Data processing agreement Tracelia.

Version 2.0 · October 28, 2026. This document is part of the Tracelia contract, with the terms of sale. English translation: the French text is the reference (version française). Download PDF · printable version

Additional specifications for this version: payment and access evidence is limited to Organisation, subscribed Experts, dates, contractual references and payment states; non-Expert accounts are not billed through a register of all members. Service improvement does not authorise reuse of raw case content. Only aggregate or irreversibly anonymised information without reidentification can support a separate own purpose; pseudonymised personal content remains subject to instructions. Retained dictation transcripts, annotations, approvals and related metadata are included in the entrusted data. Microphone and camera permissions are requested when needed. Any audio flow is limited to requested dictation; collection, recipients and retention are disclosed before activation, without authorising permanent recording. Free return includes content generated and retained during a cancelled trial, even though formatted PDF/Word downloads require a paid subscription.

1. Parties and roles

The Client determines its assignment purposes and case file contents, acting as controller or as a processor authorised by its own customer. In the latter case it supplies necessary instructions and permissions. Global Expertises, SAS with EUR 1,000 capital, Toulouse registration 911 366 698, 59 allées Jean Jaurès, 31000 Toulouse, France, acts as the Client's processor for contracted case management, storage, analysis, return and assistance functions.

Global Expertises uses FortyTwoFlow SAS, Montpellier registration 989 717 541, 73 Allée Kléber, 34000 Montpellier, France, as subprocessor publishing and technically operating Tracelia. It imposes this agreement's obligations and remains responsible to the Client for compliance throughout the processing chain. The contractual contact is contact@global-expertises.fr; the technical data protection contact is contact@fortytwoflow.ai.

Global Expertises' independent commercial, billing and legal-claims purposes are described in the privacy notice. The operator is responsible for its own account, platform security and statutory purposes and corresponding notice. None permits independent reuse of raw Client case files. Payment and access evidence is limited to necessary Organisation, subscribed Expert, contractual and payment-state references without routinely copying case contents. Purpose, permissions and retention are documented before implementation.

2. Description of entrusted processing

The service is not intended to process special categories under GDPR Article 9 or criminal conviction and offence data under Article 10. The Client removes or masks unnecessary such data before import. Exceptional processing requires written instructions, an appropriate legal basis and suitable measures agreed beforehand. Importing a document alone does not satisfy this check.

3. Instructions and Client duties

The contract, intended use of functions, Client-configured permissions and documented requests constitute initial instructions. Additional instructions are sent by an authorised person to contact@global-expertises.fr. Global Expertises processes only on these instructions, including transfers, unless required by law; it informs the Client beforehand unless prohibited.

The Client ensures lawful data, information to individuals, access permissions and retention periods. It minimises imports, checks invitation recipients and maintains emergency contacts. Global Expertises immediately flags instructions apparently contrary to data protection rules and suspends only the affected operation pending clarification. It does not determine the purposes of the Client's assignments.

4. Confidentiality and content access

Authorised personnel are bound to appropriate confidentiality, trained and permitted access on a need-to-know basis. Permissions are removed when no longer justified. Support access to case contents is limited to a request or documented incident necessity, verified, logged and ended afterwards. Emergency security intervention is justified and reported to the Client as soon as possible.

One Client's data is not disclosed to another or used to train models, enrich a shared client document base or create demonstrations without a separate specific agreement. Irreversibly anonymous statistics may improve operations only if they cannot reconstruct a case, professional secret or person. Pseudonymisation alone does not remove data from this agreement.

5. Technical and organisational measures

Global Expertises requires risk-appropriate protection considering current knowledge and data nature: TLS in transit; encryption of databases and files at rest; logical separation of Organisations and cases; role-based access; protection of administrative accounts and secrets; logging sensitive actions and access; patch and vulnerability management; and incident monitoring.

Backups are encrypted, separately authorised and subject to purge periods. Restoration procedures are maintained and tested periodically. Development environments receive no identifiable production case copies without necessity, authorisation and equivalent protection. Support exchanges are minimised; diagnostic captures mask text and input and exclude secrets. Privileged access is reviewed regularly and removed after interventions.

Measures are documented, regularly evaluated and improved. Changes must not substantially reduce agreed security. No certification, independent audit, maximum recovery time or absolute absence of incidents is guaranteed. Information needed to assess measures is supplied under section 11.

6. Authorised subprocessors

The Client generally authorises the following chain only for the described services. Global Expertises checks safeguards, imposes equivalent obligations and remains responsible for performance throughout the chain. European storage alone does not guarantee absence of third-country access.

Subprocessor additions or replacements are notified at least thirty days beforehand with identity, role, processing countries and safeguards. The Client may object within that period on documented data protection grounds. The parties seek a solution preserving protection; failing one, the Client may end the affected part before new processing, without penalty and with data return and refund of unused prepayment. Security urgency is notified as soon as known and does not remove objection rights.

7. Public services and separate payment purposes

IGN Géoplateforme geocoding receives address text and, for browser calls, the user's IP address. Server calls locating properties and retrieving maps do not pass that IP. Géorisques receives necessary address, coordinates or municipality code for risk information. These public bodies process under their own missions and notices; they receive neither complete case files nor billing data. Using the relevant functions instructs these lookups; the Client minimises addresses supplied.

Stripe receives information needed for card registration, the deferred-payment order accepted at registration, early payments, billing, security and financial obligations. No Tracelia payment is collected on registration. Monthly billing starts after the trial unless cancelled, under the accepted summary and reminder; early activation requires separate confirmation. Stripe receives no assessment documents for payment. Optional retention for another purchase differs from the payment method needed for the accepted contract. Its own purposes and collection notice are described in the privacy policy.

8. International transfers and authority requests

Transfers outside the European Economic Area, including remote access, comply with GDPR Chapter V. Before transfer, Global Expertises verifies an applicable adequacy decision or appropriate safeguards, including the relevant module of Decision (EU) 2021/914 standard clauses, destination-law assessment and necessary supplementary measures. A provider's European headquarters alone is insufficient. The Client may obtain safeguards with only legitimately protected secrets redacted.

Main application storage is in France; Sentry diagnostics are stored in Germany. OpenAI functions and provider access may involve the United States. The service is not represented as fully sovereign or free of international transfers. New locations or transfer mechanisms altering the chain follow section 6 notice and objection rules.

Global Expertises and the operator examine authority requests for legality, challenge manifestly unlawful demands where legally possible and disclose only required data. The Client is informed before disclosure unless prohibited; lawful steps to lift prohibitions are taken where possible. Non-personal data held in the Union is also protected against international governmental access contrary to Union law under Regulation (EU) 2023/2854.

9. Rights breaches and regulatory assistance

Requests concerning a Client-controlled case are forwarded without undue delay and no later than two working days. Global Expertises does not respond substantively without instructions unless legally required. It assists with search, access, correction, restriction, objection, erasure and applicable portability. The Client remains responsible for statutory deadlines; other clients' data is not exposed.

Global Expertises notifies the Client of a relevant personal data breach without undue delay after awareness, without waiting for full analysis. The Organisation contact receives the alert, supplemented as facts emerge: nature, approximate categories and volumes, likely consequences, measures and follow-up contact. The incident is documented, evidence preserved and containment and correction supported. Notification is not conditional on high risk.

The Client decides notifications owed to authorities and individuals. Global Expertises supplies information needed for the controller's applicable seventy-two-hour deadline under Article 33 and assists with security, impact assessments and prior consultations under Articles 32-36, considering the processing and available information. Ordinary assistance and assistance caused by provider breach are included. Exceptional work unrelated to that breach requires a prior quotation and cannot delay a legal duty.

10. Return retention and erasure

During the trial and any subsequent subscription, data is retained on Client instructions to provide the service. At the end of a cancelled trial not followed by a subscription, or at subscription end, the Client chooses return or erasure, respecting at least thirty calendar days of free recovery after any switching transition. Recovery requires no purchase. Purchasing retains data in the same workspace without trial-end erasure. Earlier erasure requires an authenticated written request, warning of irreversible consequences and confirmation; it is not inferred from expiry or non-renewal alone.

Active data is erased after recovery and completed transfer. Without shorter instructions, the ordinary maximum is ninety days after account closure, extended to recovery end for ongoing switching. Residual backups are isolated, excluded from ordinary use and purged within ninety days of active erasure. Any necessary restoration reapplies deletions. Erasure confirmation is supplied on request.

Legally required retention is identified, justified, separated and limited to necessary data until the obligation expires. Invoices and contract evidence do not justify retaining entire case files. No default ten-year case retention is included.

API content sent to OpenAI is not used to train its models by default. Abuse monitoring logs may be retained for up to thirty days; some files, functions or application state have separate retention until deletion. Global Expertises minimises submissions, arranges deletion of persistent elements and does not enable training on case files. Legal or security exceptions are limited, documented and disclosed where affecting a Client request.

11. Documentation checks and audits

Global Expertises supplies compliance information and facilitates audits, including inspections, by the Client or an independent confidential auditor. Existing records take priority where sufficient. On-site inspections are arranged on reasonable notice, ordinarily fifteen working days, protecting other clients, security secrets and service availability.

An ordinary annual audit may be arranged. Frequency and notice do not restrict authority checks or audits justified by breach or serious non-compliance indicators. Exceptional audit costs absent provider breach are agreed beforehand and must not make the right ineffective. The provider bears correction costs and checks required by its breach. Findings, remedies and deadlines are documented.

12. Liability and cooperation

Each party maintains required records. Global Expertises cooperates with authorities and cannot invoke a subprocessor contract to refuse Client obligations. Individual rights and GDPR Article 82 liability are not limited. Contractual liability terms apply only insofar as lawful.

Amendments preserve protections required for entrusted processing. A disagreement preventing lawful processing leads only to suspension of the affected operation or its cessation with data return, without repurposing data. Confidentiality, security, cooperation and erasure duties continue during all residual retention.

Documents and versions

The French terms of 12 October 2026 remain applicable to contracts accepted under that version; the English summary published then is kept: see the summary of 26 October 2026. A new version does not, merely by being published, replace terms accepted under an earlier version.