Appendix 1 — Personal Data Processing Agreement

This agreement (the “Agreement”) is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”). It forms an integral part of the Terms of Sale and prevails over them in all matters relating to personal data. Terms that are not defined here have the meaning given to them in the Terms of Sale or the GDPR.

1. Roles of the parties

For personal data contained in Customer Data (the “Data”), the Customer is the controller and OGIRY is the processor. Where the Customer is a Subscribing Consultant acting for a Beneficiary Company, the Customer acts as the Beneficiary Company’s processor and OGIRY acts as sub-processor; the Customer then passes this Agreement on in its contract with the Beneficiary Company.

2. Description of the processing

The subject matter, nature, purpose and duration of the processing, and the categories of data and of data subjects, are described in Schedule A.

3. Instructions

OGIRY processes the Data only on documented instructions from the Customer. The Terms of Sale, this Agreement and the Customer’s configuration of the Workspace constitute its instructions. OGIRY immediately informs the Customer if, in its opinion, an instruction infringes applicable law. OGIRY may anonymise usage data to produce the aggregated statistics provided for in Article 14.5 of the Terms of Sale, which the Customer authorises.

4. Confidentiality

OGIRY ensures that the persons authorised to process the Data are bound by an obligation of confidentiality and access the Data only to the extent necessary for their tasks.

5. Security

OGIRY implements the measures described in Schedule B and adapts them to changing risks and to the state of the art, without reducing their overall level.

6. Sub-processors

The Customer gives general authorisation for the use of the sub-processors listed in Schedule C. OGIRY informs the Customer at least thirty (30) days in advance of any addition or replacement. The Customer may object in writing, stating its reasons, within that period; if no acceptable solution is found, the Customer may terminate the contract without penalty, and the unused prepaid portion is refunded to it. OGIRY imposes on each sub-processor obligations equivalent to those of this Agreement and remains liable to the Customer for their performance.

7. Transfers outside the European Union

Any transfer of Data outside the European Economic Area is governed by an adequacy decision — in particular the EU–US Data Privacy Framework where the recipient is certified under it — or, failing that, by the European Commission’s standard contractual clauses (Decision 2021/914), supplemented where necessary by additional measures.

8. Data subjects’ rights

OGIRY forwards to the Customer without delay any request to exercise rights that it receives in respect of the Data, and does not respond to it itself unless instructed to do so. The Service enables the Customer to view, rectify, export and delete the Data; OGIRY assists the Customer with anything further, to a reasonable extent.

9. Data breaches

OGIRY notifies the Customer of any breach affecting the Data as soon as possible and no later than forty-eight (48) hours after becoming aware of it. The notification contains the information referred to in Article 33.3 of the GDPR, to the extent that it is available, together with the measures taken or envisaged.

10. Assistance

OGIRY provides reasonable assistance to the Customer in carrying out data protection impact assessments and prior consultations with the supervisory authority relating to the Service.

11. Return and deletion of the Data

At the end of the contract, the Data is returned and deleted under the conditions set out in Article 21 of the Terms of Sale: export on request for thirty (30) days, and permanent deletion no later than ninety (90) days after the end of the contract, including backups, unless retention is required by law.

12. Documentation and audit

OGIRY makes available to the Customer the information necessary to demonstrate compliance with this Agreement. The Customer may have an audit carried out once a year, with thirty (30) days’ notice, by an independent auditor who is bound by confidentiality and is not a competitor of OGIRY, during business hours and without disrupting the Service. The audit is at the Customer’s expense, unless it reveals a material breach by OGIRY.

13. Record of processing

OGIRY maintains a record of the categories of processing activities carried out on behalf of its customers (Article 30.2 of the GDPR).

Schedule A — Description of the processing

Subject matter and nature

Hosting, storage, structuring, searching, export and return of the Data; generation of content by Marcel (transmission of requests and of the necessary context to the artificial intelligence provider); sending of emails related to the Service (invitations, Thursday content, reminders).

Purpose

Provision of the Service to the Customer, in accordance with the Terms of Sale.

Duration

Term of the contract, plus the reversibility period (no more than 90 days).

Data subjects

Users of the Workspace; members of the Customer’s team described in the Team profiles; persons mentioned in Customer Content (the Customer’s clients, partners, suppliers and prospects).

Categories of data

Identity and professional contact details; job title, role and responsibilities; “Ma voix” (“My voice”) profile (background, style, writing preferences); actions, assignments and statuses; documents and content entered; histories of exchanges with Marcel; any personal data that the Customer chooses to include in its content.

Sensitive data

None expected. Entering such data is prohibited by Article 12 of the Terms of Sale, except where there is a compelling need and under the Customer’s responsibility.

Schedule B — Security measures

• Hosting in France, on the Kers hosting offering, in OVHcloud data centres.
• Encryption of communications (HTTPS/TLS) between browsers and the Service, and between the Service and its sub-processors.
• Passwordless authentication by a one-time, time-limited link or code; short-lived session tokens that are renewed and revocable.
• Segregation of data by Workspace, enforced in the application and at database level (row-level security).
• Role-based access control, with any write operation not explicitly authorised denied by default, verified by automated tests.
• Access keys to third-party services (including the artificial intelligence provider) stored exclusively on the server side, outside the source code.
• Logging of logins.
• Automated deployment pipeline with tests, code review and containerised images.
• Access by OGIRY personnel limited to authorised persons, solely for support and security purposes.

Schedule C — Sub-processors

The up-to-date list is available on request from [email protected].

Marcel OS — Version 1.0 of 24 September 2026 — OGIRY, RCS Lyon 978 960 672