Data processing agreement (GDPR article 28)

Subject, duration, nature and purpose

Hosting and processing workspace content to provide the service described in the terms, for the length of the contract and until the data is deleted.

Data and data subjects

• Data subjects: the agency’s members, its clients’ contacts, and anyone mentioned in the content.
• Data: identity and contact details, messages, briefs, files and designs, comments, technical logs.
• The agency does not upload special categories of data (art. 9) unless necessary and lawful.
• The agency informs data subjects of its own processing, including its use of BeBrief as a processor. BeBrief’s documents, which invited people see, do not replace that information.

Processor commitments

• Process data only on the agency’s documented instructions, including for transfers outside the EU.
• Never process the data for its own purposes; in particular, never use it for its creative studio work, to solicit the agency’s clients or to train an AI model.
• Limit support access to the duration and scope an agency owner authorises; every access is logged and visible to the agency.
• Bind authorised people to a written duty of confidentiality that survives the end of their engagement.
• Implement and maintain the security measures in the annex.
• Help the agency answer data subject requests: export, rectification and erasure are built into the app.
• Notify the agency of any personal data breach affecting it within 48 hours of becoming aware of it, with what it needs for its own notification to the supervisory authority.
• Assist the agency with impact assessments and prior consultations.
• At the end of the contract, return the data (full export) then delete it within 30 days, backups within a further 30 days.
• Make available the information needed to demonstrate compliance and allow audits, with reasonable notice.

Sub-processors

The agency authorises the sub-processors listed on the Sub-processors page. Any addition or replacement is announced at least 30 days ahead; the agency may object on reasonable grounds and, failing agreement, terminate without charge.

Each sub-processor is bound in writing to the same data protection obligations.

Transfers outside the European Union

Data is hosted in the EU. The only transfers are content given to the assistant, sent to OpenAI and Anthropic (United States), and text extracts sent to TypeSafe: OpenAI under the EU–US Data Privacy Framework and the standard contractual clauses, Anthropic under [base du transfert vers Anthropic : DPF et/ou clauses contractuelles types], TypeSafe under the standard contractual clauses.

Annex: security measures

• Each agency is isolated in the database itself (row-level security, enforced even on the application account).
• The application account has no administrative privilege; it can neither bypass isolation nor change the schema.
• Encryption in transit (HTTPS, HSTS) and strict security headers (CSP, no framing).
• Passwordless sign-in with single-use links valid for 30 minutes; sessions can be revoked at any time.
• Figma access keys are encrypted with AES-256-GCM.
• BeBrief staff see metadata only (project counts, storage used); an agency’s clients appear only as “Client”, with no name, email or domain. Access to an agency’s content needs a time-limited permission granted by one of its owners and shown in its log.
• Audit log of sign-ins, administrative actions and support access.
• Rate limiting, read-only unprivileged containers.
• Encrypted off-server backups, with restore tests.