Data Legal Drive (RCS Nanterre 839 793 791) (hereinafter referred to as “DLD”) publishes and markets a platform (hereinafter referred to as the “Platform”) and services (hereinafter referred to as the “Services”) enabling the implementation and governance by the Customer of its compliance process with the General Data Protection Regulation and the French law n° 78-17 of 6 January 1978 (hereinafter referred to as the “Regulation”).

After having familiarised itself with the characteristics of the Platform and/or the Services and having ascertained that they are suitable for its needs, the Customer wished to benefit from a subscription to the Platform and/or to benefit from the Services under the conditions described in these General Terms of Services (hereinafter the “GTS”), in the technical appendix (hereinafter the “Technical Appendix”) and in the Subscription Offer and the associated order form (hereinafter the “SOP”) (hereinafter, all of these documents together, the “Contract”). In case of contradiction between these documents, the descending order of precedence is as follows: (i) the CDB, (ii) the Technical Annex and (iii) the GTC. The signature of the CDB by the Customer implies full acceptance of the GTC and the Technical Annex. Special Terms and Conditions may be notified at the time of sale, in particular for Services, either in the BDC or separately. These Special Terms and Conditions have a legally superior value to these GTC.

The present GSC are established in accordance with Article L. 441-1 of the French Commercial Code and prevail over any opposing conditions of purchase. Any order accepted by the DLD sales management is immediately firm and final. DLD reserves the right to update the GCS and undertakes to inform the Client by any means. Continued use of the Platform after notification by DLD presumes the Client’s unreserved acceptance of the new GTC. DLD reserves the right to make the execution of the GTC subject to payment guarantees. The GTC may be accepted online and/or by electronic signature.


Purpose and duration of the contract

DLD offers the Client a flat-rate subscription, depending on the commercial offers defined in the current tariff or resulting from special agreements.

Unless otherwise agreed, all subscriptions take effect on the date of signature of the CDB for a fixed period ending on the anniversary date of the Contract. At the end of this initial period, in order to avoid any discontinuity in the service, the subscription contracts are automatically and tacitly renewed for successive periods of twelve (12) months, at the rate for the year of renewal revised by the Syntec index, unless notice of termination is given by registered letter with two months’ notice prior to the expiry of the subscription in progress.

With regard to the Services, the CDB states the duration of the mission entrusted. It is concluded for the duration of the Services, unless otherwise provided for in the Special Conditions. Any requests for changes to the Services, during the course of the Contract, must be sent in writing by the Client to DLD and must specify the nature and implications of the envisaged change. DLD will respond with a written proposal, indicating the cost, conditions and timetable for carrying out the modification as well as the impact on the deadlines mentioned in the CDB, if applicable. Once the Client has agreed to this proposal, the agreed modification must be the subject of an amendment to the Contract signed by the Parties.



The Platform is offered in SaaS mode, under the conditions of the Technical Annex. DLD opens access for the administrators of the Client’s entities, who can then in turn authorise other users to access their space on the Platform and configure their profile (hereinafter referred to as “Users”).

The functionalities of the Platform are described in the associated BDC, with DLD retaining the exclusive right to add to, delete or modify these functionalities at any time, as long as this does not substantially affect the purpose of the Platform. Some of these developments may be optional for the Client and be subject to additional billing or an increase in the subscription fee.

The Customer may separately order (i) technical services for the automatic transfer of files to feed the Platform; (ii) the delivery or design of training materials for its teams; (iii) organisational or technical support services.

The effectiveness of the Platform in terms of compliance with the Regulations depends solely on the Customer’s diligence and on the Users’ compliance with the actions to be taken to achieve and maintain compliance. The Client is the sole judge of the actions to be implemented (contractualization, security, governance, privacy by design, impact analysis, etc.) within its company, on its information system, with its partners, subcontractors and employees. DLD does not replace the Client in the practices or decisions to be taken in the context of its compliance.

DLD may therefore in no case be held liable, directly or indirectly, in the event of non-compliance by the Client with the Regulations, except in the case of fault on the part of DLD in its capacity as subcontractor. DLD declares and guarantees that its Platform complies with its description in the BDC.

Corrective and upgrade maintenance of the Platform is included in the subscription and is provided exclusively by DLD under the conditions of the Technical Annex where DLD undertakes to correct or provide a workaround solution for anomalies. As part of the ongoing maintenance, DLD undertakes to make every effort to maintain the Platform to the best standards of the Regulations.

Right to use

DLD grants the Client a personal, non-transferable and non-exclusive right to use the Platform for the purposes of its business and for the duration of the Contract. The right of use is granted for the version of the Platform existing on the date of subscription and for the developments provided during the term of the subscription. This right of use is strictly limited to (i) the Users and (ii) the Customer’s legal entities listed as beneficiaries in the CDB.

Consequently, the Client shall refrain from and prohibit the Users from (i) any temporary or permanent reproduction of the Platform, its screen pages, the sequence of these, the drafting and presentation of the questionnaires which would not be directly dictated by the text of the RGPD, with the exception of the standard clauses and mentions which are proposed for downloading; (ii) any dissemination, distribution, rental, marketing, sub-licensing, assignment, direct or indirect provision of the Platform for the benefit of a third party or the public, whether free of charge or not; (iii) any modification, adaptation or development of the Platform; (iv) any translation or adaptation not expressly authorised by DLD; (v) any use of the Platform for the development, production or marketing of derivative software or software whose purpose, function or expression is substantially or formally similar to the Platform, or for any other act infringing DLD’s rights; (vi) any interfacing or integration with other products without DLD’s prior authorization (vii) any insertion of screens or intermediate devices to modify the number of authorized Users and (viii) any decompilation of the Platform, (ix) any intrusion, intrusion test on the Platform without having notified DLD and obtained its prior consent.

Notwithstanding the previous paragraph, with regard to Clients who act on behalf of their own clients, in particular as outsourced DPO, the latter acquire the right to make the Platform available to them for the purposes of their outsourced compliance missions.


DLD staff

Dans le cadre de l’abonnement, un support technique est assuré par les équipes de DLD aux jours et heures ouvrés (9h-18h du lundi au vendredi sauf jours fériés en France). DLD emploie et rémunère son personnel conformément à ses obligations fiscales et sociales. Elle déclare et garantit qu’elle respecte les dispositions des articles L.8211-1 et suivants, L.8221-1 et suivants, L.8231-1 et suivants, L.8241-1 et suivants, et L.8251-1 du Code du Travail.

Plus généralement, le Client s’abstient pendant toute la durée du Contrat de solliciter directement ou indirectement les collaborateurs de DLD à des fins de recrutement et d’embauche. A défaut, le Client sera redevable d’une indemnité équivalente à une somme forfaitaire égale à la rémunération brute annuelle que ce collaborateur aura perçue ou aurait dû percevoir avant son départ.

Le personnel de DLD reste sous l’autorité hiérarchique et disciplinaire exclusive de DLD qui assure seule l’ensemble de ses obligations et droits attachés à sa qualité d’employeur et notamment la direction technique du travail, la gestion administrative, comptable et sociale de son personnel.

En cas d’intervention sur le site du Client, le personnel de DLD s’engage à se conformer aux règles, notamment d’hygiène et de sécurité, applicables, telles que communiquées par le Client par écrit préalablement à ladite intervention.



The Parties agree that the proper performance of the Services requires cooperation and consultation between them. The Parties therefore undertake to collaborate closely, actively and regularly within the framework of the Contract and, in this respect, to communicate any information to each other and to inform each other of any event or difficulty of which they are aware that may have an impact on the proper performance of the Services.

DLD undertakes, under the conditions and within the limits of the Contract, to perform the Services entrusted to it by the Client. In this respect, DLD undertakes in particular to produce any deliverables provided for in the Special Conditions (hereinafter the “Deliverables”),

During the performance of the Contract, DLD has a duty to advise the Client, the Client being solely responsible for the decisions taken.

The organisation of the Services, the scheduling of its tasks and their planning, the allocation of its resources for carrying out these tasks and the choice of its working methods are defined by DLD. Any change in the scope or any delay due to the Client or a third party may result in a postponement of the contractual schedule and the Client will bear the resulting additional costs for DLD. To enable DLD to perform the Services in accordance with the terms of the Agreement, the Client undertakes to perform the tasks and fulfil the obligations incumbent on it under the Agreement and in particular to

express its needs, constraints, objectives and business challenges for each of the Services incumbent on DLD as clearly and exhaustively as possible
provide DLD with the information, documentation, resources and/or elements enabling DLD to perform the Services;
mobilise the resources necessary for the execution of the Services within a timeframe compatible with the schedule for the Services;
ensure the cooperation of any third party involved (e.g. external DPO) in the context of the project covered by the Services;
make the necessary backups of the data, files and other information to which DLD may have access in the context of the Contract;
in the event of intervention on the Client’s site, make available to DLD premises of a nature to enable the Services to be carried out under normal conditions (size, equipment, health and safety, connection, network, etc.);
carry out the required validations within the contractual deadlines.

DLD reminds you that the Client is the only one who is in control of the issues at stake, particularly with regard to the business aspects and responsibilities in terms of RGPD compliance, and who has an overall view of his company. It therefore has an essential role in identifying the target to be reached and arbitrating the choices, both on the technical level and on the RGPD process aspects that will be necessary for the execution of the Contract.

It is up to the Client to use the results of the Services according to its own objectives and projects. He is responsible for the choices he makes from among the solutions proposed by DLD and for any changes he makes to the Services.

Financial conditions

Subscription to the Platform is invoiced prior to or at the same time as DLD sends the access data to the Platform. The Services are invoiced according to the payment schedule set out in the CDB. All prices invoiced to the Client are those in force on the day of registration or renewal of the Contract, less any applicable discounts, rebates and discounts. The financial conditions of the subscription are indicated in the BDC.

Any request for payment by instalments requires the prior setting up of a direct debit and the instalment schedule will be defined in the CDO. The setting up of a payment plan does not release the Customer from his obligation to pay the full subscription.

Unless otherwise specified in the CDB, DLD invoices are due thirty (30) calendar days after the date of issue of the invoice, all prices being exclusive of tax, in euros.

Any late or partial payment made by the Client will be automatically deducted from the outstanding amounts. In the event of late payment on the due date, penalties equal to 10% of the amount of the unpaid invoices shall be payable as of right. In the event of unpaid invoices, after a formal notice has been sent to the Customer and has remained unsuccessful for a period of 10 days, the subscription will be suspended immediately and automatically, until the account has been settled, without prejudice to the Customer’s compliance with its contractual obligations and any legal proceedings. In the event of persistent delay of more than thirty (30) calendar days, DLD may suspend access to the Platform without compensation or further notice. This suspension is conditional on the sending of a formal notice by registered letter which has remained without effect for a period of fifteen (15) days.

Any Client who is late in making a payment shall automatically owe DLD, in addition to the late payment penalties already provided for, a fixed indemnity for collection costs of 40 euros. If this is exceeded, additional compensation may be demanded on the basis of supporting documents.

The Client agrees to obtain or receive invoices electronically. The Parties agree to expressly exclude the application of Article 1195 of the Civil Code.


Customer property: customer data

All “Client Data” (files, content, contracts, maps, logos, trademarks, registers, personal data or, more generally, documents of the Client that the Client inserts or has inserted into the Platform) are deemed to belong to the Client and remain its property.

The Client declares that it is the owner of the intellectual property rights attached to the Client Data or that it has the necessary authorisations for their use and exploitation, so that it grants DLD a right of use over this Client Data, solely for the purposes of hosting and corrective and evolutionary maintenance of the Platform. The Client guarantees and indemnifies DLD against any recourse by a third party in connection with the Client Data.

The processing register as supplied by the Client as well as the reports published from the Platform belong to the Client.


Ownership of DLD: Platform & contents

DLD or its partners retain exclusive ownership of the means, tools, inventions, frameworks, connectors, APIs, methods and know-how pre-existing, born or developed by them during the execution of the subscription, whether or not they are subject to specific protection (copyright, patent, trademark, licence, etc.) as well as any software published or acquired by them which is used in the context of the subscription.

The Platform and its content (excluding Client Data) remain in any event the full and exclusive property of DLD and its partners (including its settings, functionalities, screens, questionnaires, data dictionaries, legal content and visual structure of the pages and exports). DLD is and remains the sole owner of the rights to its trademarks and logos.

Under no circumstances may the present agreement have the effect of transferring to the Client any intellectual property rights whatsoever on the Platform or the contents beyond the right of use granted. The Client undertakes to keep intact any mention of intellectual property appearing on the Platform and, more generally, to refrain from any act that may directly or indirectly infringe the rights and image of DLD. The Client shall take all useful training, information and prevention measures with regard to the Users to avoid any infringement of DLD’s rights.

Services: DLD retains exclusive ownership of the resources, tools, inventions, methods or know-how created or developed independently and/or in the course of performing the Services, whether or not they are subject to specific protection (copyright, patent, trademark, etc.). No right of use is granted to the Client on these elements.

It is expressly agreed between the Parties that DLD shall be entitled to use the lessons learned from the Services performed and to develop for third parties elements similar to those it has developed within the framework of the Contract, subject to compliance with its confidentiality undertaking under the “Confidentiality” article.



DLD warrants that it has all intellectual property rights to provide the Platform. Accordingly, DLD agrees to defend and indemnify the Client for damages related to claims, lawsuits or convictions brought by a third party alleging that all or part of the Platform infringes its intellectual property rights, provided that the Client notifies DLD as soon as possible in writing of the existence of the lawsuit, makes a request for its defense, cooperates fully with DLD in the said defense and does not settle without first obtaining DLD’s written consent.

If a lawsuit is filed, DLD shall at its option and expense: (i) modify the infringing component so that the Platform is no longer infringing, (ii) replace the infringing component with a non-infringing component with generally equivalent functionality, (iii) obtain the rights of use so that the Client may continue to operate the Platform in accordance with the terms of the Agreement.

This warranty does not apply to any open source components present in the Platform. It does not apply to any infringement action resulting from any use, combination, modification, adaptation or exploitation of the Platform not expressly authorized in advance by DLD.

For its part, the Client provides DLD with the same guarantee and under the same conditions for the Client Data and holds DLD harmless from any claim or conviction brought by a third party. More generally, the Client undertakes to upload and process only strictly lawful Client Data via the Platform. In particular, the Client is prohibited from uploading or processing any Client Data that is contrary to the law, regulations or public order, as are Users.



On expiry of the Agreement or in the event of termination for any reason whatsoever under the subscription, DLD undertakes to carry out a reversibility – within thirty (30) days – enabling the Client to take back the Client Data, free of charge and in standard, machine-readable format. Reversibility excludes any transfer of intellectual property or elements, contents, etc. of the Platform. Any request for reversibility must be made to the DLD support department.



Each Party undertakes (i) to keep confidential all information it receives from the other Party, (ii) not to disclose the other Party’s confidential information to any third party, other than employees or agents with a need to know; and (iii) to use the other Party’s confidential information only for the purpose of exercising its rights and fulfilling its obligations under the Agreement. Where appropriate, it is specified that the Platform source codes, the Platform questionnaires and dictionaries and the Customer Data constitute confidential information.

Notwithstanding the foregoing, neither Party shall have any obligation whatsoever with respect to any information that (i) has entered the public domain through no fault of the receiving Party; (ii) is independently developed by the receiving Party; (iii) is known to the receiving Party prior to disclosure by the other Party; or (iv) legitimately received from a third party not subject to an obligation of confidentiality; or (v) required to be disclosed by law or court order (in which case it shall be disclosed only to the extent required and after written notice to the providing Party).

The obligations of the Parties in respect of the Confidential Information shall remain in force throughout the term of the Contract and after its termination for so long as the information concerned remains confidential to the disclosing Party and, in any event, for a period of five (5) years after termination of the Contract

Personal data

The Parties undertake to comply with their respective obligations under the Regulations. In the context of the performance of the Agreement, the Client acts as the data controller ( and DLD acts as a subcontractor on behalf of the Client. In this capacity, DLD only processes the personal data imported into the Platform, in particular the data of Users, natural persons identified in the processing register and any data present in the documents imported into the Platform (hereinafter the “Personal Data”), on the basis of documented general or specific instructions from the Client, and for the sole purpose of hosting and corrective and upgrade maintenance of the Platform. By way of exception, DLD may be legally obliged to process Personal Data by virtue of the applicable regulations, in which case DLD will inform the Client of this obligation prior to processing, unless the relevant law prohibits such information. Where necessary, Personal Data is stored and processed by DLD (i) for the duration of the subscription only, (ii) on secure servers located exclusively in France, (iii) for the above-mentioned purposes only and (iv) is not transferred outside French territory.

The persons concerned by the Personal Data imported into the Platform benefit from the rights of access, rectification, opposition, deletion, limitation and portability by contacting the Customer directly. It is the Client’s responsibility to inform these persons of the above-mentioned purposes and of the fact that the Personal Data is transmitted to DLD in the context of the execution of the subscription.

DLD informs the Client that it (i) uses a French subcontractor to host the Platform (SCALEWAY SAS, Iliad Group) which processes the Personal Data for technical purposes only, and that (ii) in the event of an order by the Client for additional services described in Article 3 of the GTC, DLD may use subcontractors likely to have access to the Personal Data (hereinafter, together, the “Subcontractors”). DLD undertakes to ensure that these Subcontractors comply with the Regulations. In addition, DLD will endeavour to engage only subcontractors established within the European Union. In the event of the addition or replacement of a Subcontractor, DLD will inform the Client in writing, who will then have 30 days to present his objections based on a legitimate reason. If no objection is made within this period, the Subcontractor is deemed to have been accepted by the Client. In the event of acceptance of the Subcontractor, DLD undertakes in any event to comply with Article 28 of the General Data Protection Regulation.

DLD guarantees the confidentiality of the Personal Data and undertakes to ensure that the persons authorised to process them in accordance with the Contract comply with an obligation of confidentiality and receive the necessary training in the protection of personal data.

DLD deploys appropriate technical and organizational measures to protect the Personal Data and Client Data for the duration of the subscription, at the end of which, at the Client’s option, DLD deletes or returns the Personal Data and Client Data to the Client. DLD will destroy any existing copies of Personal Data and Client Data (subject to legal retention requirements).

DLD agrees to notify the Client within 48 hours (business days) of any breach of security of Personal Data and any breach of Personal Data processed under the subscription and to cooperate with the Client in the deployment of remedial measures. DLD undertakes to collaborate with the Client in carrying out an impact analysis, in managing requests to exercise the rights of the persons concerned and in the event of prior consultation of the CNIL by a Client.

DLD provides the Client with the documentation necessary to demonstrate compliance with all its obligations (including the processing register provided for in Article 30 of the General Data Protection Regulation) and to allow audits to be carried out by the Client.


Each of the Parties shall be liable for the consequences resulting from its faults, errors or omissions, causing damage to the other Party. However, in the event of a breach by one of the Parties of its commitments, that Party shall only be liable to pay compensation for the pecuniary consequences, proven by the allegedly injured Party, of the direct and foreseeable damage linked to the said breach. Consequently, neither Party shall be liable for any indirect damage suffered by the other Party or third parties in relation to it, including, in particular, any loss of profit, commercial loss, loss of turnover or profit, loss of customers, damage to image, loss of opportunity, cost of obtaining a substitute product, service or technology, or criminal, civil or administrative penalty.

In any event, with regard to the provision of the Platform, the amount of DLD’s liability is limited to the sum equivalent to one (1) year’s subscription fee for the Platform or, before the end of the first firm year of subscription, to the total amount of the fees actually collected on the date on which the damage occurred. With regard to the provision of Services, the limitation is equivalent to the amount paid by the Customer, all damages included. This limitation is stipulated with regard to the prices and fees agreed upon and is part of the economic balance of the Contract.

As the Platform is used in SaaS mode, DLD shall not be held liable in the event of (i) unavailability, slowing down of access to or operation of the Platform due to the limits of the Internet; (ii) contamination by viruses of the Client’s Data and/or software for reasons beyond DLD’s control; (iii) fraudulent or malicious introduction or attempted access by third parties to the Client’s Information System; (iv) possible misappropriation of the Client’s passwords, confidential codes and, more generally, any information of a sensitive nature for the Client.

DLD holds an insurance policy guaranteeing the consequences of the civil and professional liability that it may incur under this agreement.

The Parties shall not be held liable in full if the non-performance by one of them of some or all of the obligations incumbent on it is due to force majeure. Expressly, the cases of force majeure or fortuitous events are those usually retained by the jurisprudence of the French courts and tribunals. Initially, the case of force majeure shall suspend the performance of the Contract. If the case of force majeure lasts for more than thirty (30) calendar days, the most diligent of the Parties may terminate the Contract by operation of law, without notice or compensation, unless the Parties agree otherwise, adjusting the timetable or the end of their contractual relations.


In the event of a breach by one of the Parties of any of the obligations under the Agreement, including (i) persistent failure by DLD to provide a characteristic service for a consecutive period of at least thirty (30) calendar days; (ii) non-payment of any price or fee owed by the Client or (iii) non-compliance by the Client with the conditions and limitations of use of the Platform, which is not remedied within thirty (30) calendar days of the formal notice sent by registered letter with acknowledgement of receipt notifying the breach in question, the other Party may automatically terminate the Agreement, without prejudice to any damages to which it may be entitled in accordance with the article “Liability”.

By way of exception, DLD reserves the right to terminate the Agreement automatically without prior notice or compensation if the Client or a User in any way violates the integrity of the Platform, the intellectual property rights or the brand image of DLD.

In the event of termination of the Contract for breach of contract by the Client, all sums paid shall be retained by DLD, which shall invoice all sums remaining due until the end of the Contract (or for the current year if the termination takes place after its initial renewal). In the event of termination of the Contract for the sole fault of DLD, the latter will issue a credit note for any invoice corresponding to the contractual period remaining at the date of the effective termination, and will retain the fees collected and/or due for the elapsed contractual period until the effective termination.



In the event that this Agreement is translated into a foreign language, only the French version shall be binding.

Neither Party may make any commitment in the name and/or on behalf of the other Party. Furthermore, each of the Parties shall remain solely responsible for its allegations, commitments, services, products and personnel. The Contract has neither the purpose nor the effect of creating any relationship of representation, mandate, agency, subordination, de facto partnership or other.

DLD is authorised by the Client to quote the latter’s company name and to reproduce its brand and/or logo as a commercial reference on any medium.

In the event that the provisions of the GTCS are deemed null and void, inapplicable or unenforceable by any competent court, the other provisions of the GTCS shall remain valid, applicable and enforceable. The Parties agree, however, that in such event, they will negotiate in good faith replacement provisions that are (i) valid, enforceable and enforceable and (ii) consistent with the Parties’ original intent.

By signing these GTC, the Customer agrees to waive the application of articles 1221, 1222 and 1223 of the Civil Code, without regard to any judicial decision.

In the event of a dispute in the interpretation or execution of the Contract, the Parties shall endeavour to find an amicable solution to their dispute, by involving their respective General Management. If no solution is found, the Parties agree to submit to a conciliation procedure by means of a request to the President of the competent Commercial Court, implemented by the most diligent Party by sending a registered letter to the other Party in this regard. The Parties shall then have a period of fifteen (15) days to set up the conciliation procedure and one (1) month to reach an agreement, unless a written agreement extending the period is reached. Failing this, or failing agreement, the Parties shall recover their full freedom of action.

The Contract is subject to French law. In the absence of an amicable agreement or conciliation between the Parties and for any dispute arising between them concerning the interpretation, performance or termination of the contract, jurisdiction is expressly granted to the competent courts of Paris, notwithstanding multiple defendants or third party proceedings, even for emergency proceedings or protective proceedings by way of summary proceedings or application.