Courtesy translation: only the French version, governed by French law, is legally binding. It can be read at: https://promomedia.fr/sous-traitance
Data processing agreement for personal data
Article 28 of the GDPR. This agreement forms part of the general terms of sale (Article 11.2).
Between:
- The Customer, as identified on its account and order ("the Controller");
- PROMOMÉDIA, SAS with a share capital of €1, registered with the Nanterre trade and companies register under no. 948 206 438, 99 avenue Achille Peretti, 92200 Neuilly-sur-Seine ("the Processor").
It applies for as long as PROMOMÉDIA processes personal data on behalf of the Customer.
Article 1 - Purpose
The Processor processes, on behalf of the Controller, the personal data of the listeners of the apps, websites and services provided (Streaming, mobile apps, radio websites, Alexa skills), solely to provide those services.
Article 2 - Description of the processing
- Purpose: operation of the services (notifications, dedications, listening statistics, display of content).
- Nature: collection, hosting, transmission, consultation, deletion.
- Data subjects: listeners and users of the Customer's apps and websites.
- Types of data: notification tokens (device identifier), nicknames and dedication messages, IP address, technical connection data, listening statistics.
- Duration: that of the contract, then deletion in accordance with Article 9.
Article 3 - Instructions
The Processor processes the data only on the documented instructions of the Controller (the Terms of Sale, normal use of the service and its settings constitute instructions). It informs the Controller if an instruction appears to it to infringe the GDPR.
Article 4 - Confidentiality
The Processor ensures that the persons authorised to process the data are bound by confidentiality and trained in data protection.
Article 5 - Security
The Processor implements technical and organisational measures appropriate to the risk, in particular: encryption of exchanges, access control, strengthened authentication for the team, backups, logging, security updates.
Article 6 - Sub-processors
6.1. The Controller gives general authorisation for the use of sub-processors, the list of which appears in the annex.
6.2. The Processor informs the Controller of any addition or replacement with 30 days' notice; the Controller may object for a reasonable reason and, failing agreement, terminate the service concerned.
6.3. The Processor imposes on its own sub-processors the same data protection obligations and remains liable to the Controller for their performance.
Article 7 - Rights of data subjects
The Processor assists the Controller, by appropriate measures, in responding to requests to exercise rights (access, rectification, erasure, objection, restriction, portability). If it receives a request directly, it forwards it to the Controller within 5 working days without replying to it itself.
Article 8 - Personal data breach
The Processor notifies the Controller of any personal data breach without undue delay, and at the latest 48 hours after becoming aware of it, indicating the nature of the breach, the data concerned, its likely consequences and the measures taken. The Controller remains responsible for notifying the CNIL and the data subjects where necessary.
Article 9 - Fate of data at the end of the contract
At the end of the service, the Processor deletes the data or returns it to the Controller, at the Controller's choice. The data is kept for 30 days after termination (Article 12.3 of the Terms of Sale), then deleted, unless there is a legal retention obligation.
Article 10 - Transfers outside the European Union
The data is hosted in France. Only the platforms' notification services (see annex) may involve a transfer outside the European Union; it only takes place with appropriate safeguards (adequacy decision or standard contractual clauses).
Article 11 - Assistance and audit
11.1. The Processor assists the Controller in meeting its obligations regarding security, impact assessments and prior consultation of the CNIL, to the extent of the information available to it.
11.2. It makes available the information necessary to demonstrate compliance with this agreement and allows audits, once a year except in the event of an incident, on written request with reasonable notice, at the Controller's expense and without compromising the security of other customers.
Article 12 - Liability
Each party is liable for its breaches of the GDPR under the conditions of ordinary law, within the limits set by Article 9 of the Terms of Sale, without prejudice to the rights of data subjects.
Article 13 - Record and documentation
The Processor keeps the record of its processing activities carried out on behalf of customers (Article 30.2 of the GDPR).
Annex - Sub-processors
| Processor | Role | Location |
|---|---|---|
| o2switch | Hosting of the platform | France |
| o2switch | Sending of emails | France |
| Google (Firebase Cloud Messaging) | Android notifications | EU / United States (standard contractual clauses) |
| Apple (APNs) | iOS notifications | United States (standard contractual clauses) |
| Stripe | Payment (the Customer's payment data, excluding listeners) | EU / United States |
Version of 4 November 2026.