1. Parties and purpose
This agreement is made between the customer holding an Orkalo workspace (“the controller”) and the publisher of Orkalo, Keddy Girel Andamba Gnegne, sole trader, SIREN 923 735 674, 5 Rue Sarret de Coussergues, Résidence Jules Verne, 34300 Agde, France (“the processor”). It sets out how the processor handles, on behalf of the controller, the personal data entrusted to Orkalo. It forms part of the terms of use and applies as long as the workspace exists. Acceptance of the terms of use counts as acceptance of this agreement; a separately signed version can be provided on request.
2. Description of the processing
- Nature: hosting, storage, consultation, transmission to connected platforms, sending messages, producing documents, deletion.
- Purpose: short-term rental management (properties, bookings, guests, jobs, owners, payments).
- Data subjects: guests, service providers (with or without an account), owners, members of the controller's team.
- Data: identity and contact details, stay dates and details, amounts, messages, photos, signed documents (name, date, IP), job check-ins (position at the tap), and, if the controller asks for them, identity documents and guest forms.
- Duration: that of the subscription, followed by return and deletion (article 9).
3. Controller's instructions
The processor handles the data only on the controller's documented instructions: these instructions are the settings and actions made in Orkalo, together with this agreement. If an instruction seems to breach the GDPR, the processor informs the controller without delay.
4. Confidentiality and security
People at the processor who are authorised to access the data are bound by confidentiality and only access it when needed (support requested, incident). The security measures applied are described in the appendix (article 11).
5. Sub-processors
The controller authorises the processor to use the providers listed in the privacy policy (hosting, e-mail, platform connection, payments, address search, Apple / Google sign-in). The processor imposes equivalent protection obligations on them. It informs the controller of any addition or replacement at least 30 days in advance; the controller may object on legitimate grounds and, failing a solution, terminate at no cost.
6. Data subjects' rights
The processor helps the controller answer requests from data subjects (access, correction, deletion, portability, objection), in particular through Orkalo's export and deletion features. A request received directly by the processor is forwarded to the controller without delay.
7. Data breach
The processor notifies the controller of any personal data breach within 48 hours of becoming aware of it, with the information the controller needs to notify, where applicable, the supervisory authority within 72 hours and the data subjects.
8. Assistance and evidence
The processor reasonably assists the controller with impact assessments and consultation of the supervisory authority. It provides the information needed to demonstrate compliance with this agreement and accepts audits, with 30 days' notice and at the controller's expense, without access to other customers' data.
9. End of the contract
At the end of the subscription, the controller can export its data for 30 days. The processor then deletes it, including from backups at the end of their 30-day cycle, unless a legal retention obligation applies. Deletion is completed at the latest 90 days after the subscription ends.
10. Controller's obligations
The controller chooses the legal basis of each processing, informs the data subjects (guests, service providers, owners), in particular about location check-in and the collection of identity documents, and only asks for the data needed. It sets its team's rights and protects its own access.
11. Appendix: security measures
- Encrypted connections (HTTPS) and encrypted passwords.
- Revocable sessions; tokens kept in the phones' keychain; Face ID or fingerprint in the apps.
- Strict separation of customer workspaces and role-based rights.
- Identity documents stored separately, restricted access, automatic deletion.
- Login attempt limits and a log of sensitive actions.
- Encrypted daily backups, kept for 30 days.
- Automatic deletion of check-ins after 12 months.
- Servers in the European Union with UpCloud (Finland).