Data processing agreement (GDPR art. 28)
Version of 5 August 2026
This is a translation. Wyncove's legal documents are drafted in French, and the French version is the only binding one. This English text is provided so that an English-speaking reader can review the terms; in the event of any discrepancy between the two, the French version prevails.
This agreement governs the processing of personal data that Wyncove carries out on behalf of its customers. It constitutes the data processing annex to the terms of service within the meaning of article 28.3 of the GDPR, and applies from the creation of an account.
To be completed before the first signature: full identity of the processor (article 1) — the same items as the legal notice — and signature of the sub-processing agreements listed in article 6. A review by legal counsel is recommended before the first paying customer: this document faithfully describes how the service works, which is not the same as legal validation.
1. Parties and roles
The customer — the organisation that uploads contracts — is the controller: it decides which documents to entrust to the service and for what purpose. Wyncove is the processor: it processes that data solely in order to perform the service, on the customer's instructions.
This allocation is not a formality: it has practical consequences. It is the customer that answers an access or erasure request from a data subject, and Wyncove that must give it the means to do so (article 5). It is also the customer that judges the lawfulness of uploading a contract containing third-party data — Wyncove cannot assess in its place the legal basis of a document it does not choose.
One exception to name. For audience measurement of its website and its application, Wyncove acts as a controller and not as a processor: that data is not the customer's, and page addresses are redacted before any transmission (see the privacy policy). This agreement does not cover that processing.
2. Subject matter, nature and duration of the processing
- Subject matter
- Tracking contractual deadlines: uploading contracts, extracting structured information, human review, register, alerts, production of draft letters.
- Nature of the operations
- Collection (upload by the customer), storage, reading of the text, transmission to the extraction sub-processor, structuring, consultation, modification by the customer, export, erasure.
- Purpose
- Exclusively the performance of the service subscribed to. No other purpose — in particular no marketing, no resale, no enrichment of a third-party database.
- Duration
- The term of the customer contract, extended by thirty days after its closure to allow retrieval (article 7).
3. Categories of data and of data subjects
| Category | Content | Data subjects |
|---|---|---|
| Contractual documents | PDF or Word files uploaded, and the text read from them. Their content is chosen by the customer: it may include names, job titles, signatures and contact details. | Signatories and representatives of the parties, employees mentioned |
| Extracted data | Counterparty, dates, notice periods, amounts, periodicity, liability cap, governing law — each with its source quote | The same, indirectly |
| User accounts | Work email address, role, date of last sign-in | Employees of the customer authorised to use the service |
| Signing identity | Name and capacity of the person signing the letters produced, postal address of the company — entered by an administrator of the customer | The designated signatory |
| Documents received by email | Attachment forwarded to the deposit address, subject line, declared sender. Neither the body of the message nor its full headers are retained | Senders and people named in the attachment |
| Audit log | Who did what, and when — without the content of the documents | Users of the customer |
No special categories of data within the meaning of article 9 of the GDPR are requested or expected. The service is not designed to receive them, and the customer undertakes not to upload documents whose purpose would be to process them.
4. Wyncove's obligations
- Process on instructions, and nothing more. Data is processed only to perform the service. If an instruction from the customer appeared to infringe the GDPR, Wyncove informs it.
- Confidentiality of authorised persons. Access to a customer's data is limited to the people who need it for operations or support, bound by confidentiality. Administrative access is named and logged.
- Security (article 32): see article 8 below and the Security page.
- Breach notification. Wyncove informs the customer without undue delay and at the latest within 48 hours of becoming aware of it, with the information available to it: nature, categories and approximate volume of data, likely consequences, measures taken. It is for the customer, as controller, to notify the CNIL where applicable — Wyncove provides the material for it.
- Assistance with impact assessments and prior consultations, within the limits of the information available to Wyncove.
- No transfer outside instructions. Wyncove discloses a customer's data to no third party, except to the sub-processors listed in article 6 and except where required by law — in which case the customer is informed, unless the law prohibits it.
- No model training. Wyncove neither trains nor fine-tunes any model on a customer's data. The reuse of corrections for improvement purposes is anonymised, framed, and can be refused at any time (article 9).
5. Data subject rights
Wyncove does not answer a data subject directly: it has no relationship with them and is not in a position to identify them. It gives the customer the means to answer for itself:
- Access and portability — the register can be consulted and exported to CSV from the application, at any time and without a request.
- Rectification — every extracted field can be corrected by the customer from the contract record.
- Erasure — deleting a contract is immediate in the application; the purge of files and data follows according to article 7. A request covering a whole account should be sent to privacy@wyncove.fr and is carried out within thirty days.
- Forwarding of a request received in error — if a data subject contacts Wyncove, the request is forwarded to the customer without being answered on the merits.
6. Sub-processors
The customer authorises Wyncove to use the following sub-processors, each bound by an agreement imposing obligations equivalent to those of this document. The up-to-date list, with the data concerned and the locations, appears in the subprocessor table of the privacy policy.
| Sub-processor | Role | Data location |
|---|---|---|
| Vercel | Running the application | Functions in the Paris region |
| Supabase | Database and file storage | Paris (eu-west-3) |
| Anthropic | Extraction by language model | Contract text in transit only, with a no-training commitment |
| Brevo (French company) | Sign-in emails and deadline reminders | European Union — never the content of a contract |
Any addition or replacement is notified to the customer by email at least thirty days before it takes effect, together with the nature of the processing entrusted. The customer may object on reasonable data protection grounds; failing agreement, it may terminate the part of the service concerned without penalty.
The customer's calendar provider is not a sub-processor of Wyncove. When an organisation chooses to publish its deadlines as a calendar feed, it is the organisation that subscribes to it in Google Calendar or Outlook, and its own provider that comes to read it. Wyncove transmits nothing. The feed contains neither contract excerpts nor amounts.
7. Fate of the data at the end of the contract
On closure of the account, the customer has thirty days to export its data. After that period, the files and the extracted data are erased, including from rotating backups (thirty days at most). The audit log is kept for a rolling twelve months for security purposes, without the content of the documents. Billing data follows the ten-year accounting obligation.
A certificate of erasure is issued on request. Wyncove keeps no copy beyond those periods, with the exception of the anonymised evaluation cases covered by article 9, which can no longer be traced back to a customer.
8. Technical and organisational measures
- Separation by organisation: the organisation identifier is part of the clause of every query, and it comes from the session — never from a field sent by the browser.
- Encryption: in transit (TLS) and at rest (database and file storage).
- Password-free authentication by short-lived single-use link; only the hash of the token is stored. Sessions live in the database, and are therefore revocable immediately server-side.
- Roles: administrator, member, reader — enforced by the interface and by every write route.
- Append-only audit log: upload, confirmation, correction, deletion, export, letter production. It records the act, never the content.
- Minimisation towards the model: only the contract text and the organisation name are transmitted. No accounts, no email addresses, no billing data, no data from another customer. Each call is independent and stateless.
- Human review: no uncertain information is presented as a fact; every value carries its source quote and its confidence score.
- Backups, encrypted, on a thirty-day rotation.
- Automated tests and continuous evaluation of the extraction pipeline: a quality regression blocks the release.
9. Anonymised reuse of corrections
Corrections made by users are used to measure and improve extraction quality. They are reused only in anonymised form: direct identifiers replaced with consistent fictitious substitutes, amounts perturbed, dates shifted, references regenerated, mapping table destroyed. The result falls outside the scope of the GDPR.
The customer may object at any time, without justification and without effect on the service, by writing to privacy@wyncove.fr. No model is trained or fine-tuned on that data, anonymised or not.
10. Audit and information
On written request, Wyncove makes available: this dated version, the privacy policy, the Security page, and its data and AI governance policy — an internal versioned document, exported as a dated PDF on request.
A documentary audit is possible once a year, with reasonable notice, at the requester's expense and under a confidentiality agreement. An on-site audit at the sub-processors falls under their own certification programmes, whose reports are passed on where they can be shared.
11. Separate signature
This agreement takes effect through acceptance of the terms of service, of which it is an annex. A customer that must produce a signed document — because its own record of processing activities requires it, or its insurer — may request a copy from privacy@wyncove.fr: the version provided will be identical to this one, dated the day of signature.
12. Contact
Any question relating to data protection: privacy@wyncove.fr. Wyncove has not appointed a data protection officer, such an appointment not being mandatory given its activity and its size; this point is reviewed at each revision of the governance policy.