← Back to home

Data Processing Agreement

Last updated: October 2026

This agreement (the "DPA") supplements the terms and conditions and governs the processing of personal data carried out by Factella on behalf of the customer, in accordance with Article 28 of the GDPR.

1. Roles of the parties

The customer (the store using Factella Pro) acts as the controller. The Publisher of Factella (identified in the legal notice) acts as the processor, and processes the data only on the customer's documented instructions.

2. Description of processing

Item	Detail
Nature & purpose	Transmission of electronic invoices and e-reporting data to an approved platform (PA); receipt of supplier invoices
Categories of persons	Customers, suppliers and business contacts of the store
Categories of data	Business identity & contact details, company identifiers (SIREN/SIRET, VAT), invoice amounts and line items
Duration	Duration of the subscription; invoice contents are not retained

3. Processor's obligations

• Process the data only on the customer's documented instructions;
• Ensure the confidentiality of persons authorised to process the data;
• Implement appropriate technical and organisational measures (encryption of tokens in transit and at rest, restricted access, encrypted backups in France);
• Use only the sub-processors listed below;
• Assist the customer with requests to exercise rights and with data breaches;
• Notify the customer of any data breach as soon as possible;
• Delete the data at the end of the service, except where there is a legal obligation to retain it.

4. Sub-processors

The customer authorises the use of the following sub-processors:

Sub-processor	Role	Location
SUPER PDP	Approved platform (PA, formerly PDP) — transmission of invoices and e-reporting	France / EU
OVHcloud (OVH SAS)	Hosting of the relay service and backups	France
Freemius, Inc.	Payment and subscription management (Merchant of Record)	Outside the EU — covered by appropriate safeguards

The Publisher will inform the customer of any intended change of sub-processor, so as to allow the customer to raise objections.

5. Location and transfers

The service data is hosted in France. Any transfer outside the European Union (for example for payment management) is covered by appropriate safeguards in accordance with Chapter V of the GDPR.

6. Security

Security measures include HTTPS encryption of exchanges, encryption at rest of access tokens, hardened hosting (firewall, key-based SSH access, automatic security updates) and daily encrypted backups retained for 14 days.

7. Audit

The Publisher makes available to the customer the information necessary to demonstrate compliance with the obligations of this agreement and may contribute to reasonable audits, upon written request.

8. Contact

For any question relating to this agreement: contact@getfactella.com.