Agreement on the protection of your customers' data

Your data remains yours. ORILA keeps it for you, and uses it for nothing else.

This agreement on the protection of your customers' data (the “Agreement”) supplements ORILA's terms of use and terms of sale (together, the “Contract”). It meets the requirements of article 28 of Regulation (EU) 2016/679 of April 27, 2016 (the “GDPR”). Version 2 of October 13, 2026.

It is entered into between:

• the Client: the legal entity or the individual acting in a professional capacity who has opened a space (an “organisation”) in the ORILA service, acting as controller;
• C2SL, a simplified joint-stock company (SAS) with a share capital of 100 €, 6 rue Soutrane, 06560 Valbonne, RCS Grasse 892 281 510, publisher of the ORILA service, acting as processor.

The Client accepts the Agreement by accepting the Contract. The Agreement forms part of the Contract: in the event of a conflict regarding the protection of personal data, the Agreement prevails.

1. Purpose

The Agreement sets out the conditions under which C2SL processes, on behalf of the Client and solely on its instructions, the personal data that the Client records in the ORILA service or that the service collects for it (the “Data”).

It does not apply to the processing for which C2SL is itself the controller: management of the Client's account and subscription, C2SL's invoicing, the security of the service and the prevention of abuse, and audience measurement on the orila.co site. These are described in the privacy policy.

2. Description of the processing

• Subject matter: provision of online business management software (customer relationship management, sales, invoicing, secretarial work, documents, team).
• Duration: that of the Contract, extended by the return period provided for in article 11.
• Nature: hosting, recording, organisation, consultation, making available, transmission on the Client's instruction, erasure.
• Purpose: to enable the Client to manage its business by means of the service.
• Types of data and categories of data subjects: see Annex 1, processing by processing.
• Sensitive data: the service is not designed for health data or other special categories of data (article 9 of the GDPR). The Client undertakes not to record any in it.

3. Client's instructions

3.1 C2SL processes the Data only on the Client's documented instructions. These instructions consist of: the Contract, the Agreement, and the settings and actions that the Client carries out in the service (creating a record, sending a letter, sharing a document, enabling an option, connecting a third-party service, deleting a piece of data).

3.2 C2SL never uses the Data for its own purposes, does not sell it, does not rent it out and does not use it to train an artificial intelligence model.

3.3 If an instruction appears to it to infringe the GDPR or any other data protection rule, C2SL informs the Client immediately.

3.4 If Union or Member State law requires C2SL to carry out processing not provided for (a judicial requisition, for example), it informs the Client before doing so, unless that law prohibits it on important grounds of public interest.

4. Confidentiality

The persons at C2SL authorised to process the Data are bound by confidentiality by contract or by a statutory obligation, and access it only to the extent necessary for the performance of the Contract, for support requested by the Client or for the security of the service.

5. Security

C2SL implements the technical and organisational measures described in Annex 3 to ensure a level of security appropriate to the risk (article 32 of the GDPR). It may update them, provided that it never lowers their level.

6. Our providers

6.1 The Client gives C2SL general authorisation to use the providers listed in Annex 2 (the “Providers”, sub-processors within the meaning of article 28 of the GDPR).

6.2 C2SL informs the Client of any addition or replacement of a Provider at least thirty days before it receives any Data, by a message in the service and by e-mail to the organisation's administrator. The Client may object during this period, in writing and on grounds relating to data protection. Failing agreement within thirty days following the objection, the Client may terminate the part of the Contract concerned free of charge, and C2SL refunds to it, pro rata, the share of the subscription paid in advance.

6.3 C2SL imposes on each Provider, by contract, data protection obligations at least equivalent to those of the Agreement. It remains fully liable to the Client for their performance.

6.4 The services that the Client connects itself, with its own credentials (its bank, its accounting platform, its professional WhatsApp messaging, its own mail server), are not Providers of C2SL: they are chosen by the Client and governed by the contract it has concluded directly with them. C2SL transmits Data to them only on the Client's instruction, given through that connection.

7. Transfers outside the European Union

The Data is hosted in Europe. Where a Provider established outside the European Union may access it, the transfer is governed by an adequacy decision (including the EU–US Data Privacy Framework, for a certified provider) or by the standard contractual clauses adopted by the European Commission (Decision 2021/914). Annex 2 indicates, for each Provider, the location and the safeguard.

8. Rights of data subjects

8.1 C2SL assists the Client, by appropriate technical and organisational measures, in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection). The service allows the Client to consult, correct, export and delete the Data itself.

8.2 If a person contacts C2SL directly about Data processed for the Client, C2SL does not reply on the substance: it forwards the request to the Client within five working days and informs the person accordingly.

9. Personal data breach

9.1 C2SL notifies the Client of any personal data breach affecting the Data without undue delay, and no later than forty-eight hours after becoming aware of it, by e-mail to the organisation's administrator.

9.2 The notification contains, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the contact at C2SL. Elements not yet known are provided as soon as they are.

9.3 It is for the Client, as controller, to notify the breach to the supervisory authority and, where applicable, to the data subjects (articles 33 and 34 of the GDPR). C2SL assists it in doing so.

10. Assistance to the Client

C2SL assists the Client, taking into account the nature of the processing and the information available to it, in meeting its obligations relating to security, data breaches, data protection impact assessments and prior consultation of the authority (articles 32 to 36 of the GDPR). This assistance is free of charge where it concerns the service itself; tailor-made assistance beyond that may be subject to a prior quotation.

11. Fate of the Data at the end of the Contract

At the end of the Contract, and at the Client's choice, C2SL returns the Data to it or erases it, under the conditions of the article “Data, reversibility and backup” of the terms of sale: export at any time and free of charge, a thirty-day transition period on request, Data retrievable for thirty days after the end of the service, then complete erasure. Backup copies, kept solely to restore the service after an incident, are erased at the end of their rotation cycle. Only the Data that Union or Member State law requires to be retained is kept, and only for the period required.

12. Audit and information

12.1 C2SL makes available to the Client all the information necessary to demonstrate compliance with article 28 of the GDPR, and allows for audits, including inspections, to be conducted by the Client or an auditor mandated by it.

12.2 So as not to compromise the security of other clients, an audit is requested in writing with thirty days' notice, covers what concerns the Client, and is conducted during working hours by an auditor bound by confidentiality and not a competitor of C2SL. The Client bears its cost, unless the audit reveals a breach of the Agreement by C2SL. Replies are first given in writing and by documents; an on-site inspection takes place only if those replies are not sufficient, or at the request of a supervisory authority.

13. Record of processing

C2SL keeps a record of the categories of processing activities it carries out on behalf of its clients (article 30, paragraph 2, of the GDPR).

14. Client's obligations

The Client warrants that it has a legal basis for the processing it entrusts to C2SL, that it has informed the data subjects under the conditions of articles 13 and 14 of the GDPR, in particular the recipients of its mailings and shares, and that it gives no instruction contrary to the GDPR.

15. Liability

Each party answers for its own breaches under the conditions of article 82 of the GDPR. The limitation of liability provided for by the terms of sale applies to the Agreement, except in the case of gross or intentional misconduct.

16. Duration and amendment

The Agreement applies for as long as C2SL processes Data for the Client. C2SL may amend it to keep pace with changes in the law or the service; any amendment that reduces the protection of the Data is notified thirty days in advance, with the same right of termination as in article 6.2. The version in force is published on this page.

17. Applicable law

The Agreement is governed by French law. Disputes fall within the jurisdiction of the courts designated by the terms of use.

Annex 1 — Processing carried out for the Client

• Portfolio and customer relationship — identity, business contact details, position, company, notes, exchanges, meetings, tasks, deals · the Client's customers, prospects and contacts · until deleted by the Client, then in accordance with article 11.
• Sales and invoicing — billing identity and contact details, company identification and VAT numbers, quotes, invoices, payments; when a customer of the Client accepts or declines a quote from its link, the proof of their answer: date and time, network address and browser, digital fingerprint of the quote as it was displayed, reason for declining if they choose one · the Client's customers · until deleted by the Client; issued invoices are kept in accordance with the Client's accounting obligations, and the proof of an answer for as long as the Client keeps the quote.
• Online signature (quote or other document) — name and email address of the signatory as entered by the Client, name typed and signature drawn by the signatory, date and time of each step (sending of the link, first opening, sending of the code, signature or refusal, with the reason for refusing if they choose one), network address and browser at the first opening, when the code is requested and when signing or refusing, digital fingerprint of the document recalculated at the moment of signing; the code received by email is kept only as a fingerprint, never in readable form · signatories designated by the Client · for as long as the Client keeps the proof file, then in accordance with article 11.
• Mail (connected mailbox, mailings, campaigns) — addresses, names, content of messages and attachments, a contact's consent to receive messages · the Client's correspondents and recipients · until deleted by the Client (a message moved to the trash is erased after 30 days).
• Documents — content of the files uploaded by the Client · any person mentioned in those documents · until deleted by the Client (trash emptied after seven days).
• Viewing counters for shares — for each share: number and time of link openings, of each document or page, of video plays and of downloads, in their order; no network address, no browser, no cookie, no information about the person; the browser type is read in passing to exclude bots, without being kept · recipients of the Client's shares and short links · until the Client stops the share, and at the latest twelve months after the last opening.
• Events — identity, contact details, reply, attendance, dietary preferences if the guest provides them · the Client's guests · until deleted by the Client.
• Team — identity, role, access, internal messages · members of the Client's team · until deleted by the Client.
• Import of an existing file — content of the uploaded file; if the Client so requests, column headings and a few rows sent to Mistral AI · persons appearing in the file · for the duration of the import, then in accordance with the processing above.
• Team of agents (option) — excerpts of the record concerned, content of the received emails an agent reads, and the Client's instruction, sent to Mistral AI · persons appearing in those records and senders of those emails · for the duration of the request, without being used to train the provider's models.

Annex 2 — Our providers

• Cloudflare, Inc. — hosting of the application, file storage, delivery of pages · storage in Europe; company established in the United States · EU–US Data Privacy Framework (active certification noted on September 14, 2026), standard contractual clauses held in reserve.
• Neon, Inc. — database · Europe; company established in the United States · standard contractual clauses.
• Amazon Web Services — delivery of e-mails · Paris region; company established in the United States · standard contractual clauses.
• Brevo — delivery of e-mails, as a fallback solution · France.
• Mistral AI — processing of requests to the agents, of the received emails they read and of file imports, if the Client enables it · Europe.

Annex 3 — Security measures

• Encrypted communications (HTTPS/TLS) between the browser and the service.
• Partitioning of each organisation: each piece of data carries the identifier of its organisation, and filtering is applied automatically by the server on every request.
• Rights by role and by department within an organisation.
• Log of abuse attempts, internal alerts and graduated measures, described in the terms of use.
• Limitation of login attempts.
• Files served with protections against their execution in the browser; shared pages displayed on a separate domain.
• Public demonstration in read-only mode, on fictitious data.
• Database backups, kept solely to restore the service after an incident.

Contact

For any question about this Agreement: [email protected].