1. Parties, purpose and term
This agreement binds the customer Agency (the "Controller") and TECH APP STUDIO, a French SAS, RCS Nice 106 518 152, 19 Avenue des Diables Bleus, 06300 Nice, France (the "Processor"), for the personal data processed in Velora. It forms part of the terms of sale and applies for the whole term of the contract, then until the data is fully deleted.
It supplements the privacy policy. In the event of a conflict on data protection, this agreement prevails over the terms of sale.
2. Description of the processing
- Nature and purpose: hosting, storage, display and transmission of the data needed for the service described in the terms of sale (sales tracking, content, messages, shoots, contracts, Models' app).
- Data subjects: the Agency's Models and its team members.
- Data: identity and contact details, connected platform accounts (encrypted sessions and keys), sales, content, messages, form answers, contracts, voice samples if the feature is used, device and connection data, security logs.
- Special category data: the "My cycle" tracker (health data), optional, switched on only with the Model's explicit consent given in the app, encrypted and not visible to the Agency.
- Duration: the term of the contract, plus the 30-day export period.
3. The Agency's instructions
The Processor processes the data only on the Agency's documented instructions. The terms of sale, this agreement and the settings made by the Agency in the console are its instructions. The Processor informs the Agency if it believes an instruction infringes the GDPR.
The Processor never uses the data for its own purposes, does not sell it and does not use it to train AI models.
4. Confidentiality
Only the Processor's authorized staff access the data, when needed for the service. They are bound by confidentiality under contract or a legal obligation.
5. Security (Article 32 GDPR)
- Agencies isolated in the database (Row Level Security), checked by automated tests.
- AES-256-GCM encryption of secrets with one key per agency, itself encrypted by a master key kept outside the database.
- Encryption in transit (TLS) and at rest at the hosting providers.
- Hashed passwords (Argon2id), two-factor authentication required for owners and admins.
- Private media, reachable only through signed links valid for 5 minutes.
- Audit log of sensitive actions, encrypted backups, rate limits against scraping.
- iPhone app checked with App Attest, sessions kept in the device Keychain.
The Processor may update these measures without lowering the level of protection.
6. Sub-processors
The Agency gives a general authorization to use the sub-processors listed in the privacy policy. The Processor imposes the same data protection obligations on them by contract and remains responsible for their compliance.
The Processor notifies the Agency by e-mail at least 30 days before adding or replacing a sub-processor. The Agency may object on reasonable data protection grounds. If no solution is found, it may terminate free of charge before the change.
7. Services connected by the Agency
The third-party services the Agency connects itself (sales platforms, messaging, e-signature, social networks, AI providers) are not sub-processors of the Processor. Data is sent to them on the Agency's instructions; the Agency chooses these services, accepts their terms and governs its relationship with them.
8. Transfers outside the EU
Data is hosted in the European Union. A transfer to a third country, including remote access by a sub-processor, only takes place with appropriate safeguards: an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
9. Assistance to the Agency
The Processor helps the Agency answer data subject requests: the console lets it export and delete data, and any request received directly from a data subject is forwarded to the Agency without undue delay.
On request, it also helps the Agency with its impact assessments and prior consultations with the supervisory authority, by providing the information it has.
10. Personal data breach
The Processor notifies the Agency of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it. The notice describes, as far as possible, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed.
11. End of the contract
At the end of the contract, the Agency can export its data for 30 days. The Processor then deletes it. Copies in backups disappear as they rotate, within 30 days. The Processor confirms deletion in writing on request. Only the data it must keep by law, such as invoices, remains.
12. Audit
The Processor makes available to the Agency the information needed to demonstrate compliance with this agreement. The Agency may have an audit carried out once a year, with 30 days' notice, at its own cost, by an independent auditor bound by confidentiality, without disrupting the service or accessing other customers' data.
13. The Agency's commitments
The Agency guarantees that it has a legal basis for each processing, informs its Models and its team, obtains the necessary consents (in particular for voice and image), and invites only adults. It can publish its own privacy policy in its Models' app from the console (Customize).