• products, stock, transactions, payments, invoices and history;
• usage data and technical identifiers;
• financial data or data relating to assets where accessible in the Provider;
• any other data the Customer makes accessible through the connector.

The Service is not designed to process health, biometric or genetic data, data relating to beliefs, sex life or offences, or other particularly sensitive categories. The Customer must not deliberately connect such data without prior written agreement, a risk analysis and appropriate measures.

5. Documented instructions

The Terms, the account settings, the configuration of the connections, the Customer's queries and actions and their compatible written instructions constitute the documented instructions.

GOLDEN F processes the data solely on those instructions, save where required by European Union or Member State law. In that case, it informs the Customer before the processing, unless legally prohibited.

If GOLDEN F considers that an instruction infringes personal data regulations, it informs the Customer and may suspend the instruction concerned until clarified.

6. Confidentiality and access

The persons authorised to process the data are subject to a duty of confidentiality and have only the access necessary for their duties. Production access is restricted, authenticated, logged and reviewed periodically.

Support must never ask for a complete Provider secret. Exceptional access to data to resolve an incident must be necessary, proportionate and traceable.

7. Security

GOLDEN F implements the measures described in annex 2 and maintains a level of security appropriate to the risks, taking into account the state of the art, the costs, the nature of the data and the possible consequences for the persons concerned.

It may change the measures without materially reducing the overall level of protection.

8. Subprocessors

The Customer grants GOLDEN F general authorisation to use the subprocessors published at /legal/subprocessors.

GOLDEN F imposes on each subprocessor protection obligations that are substantially equivalent for the processing entrusted to it, and remains responsible for its own obligations in accordance with the GDPR.

GOLDEN F informs Business Customers subscribed to notifications before a subprocessor is added or replaced. Where possible, the notice is fifteen days. An urgent change necessary for security, continuity or compliance with the law may take place sooner, with information given without undue delay.

During the notice period the Customer may raise a reasoned objection concerning data protection. The parties look for a reasonable solution. If no solution allows the processing concerned to continue lawfully, the Customer may stop using the affected function or terminate the part of the Service concerned.

9. International transfers

GOLDEN F transfers data outside the European Economic Area only if the conditions of chapter V of the GDPR are met.

Depending on the provider, the transfer relies on an adequacy decision applicable to the entity concerned or on the European Commission's standard contractual clauses, supplemented where necessary by an assessment and additional measures.

The Customer mandates GOLDEN F to enter into, on its behalf where necessary, the standard contractual clauses with the subprocessors. Information on the locations and mechanisms appears at /legal/subprocessors.

10. Data subject rights

Taking into account the nature of the processing, GOLDEN F assists the Customer, by appropriate technical and organisational measures, in responding to requests for access, rectification, erasure, restriction, objection and portability.

If GOLDEN F receives directly a request concerning data processed for the Customer, it forwards it to the Customer without answering on the merits, save on the Customer's instruction or a legal obligation.

The Customer remains responsible for the decision to take and for verifying the identity of the requester.

11. Regulatory assistance

GOLDEN F provides the Customer with the information reasonably available to help it comply with its obligations relating to security, breaches, impact assessments and prior consultations, taking into account the nature of the processing.

Exceptionally extensive assistance, specific to the Customer and not attributable to a failure by GOLDEN F, may be subject to a prior quotation.

12. Personal data breach

GOLDEN F informs the Customer without undue delay after becoming aware of a breach affecting the data processed on its behalf.

The available information progressively includes the nature of the incident, the categories of data and of persons, the likely consequences, the measures taken or proposed and a point of contact. A first notification may be completed as the investigation progresses.

GOLDEN F's notification does not amount to an admission of fault or a conclusion on the Customer's obligation to notify an authority or a person.

13. Return and deletion

During the contract, the Customer uses the available export functions and keeps its own copies where necessary.

At the end of the Service or on a lawful instruction, GOLDEN F deletes or returns the personal data processed for the Customer, save a legal retention obligation. Active data is deleted within thirty days. Backup copies become inaccessible for ordinary use and expire in their protected cycle, at the latest within thirty-five days, save a documented legal hold.

Data already written into a workbook, a Customer system, an MCP client or an external service chosen by the Customer is not under GOLDEN F's control and must be deleted by the Customer in those environments.

14. Information and audits

GOLDEN F makes available the information necessary to demonstrate compliance with article 28 GDPR, in particular this DPA, the list of subprocessors, the security measures and the attestations reasonably available.

Once per twelve-month period, save an incident or a request from an authority, the Customer may request a documentary audit with reasonable notice. An on-site audit is contemplated only if the available documents are insufficient, during business hours, without access to other customers' data and subject to a duty of confidentiality.

The costs of the audit are borne by the Customer, unless the audit reveals a material failure by GOLDEN F.

15. Customer obligations

The Customer:

• determines the lawfulness, the purposes and the duration of its processing;
• informs the data subjects and collects the necessary consents;
• chooses appropriate Providers and authorisations;
• limits the data to what is necessary;
• protects its accounts, devices, workbooks, keys and exports;
• does not send unlawful or particularly sensitive data without an appropriate framework;
• responds to requests from data subjects and authorities;
• checks that its instructions comply with the law.

16. Liability and order of precedence

The liability of the parties is governed by the Terms, without limiting the rights of data subjects or the liabilities which cannot be limited by law or by the standard contractual clauses.

In the event of a contradiction concerning the protection of data processed on behalf of the Customer, this DPA prevails over the Terms. The applicable standard contractual clauses prevail over the DPA in the event of a contradiction.

17. Contact

Any request relating to the DPA may be addressed to contact@linkyflow.com.

Annex 1 — Description of the processing

Item	Description
Subject matter	provision of the LinkyFlow connectors, queries, processing, exports and actions
Duration	the term of the contract, then a limited period for return, deletion and expiry of backups
Frequency	according to the queries, tasks and connections configured by the Customer
Nature	access, collection, consultation, transformation, transmission, limited caching, encryption and deletion
Purposes	providing, securing, maintaining and supporting the functions requested by the Customer
Data subjects	the Customer's employees, customers, prospects, suppliers, partners, users, account holders and counterparties
Data	identity, contact details, accounts, orders, products, stock, transactions, payments, history and technical data accessible in the Providers
Target retention	transient processing; caches of 24 hours maximum; settings kept until deleted; end of contract per article 13

Annex 2 — Technical and organisational measures

GOLDEN F maintains at least the following measures:

1. TLS encryption of communications;
2. encryption at rest of databases, backups and secrets;
3. separate management of keys and secrets, with no display in clear again;
4. strict logical isolation of data per Customer;
5. least privilege and periodic review of production access;
6. strong authentication for administrative access where available;
7. masking of tokens, keys, card data and Provider content in logs, errors and analytics tools;
8. logging of security events and monitoring of anomalies;
9. encrypted backups, tested restores and a documented expiry cycle;
10. management of dependencies, patches and vulnerabilities;
11. reasonable separation of development, test and production environments;
12. automated tests and reviews of sensitive changes;
13. a procedure for detecting, qualifying, containing and notifying incidents;
14. a tested deletion and purge procedure;
15. contractual framing and review of subprocessors;
16. continuity and recovery appropriate to the criticality of the Service.

Annex 3 — Subprocessors

The up-to-date list is available at /legal/subprocessors and is incorporated into this DPA.