Data processing agreement

The controller is the business customer who holds the account (“the Customer”). The processor is Pandem Network, registered non-profit association (French law of 1 July 1901), SIREN 131 572 885, registered office Dom Ici, 57 rue Auguste Chevallier, 37000 Tours, France (“Pandem”). Pandem processes these data on the Customer’s behalf, only to provide, secure and back up the services subscribed.

For the data of your own customer account (contact details, invoices, connection logs), Pandem is the controller: see the privacy policy.

• Services concerned: email (mailboxes, aliases, address books and calendars), virtual servers (VPS), game servers and Discord bots, web hosting (files, databases), DNS hosting.
• Operations: hosting, storage, transmission, replication between sites, backup and deletion.
• Purpose: providing the services subscribed, keeping them secure and backed up.
• Data: whatever the Customer places in the services; for email, the messages and attachments, contacts, calendars, access credentials and the mailboxes’ connection logs.
• Data subjects: the Customer’s users, customers and correspondents, and the visitors of its websites.
• Duration: that of the services subscribed, then deletion under article 9.

Pandem does not ask for any special category of data (GDPR article 9). The Customer does not place in the services health data subject to the certified hosting requirement (article L.1111-8 of the French Public Health Code), unless Pandem agrees in writing.

Pandem:

• processes the data only on the Customer’s documented instructions: the terms of sale, this agreement, the settings made in the customer area and the Customer’s written requests, including for any transfer outside the European Union; if an instruction seems to infringe the GDPR, Pandem tells the Customer; if the law requires a processing, Pandem tells the Customer beforehand, unless the law forbids it;
• ensures that the persons authorised to process the data are bound by confidentiality; the administration screens show only mailbox metadata, never the content of messages;
• implements the security measures of article 5;
• engages a sub-processor only under the conditions of article 6;
• helps the Customer answer requests from data subjects exercising their rights (article 7);
• helps the Customer meet its obligations on security, breach notification, impact assessment and prior consultation (GDPR articles 32 to 36), taking into account the information available to Pandem;
• deletes the data at the end of the services, under article 9;
• makes available to the Customer the information needed to demonstrate compliance with this agreement and allows audits under article 10.

The Customer’s data are hosted on Pandem’s servers in the Tours area (Indre-et-Loire, France) and with the sub-processors listed in the annex, at the places it states. Pandem does not transfer the Customer’s data outside the European Union without the Customer’s instruction and without the safeguards of chapter V of the GDPR.

• TLS encryption of every access (IMAP, POP, SMTP, DAV, panels, APIs) and of the traffic between sites;
• passwords stored hashed and server secrets encrypted at rest; revocable app passwords for email; two-factor authentication available on accounts;
• service networks filtered by Pandem’s routers, email networks isolated; server administration by SSH key only;
• email replicated on three sites; regular machine backups; off-site copies encrypted before they are sent, with a key Pandem keeps offline;
• logging of sign-ins and administration actions;
• the servers’ disks are not encrypted at rest.

These measures evolve; Pandem does not lower them below the level described here.

The Customer authorises Pandem to engage the sub-processors listed in the annex. Pandem informs the Customer by email of any addition or replacement at least 30 days in advance; the Customer may object within that time and, failing agreement, cancel the service concerned free of charge, with a refund of the paid period not used.

Pandem imposes on each sub-processor, by contract, the same data protection obligations as those of this agreement and remains liable to the Customer for their performance.

Pandem forwards to the Customer without delay any request from a data subject it receives directly, without answering it itself unless instructed. The customer area gives the Customer the tools to answer (mailbox export over IMAP, deletion of mailboxes, aliases and websites, editing of DNS zones); Pandem helps with the rest, on request.

Pandem notifies the Customer of any personal data breach concerning it without undue delay and at the latest 48 hours after becoming aware of it, by email to the account address, with the information of GDPR article 33(3) available to it, which it completes as it goes. It is for the Customer, as controller, to notify its supervisory authority and to inform the data subjects where needed; Pandem helps.

Before a service ends, the Customer retrieves its data: mailboxes over IMAP, website and server files over SFTP or from the panels. At the end, the data are deleted under the rules of the terms of sale (article 4): email read-only for 30 days, then suspended and deleted 60 days after the due date; websites offline for 7 days, then deleted with their databases and backups; servers deleted when the service ends.

The service’s backups are deleted with it; copies that remain in the infrastructure backups disappear as these rotate. Only data the law requires Pandem to keep are kept, for the legal period.

Pandem provides the Customer, on request, with the information needed to demonstrate compliance with this agreement (description of the security measures, list of sub-processors, extracts of the record of processing). The Customer may have an audit carried out on written request, with 30 days’ notice, at most once a year unless a breach has occurred, at its own cost, by an auditor bound by confidentiality and without access to other customers’ data.

This agreement is governed by French law; disputes fall under the courts named in article 11 of the terms of sale. If this agreement and the terms of sale conflict on data protection, this agreement prevails.

As of the date this agreement was last updated: