Preamble

DATA LEGAL DRIVE (839 793 791 R.C.S. Nanterre) publishes and markets a platform (hereinafter the “Platform“) allowing the implementation and the governance by the Customer of its compliance process with the General Data Protection Regulation and the law n° 78-17 of January 6, 1978 (hereinafter the “Regulation”).

The present General Terms of Use (hereinafter the “GTU“) govern all commercial relations resulting from the use of the DATA LEGAL DRIVE Platform by the Users. It is recommended to read the GTUs at each visit to this website since they may be modified at any time and without notice.

The use of the Platform, whether it is free on a temporary basis, or requiring registration linked to a subscription, entails the commitment of the User to respect these GCU.

When access to the Platform is free, it will end on the date indicated in the registration confirmation email. Any renewal of this free access will be subject to the express agreement of DATA LEGAL DRIVE.

By checking the box “I have read and accept these Terms of Use”, you (hereinafter “the User“) acknowledge having read these Terms of Use in their entirety and warrant that :

  • You are the account holder as declared to DATA LEGAL DRIVE (hereinafter “DLD“) at the time of the opening of the DATA LEGAL DRIVE Platform account access
  • You have read, understood and accepted these TOU; and
  • You have all the necessary authorizations to use the Platform on behalf of the legal entity having concluded the subscription with DLD (hereafter the “Client“).

Account ownership and access

DLD opens the accesses of the administrators of the Client’s entity(ies), who can then, in turn, authorise other users to access their space on the Platform and configure their profile.

The account is attached to the User on a strictly personal basis. The User shall keep his password confidential and shall not disclose it to any other person. In the event of loss or theft of the password, the User undertakes to reset it directly from the DLD homepage.

DLD cannot be held liable for the consequences of the User not resetting the password.

The User undertakes to implement basic computer hygiene measures regarding password management.

Limits to the right of use

DLD grants the Client a personal, non-transferable and non-exclusive right to use the Platform for the purposes of its business and for the duration of the Contract. The right of use is granted for the version of the Platform existing on the date of subscription and for the developments provided during the term of the subscription. This right of use is strictly limited to (i) the Users and (ii) the Client’s legal entities listed as beneficiaries in the CDB.

The User is prohibited from carrying out :

  • Any temporary or permanent reproduction of the Platform, its screen pages, the sequence of these, the drafting and presentation of the questionnaires which are not directly dictated by the text of the regulations, with the exception of the standard clauses and mentions which are offered for downloading;
  • Any dissemination, distribution, rental, marketing, sub-licensing, assignment, direct or indirect provision of the Platform for the benefit of a third party or the public, whether free of charge or not;
  • Any modification, adaptation or development of the Platform;
  • Any translation or adaptation;
  • Any use of the Platform for the development, production or marketing of derivative software or software whose purpose, function or expression is substantially or formally similar to the
  • Platform, or for any other act infringing the rights of DLD;
  • Any interfacing or integration with other products;
  • Any insertion of screens or intermediate devices to change the number of authorized Users; and
  • Any decompilation of the Platform;
  • Any intrusion, intrusion test on the Platform without having notified DLD and obtained its prior consent.

Notwithstanding the previous paragraph, with regard to Clients who act on behalf of their own clients, in particular as outsourced DPO, the latter acquire the right to make the Platform available to them for the purposes of their outsourced compliance missions.

User or client property

All “Customer Data” (files, content, contracts, maps, logos, trademarks, registers, personal data or more generally documents of the User which the User imports into the Platform) are deemed to belong to the User or the Customer and remain his property.

The User declares that he/she has the necessary authorisations for the use and exploitation of the Client Data, so that he/she grants DLD a right of use over this Client Data, solely for the purposes of hosting and corrective and evolutionary maintenance of the Platform.

The processing register as fed by the User as well as the reports published from the Platform are and remain the property of the Client.

 

Ownership of Data Legal Drive: Platform and content

DLD or its partners retain exclusive ownership of the pre-existing means, tools, inventions, frameworks, connectors, APIs, methods and know-how, born or developed by them in the course of executing the subscription, whether or not they are subject to specific protection (copyright, patent, trademark, licence, etc.) as well as of any software published or acquired by them which is used in the context of the subscription.

In any event, the Platform remains the full and exclusive property of DLD or its partners (including its settings, functions, screens, questionnaires, data dictionaries and legal content). DLD is and remains the sole owner of the rights to its trademarks, logos and resources.

Under no circumstances may the present agreement have the effect of transferring to the User any intellectual property rights whatsoever on the Platform beyond the right of use granted. The User undertakes to keep intact any mention of intellectual property appearing on the Platform and, more generally, to refrain from any act that may directly or indirectly infringe the rights and image of DLD.

The Client shall take all useful information and prevention measures with regard to Users to avoid any infringement of DLD’s rights.

 

Use of tools provided by Data Legal Drive

As part of the provision of the Platform by DLD, the Client may be required to use tools provided by DLD. In this case, the Client certifies that it will only use these tools for the purpose of providing the solution, to the exclusion of any third party use.

Consequently, no guarantee is given by DLD in the use of these tools outside the performance of this Contract.

 

Privacy

DLD undertakes to keep all Client Data confidential and to use it only for the purpose of enabling the Client and the User to use the Platform in accordance with the contractual conditions in force between DLD and the Client.

The User undertakes to keep all information received from DLD confidential, not to disclose DLD’s confidential information to any third party and to use DLD’s confidential information only for the purpose of exercising its rights and fulfilling its obligations hereunder. Insofar as necessary, the source codes and interfaces of the Platform as well as the questionnaires and dictionaries of the Platform constitute confidential information.

Notwithstanding the foregoing, neither Party shall have any obligation whatsoever with respect to information that (i) has entered the public domain through no fault of the receiving Party; (ii) is independently developed by the receiving Party; (iii) is known to the receiving Party prior to disclosure by the other Party; or (iv) legitimately received from a third party not subject to an obligation of confidentiality; or (v) required to be disclosed by law or court order (in which case it shall be disclosed only to the extent required and after written notice to the providing Party).

The obligations of the Parties in respect of the Confidential Information shall remain in force throughout the duration of the contractual relationship and after its termination, so long as the information concerned remains confidential to the disclosing Party and, in any event, for a period of five (5) years after the termination of the Contract.

 

Personal data

The Parties undertake to comply with their respective obligations under the Regulations.

In the context of the subscription, the Client acts as the controller of the personal data imported by the User into the Platform, and DLD acts as a subcontractor on behalf of the Client.

In this respect, DLD only processes the personal data imported into the Platform, in particular the data of the Users, the natural persons identified in the processing register and any data present in the documents imported into the Platform, on the basis of documented general or specific instructions from the Client, and for the sole purpose of hosting and corrective and upgrade maintenance of the Platform. By way of exception, DLD may be legally obliged to process Personal Data by virtue of the applicable regulations, in which case DLD will inform the Client of this obligation prior to processing, unless the relevant law prohibits such information.

Where necessary, Personal Data is stored and processed by DLD (i) for the duration of the subscription only, (ii) on secure servers located exclusively in France, (iii) for the above-mentioned purposes only and (iv) is not transferred outside French territory.

The User has the rights of access, rectification, opposition, deletion, limitation and portability by contacting the Client directly.

DLD informs the Client that it (i) uses a French subcontractor to host the Platform (SCALEWAY SAS, Iliad Group) which processes the Personal Data for technical purposes only, and that (ii) in the event of an order by the Client for additional services described in Article 3 of the GTC, DLD may use subcontractors likely to have access to the Personal Data (hereinafter, together, the “Subcontractors”). DLD undertakes to ensure that these Subcontractors comply with the Regulations. In addition, DLD will endeavour to engage only subcontractors established within the European Union. In the event of the addition or replacement of a Subcontractor, DLD will inform the Client in writing, who will then have 30 days to present his objections based on a legitimate reason. If no objection is made within this period, the Subcontractor is deemed to have been accepted by the Client. In the event of acceptance of the Subcontractor, DLD undertakes in any event to comply with Article 28 of the General Data Protection Regulation.

DLD guarantees the confidentiality of the Personal Data and undertakes to ensure that the persons authorised to process them in accordance with the Contract comply with an obligation of confidentiality and receive the necessary training in the protection of personal data.

DLD deploys appropriate technical and organizational measures to protect the Personal Data and Client Data for the duration of the subscription, at the end of which, at the Client’s option, DLD deletes or returns the Personal Data and Client Data to the Client. DLD will destroy any existing copies of Personal Data and Client Data (subject to legal retention requirements).

DLD agrees to notify the Client within 48 hours (business days) of any breach of security of Personal Data and any breach of Personal Data processed under the subscription and to cooperate with the Client in the deployment of remedial measures. DLD undertakes to collaborate with the Client in carrying out an impact analysis, in managing requests to exercise the rights of the persons concerned and in the event of prior consultation of the CNIL by a Client.

DLD provides the Client with the documentation necessary to demonstrate compliance with all its obligations (including the processing register provided for in Article 30 of the General Data Protection Regulation) and to allow audits to be carried out by the Client.

Applicable law and jurisdiction

In the event of a dispute concerning the interpretation or execution of these GCU, the Parties shall endeavour to find an amicable solution to their dispute, by involving their respective General Management.

If no solution is found, the Parties agree to submit to a conciliation procedure by means of a request to the President of the competent Commercial Court, implemented by the most diligent Party by sending a registered letter to the other Party in this regard. The Parties shall then have a period of fifteen (15) days to set up the conciliation procedure and one (1) month to reach an agreement, unless a written agreement extending the period is reached. If no agreement is reached, the Parties shall recover their full freedom of action.

These GCU are subject to French law.

In the absence of an amicable agreement or conciliation between the Parties and for any dispute arising between them concerning the interpretation, performance or termination of these GTUs, jurisdiction is expressly granted to the competent courts of Paris, notwithstanding multiple defendants or third party proceedings, even for emergency procedures or protective procedures by way of summary proceedings or petition.