AeroCertLink — Data Processing Agreement

1.1 This DPA applies to personal data that the Customer submits to the Platform concerning its own staff, contacts or other individuals, and that AeroCertLink processes solely on the Customer’s behalf (“Customer Personal Data”). For that data, the Customer is the controller and AeroCertLink the processor.

1.2 Where the Customer uses a service governed by Service-Specific Terms (for example, a service for the encrypted storage of technical data), those terms may complement this DPA, in particular as to encryption, key management and data location. Where Customer Personal Data is encrypted in such a way that AeroCertLink cannot access it, AeroCertLink’s assistance obligations under sections 8 and 10 are limited to what is technically possible.

1.3 This DPA does not apply to personal data that AeroCertLink processes as an independent controller, as described in its Privacy Policy: in particular Users’ account and profile data, declared Designations, Engagement Records, evidence of acceptance of the Terms, security logs and reports of unlawful content.

3.1 AeroCertLink processes Customer Personal Data only on the Customer’s documented instructions, which consist of this DPA, the Terms and the Customer’s use of the features of the Platform, unless required to do otherwise by European Union or Member State law. In that case, AeroCertLink informs the Customer of that legal requirement before processing, unless that law prohibits it.

3.2 AeroCertLink immediately informs the Customer if, in its opinion, an instruction infringes Data Protection Laws.

3.3 The Customer is responsible for the lawfulness of the processing it instructs, in particular for having a legal basis and for informing the data subjects.

AeroCertLink ensures that every person authorised to process Customer Personal Data is bound by an obligation of confidentiality, and that access is limited to what is strictly necessary for the performance of the service.

AeroCertLink implements the technical and organisational measures described in Annex 2, appropriate to the risk, within the meaning of Article 32 GDPR. It may update them provided that the overall level of security is not reduced.

6.1 The Customer gives AeroCertLink a general authorisation to engage the sub-processors listed in Annex 1.

6.2 AeroCertLink informs the Customer of any intended addition or replacement of a sub-processor at least fifteen (15) days in advance, by e-mail or in the Platform. The Customer may object within that period on reasonable grounds relating to data protection. If the parties cannot resolve the objection, the Customer may close its account before the change takes effect, without penalty.

6.3 AeroCertLink imposes on each sub-processor, by contract, data protection obligations providing at least the same level of protection as this DPA. AeroCertLink remains fully liable to the Customer for the performance of its sub-processors’ obligations.

7.1 Customer Personal Data is stored in the European Union (Paris, France).

7.2 Where a sub-processor processes Customer Personal Data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission (in particular the EU–US Data Privacy Framework for certified companies) or, failing that, on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, incorporated into the sub-processor’s contract. Module Three of the standard contractual clauses applies to transfers from AeroCertLink to its sub-processors.

8.1 Data subject requests. AeroCertLink assists the Customer, by appropriate technical and organisational measures and insofar as possible, in responding to requests from data subjects to exercise their rights. If AeroCertLink receives such a request directly, it forwards it to the Customer without undue delay and does not respond itself, unless instructed.

8.2 Other obligations. Taking into account the nature of the processing and the information available to it, AeroCertLink assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation).

9.1 AeroCertLink notifies the Customer of any personal data breach affecting Customer Personal Data without undue delay, and at the latest within forty-eight (48) hours of becoming aware of it.

9.2 The notification describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at once is provided in stages.

9.3 AeroCertLink takes without delay the measures necessary to contain the breach and mitigate its effects, and documents each breach in its incident register.

At the end of the Customer’s use of the Platform, AeroCertLink, at the Customer’s choice, returns Customer Personal Data in a structured, commonly used and machine-readable format, or deletes it, within thirty (30) days. Copies held in backups are deleted on their normal cycle, within seven (7) days, and remain protected by this DPA until deleted. This does not apply to data that Union or Member State law requires AeroCertLink to keep.

11.1 AeroCertLink makes available to the Customer all information necessary to demonstrate compliance with this DPA, including its sub-processors’ security certifications and reports where available.

11.2 The Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once per twelve (12) months except following a personal data breach or at the request of a supervisory authority, on thirty (30) days’ written notice. The audit is limited to the processing covered by this DPA, must not disrupt the service or give access to other customers’ data, and is at the Customer’s expense.

AeroCertLink maintains a record of the processing activities it carries out on behalf of its customers (GDPR Art. 30(2)) and cooperates with the supervisory authorities on request.

13.1 Each party’s liability under this DPA is governed by the Terms, without prejudice to the rights of data subjects under Article 82 GDPR.

13.2 In case of conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails.

13.3 This DPA remains in force for as long as AeroCertLink processes Customer Personal Data.

Encryption of data in transit (TLS) and at rest (encryption managed by the hosting provider).

Access control in the database: row-level security policies on every table containing business data; server-side authorisation checks on every action that writes data.

Separation of Users: an Organisation never sees another Organisation’s data; an Expert sees an Organisation’s name only once engaged on the relevant Position, unless the Organisation chooses otherwise.

Administrator access: limited to named administrators, with multi-factor authentication on the database and hosting consoles, and logging of administrative actions (actor, action, target, date, reason).

Secrets: kept in the environment configuration, never in the code delivered to browsers.

Web security: security headers (content security policy, strict transport security); limits on the rate of creation actions per account.

Separate environments: test data is never copied into production, and production data is never copied into test environments.

Backups: automatic daily backups, retained for seven (7) days.

Change control: every change to the database structure is reviewed and tested on a test environment before being applied to production.

Incident management: written breach procedure and incident register.

AI tools: no artificial intelligence tool or agent has access to personal data in the production environment. Checks carried out in production after a change use test accounts only.