Data Processing Agreement (GDPR)
Last updated: September 2026
This is a translation provided for convenience. In the event of any discrepancy, the French version prevails.
This agreement supplements the Terms of Use for clients subject to the General Data Protection Regulation (GDPR). It applies as soon as the terms are accepted, with no further formality required: if your organization needs a signed copy, write to contact@denkimedia.com.
1. Roles of the parties
The client is the controller: it decides which documents it uploads, the content of its publications and the measurement tools it integrates into them. Denkimedia (Amaury Chouia, sole proprietorship established in Quebec, Canada) acts as processor: it processes this data solely to provide the service, on the client's instructions.
2. Subject matter, duration and nature of the processing
| Item | Details |
|---|---|
| Subject matter | Conversion of a document into an interactive web publication, hosting, editing of interactive areas, audience measurement |
| Duration | Term of the contract, followed by deletion in accordance with Article 9 |
| Nature of the operations | Collection, conversion, storage, consultation, making available, deletion |
| Categories of data subjects | Persons mentioned in the documents uploaded by the client, visitors to its publications, users of the client account |
| Categories of data | Content of uploaded documents, account data, page viewed, date and country of the visitor; no special categories of data are requested by the service |
3. Instructions
Denkimedia processes the data only on documented instructions from the client: the Terms of Use, the account settings and written requests serve as such instructions. If an instruction appears to infringe the GDPR, Denkimedia informs the client without delay.
4. Confidentiality
Persons authorized to access the data are bound by confidentiality. Access is limited to what is necessary to operate and support the service.
5. Security
- Encryption of communications (HTTPS) and of backups;
- passwords stored only in hashed form, never in plain text;
- account isolation: a client can access only its own publications;
- protection of publications by access code, at the client's request;
- daily backups retained for 14 days, with automatic rotation;
- error logging without any visitor personal data.
6. Sub-processors
The client authorizes the following sub-processors. Any change to this list is announced by email before it takes effect, giving the client the opportunity to object and, where applicable, to terminate.
| Provider | Role | Country |
|---|---|---|
| OVH Canada Inc. | Hosting of the service and publications | Canada (adequacy decision) |
| Infomaniak | Delivery of transactional emails | Switzerland (adequacy decision) |
7. Transfers outside the European Union
The data is hosted in Canada and emails are delivered from Switzerland, two countries covered by an adequacy decision of the European Commission. No transfer to any other country is necessary for the operation of the service.
8. Assistance, incidents and data subject rights
Denkimedia assists the client in responding to requests to exercise data subject rights and, taking into account the information available to it, in meeting its security, notification and impact assessment obligations. Any data breach is reported to the client without undue delay after Denkimedia becomes aware of it, with the information known at that time.
9. Data at the end of the contract
At the end of the contract, the client may export its data from its account. Deleted publications remain recoverable for 30 days and are then permanently destroyed, including files. Deleting the account immediately erases the account, the publications and their statistics.
10. Audit
Upon reasonable written request, Denkimedia makes available the information necessary to demonstrate compliance with these obligations.