This Data Processing Addendum ("DPA") is part of the agreement between the customer that opens a reCloud workspace ("Customer") and LINEXA CONSULTING, a company registered in France under SIREN 107 250 946 (SIRET 107 250 946 00012, intra-EU VAT FR67 107 250 946), with its registered office at 4 Rue Lakanal, 78500 Sartrouville, France ("LineXa"), under the reCloud Terms of Service. It applies when the service processes personal data that is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR or similar laws. The Customer accepts it by opening or using a workspace.
1. Roles
- The Customer is the controller of the personal data in the cloud projects it connects and in its workspace.
- LineXa is a processor: the service processes that data only to provide its features to the Customer.
- The providers in section 6 are sub-processors.
- For the data LineXa needs to run its own business (invoicing, security of the service, answering requests), LineXa is a controller, as described in the privacy policy.
2. What is processed
| Data subjects | The Customer's users of the workspace, and the people and service accounts that appear in the descriptions of the connected cloud projects (for example in labels, resource names and role grants) |
| Personal data | For users: name, e-mail address, role, password hash, sign-in records. For the scans: names, labels and e-mail addresses that appear in resource descriptions and in the roles granted in a project |
| Other data | Resource type, location, status, size, configuration, usage signals, cost estimates and findings. This is not personal data unless the Customer puts personal data in names or labels |
| Special categories | None. The service does not need or ask for any |
| Purpose | To provide the service: scan the connected projects, show the findings and run the workspace |
| Duration | While the workspace exists and the project is connected, then as set out in section 8 |
The service does not read the data stored in the Customer's resources, such as bucket contents, table data, secret values or log contents.
3. LineXa's obligations
LineXa will:
- Process personal data only on the Customer's documented instructions. Using the service as described in the user guide is those instructions.
- Not sell personal data, use it for its own purposes, or combine it with other data.
- Make sure anyone at LineXa who could access personal data is bound by confidentiality.
- Keep the security measures in section 5.
- Help the Customer answer data subject requests and meet its obligations on security, breach notification and impact assessments, as far as the service's design allows.
- Delete or return personal data at the end of processing (section 8).
- Give the Customer the information needed to show that it meets these obligations (section 9), and tell the Customer if it believes an instruction breaks data protection law.
4. Where the data is
Scan results and workspace data are hosted in the European Union.
- The service reads the Customer's cloud projects over the cloud provider's API, with a read-only account and a one-hour token. No key file is stored.
- LineXa does not move the data outside the European Union as part of running the service.
- Support staff reach customer data only through the administration console, and every change is logged.
5. Security
- Read-only by design: one custom role with list and describe permissions only. The service has no permission to change the Customer's cloud or to read the data inside its resources.
- No stored cloud keys: a one-hour token is used, and the Customer ends access at any time with one command.
- Isolation: each workspace has its own address and its own users, and a session is bound to one workspace.
- Access control: users have roles. Passwords are stored as hashes, an account is locked after repeated failed sign-ins, and sessions expire. Sign-in to the administration console requires a second factor.
- Encryption: connections to the service use HTTPS, and secrets such as mail credentials are encrypted at rest.
- Audit: sign-ins and staff changes are logged.
- Data minimisation: the service stores descriptions of resources, not their contents.
- Code: changes are reviewed and tested before release.
6. Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| OVH SAS (Roubaix, France) | Hosts the service, its database and the scan results | France, European Union |
| Brevo (France) | Sends the e-mails of the service (invitations, replies, notices) | European Union |
The Customer authorises these sub-processors. LineXa will update this page at least 30 days before adding or replacing a sub-processor. The Customer may object in writing within that time. If LineXa and the Customer cannot resolve the objection, the Customer may stop using the service and disconnect its projects.
7. Personal data breaches
LineXa will tell the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the service. The notice will say what happened, what data and people are affected, the likely consequences and what is being done about it. Notices go to the owners of the Customer's workspace, by e-mail.
8. Deletion
- When a project is disconnected: its data is deleted within 30 days.
- When a workspace is deleted: an owner can delete it at any time in Settings, under Delete my account. Its projects, scan results, members, sessions and sign-in records are deleted at once, and people who belong to no other workspace lose their account. LineXa keeps only what the law requires, such as bills.
- On request: the Customer can ask LineXa at any time to help remove specific data.
9. Information and audits
On written request, LineXa will answer reasonable questions about how the service processes personal data, will describe the measures in this DPA in more detail, and will send the full role file for review before a project is connected. Any further audit must be agreed in advance, at reasonable times and with reasonable notice.
10. International transfers
LineXa does not transfer Customer personal data outside the European Union as part of running the service. If that ever changes, LineXa will tell the Customer in advance and will put in place the transfer tools the law requires, such as the EU Standard Contractual Clauses.
11. Liability, order and law
- Liability: the limits of liability in the Terms of Service apply to this DPA.
- Order of precedence: if this DPA and the Terms of Service conflict about personal data, this DPA wins.
- Governing law: this DPA is governed by French law.
Contact
Data protection questions and requests: support@linexa.eu.