Business data-processing terms.

1. Scope and parties

This Data Processing Addendum (“DPA”) is between the customer identified in the agreement that incorporates it (“Customer”) and ML BOOST, a French société par actions simplifiée with registered office at 6 rue d’Armaillé, 75017 Paris, France (“ML BOOST”). It forms part of that agreement only when the agreement or a signed order expressly incorporates this DPA.

This DPA applies when ML BOOST processes personal data in Customer Data on Customer’s behalf to provide a hosted Pagewrite business workflow. It does not govern data for which ML BOOST independently decides the purposes and means, such as its own account administration, billing, security, and business-contact records; those activities are described in the privacy notice.

2. Roles, law, and documented instructions

For Customer Personal Data, Customer is the controller and ML BOOST is the processor, or Customer is a processor and ML BOOST is its subprocessor. “Controller”, “processor”, “personal data”, “processing”, “personal data breach”, and “supervisory authority” have the meanings given by applicable data-protection law, including the GDPR where it applies.

Customer instructs ML BOOST to process Customer Personal Data only to provide, secure, support, and terminate the contracted Pagewrite service; to follow the configuration and actions submitted through authorised Customer users or agents; and to comply with other documented instructions agreed by the parties.

ML BOOST will notify Customer if, in its reasonable opinion, an instruction infringes applicable data-protection law, and may pause the affected processing while the parties resolve it. ML BOOST may process data where Union or Member State law requires it, after informing Customer before processing unless that law prohibits notice.

Customer is responsible for the lawfulness, accuracy, and minimisation of Customer Personal Data; required notices and consents; the authority of its users and agents; and selecting a workflow appropriate to the data and matter.

3. ML BOOST processor duties

ML BOOST will:

• process Customer Personal Data only on documented instructions and for the agreed service;
• ensure persons authorised to process it are bound by confidentiality;
• apply the technical and organisational measures in Annex 2, taking account of the processing risk;
• engage subprocessors only under section 5;
• assist Customer, taking account of the nature of processing and information available to ML BOOST, with data-subject requests, security, breach notifications, impact assessments, and regulator consultations;
• delete or return Customer Personal Data at the end of the service as set out in section 9, unless applicable law requires retention; and
• make available the information reasonably necessary to demonstrate compliance with these processor obligations.

ML BOOST will not sell Customer Personal Data, use it for third-party advertising, or use live case content to train a general model unless Customer gives a separate, express written instruction that identifies the data and purpose.

4. Security of processing

ML BOOST will maintain measures appropriate to the risk, including the measures in Annex 2. Customer acknowledges that different deployment paths have different data flows: a hosted workflow may use the providers listed for that route, while a customer-run deployment shifts environment, credential, logging, storage, and provider controls to Customer.

Customer must use supported authentication, protect API keys and agent credentials, limit user permissions, avoid unnecessary source documents, review generated output before use, and promptly tell ML BOOST about a suspected compromise affecting the service.

No certification, dedicated environment, data-residency commitment, zero-egress claim, recovery objective, penetration-test right, or regulated-data approval applies unless it is stated in the signed order after validation.

5. Subprocessors

Customer gives general written authorisation for ML BOOST to use subprocessors needed for the contracted hosted workflow. The current provider register, service purpose, and general processing location are published at pagewrite.dev/subprocessors. The order may narrow that list for a specific workflow.

ML BOOST will impose data-protection obligations on a subprocessor that are no less protective, in substance, than the obligations applicable to ML BOOST under this DPA. ML BOOST remains responsible to Customer for the subprocessor’s performance of those obligations.

For an active production business service, ML BOOST will give reasonable advance notice through the Customer business contact before adding or replacing a subprocessor that will process Customer Personal Data. Customer may object on reasonable data-protection grounds within the notice period. The parties will work in good faith on a commercially reasonable alternative; if none is available, either party may terminate the affected service, and ML BOOST will refund prepaid fees for the unused terminated period where applicable.

6. International transfers

ML BOOST is established in France. It will not transfer Customer Personal Data to a country outside the European Economic Area, nor permit such access, unless the transfer is covered by an adequacy decision or another valid transfer mechanism and the safeguards required by applicable law.

Where necessary, the parties will incorporate the then-current European Commission Standard Contractual Clauses using the module appropriate to their roles, together with required supplementary measures. For a UK restricted transfer, the parties will use the applicable UK addendum or other lawful mechanism. Provider-level transfer information is described in the provider register and the applicable provider terms.

7. Data-subject rights and compliance assistance

If ML BOOST receives a request concerning Customer Personal Data, it will not respond for Customer except on Customer’s documented instruction or where law requires it. It will redirect the requester to Customer where reasonably possible and promptly notify Customer, unless prohibited.

Taking account of the processing and information available, ML BOOST will provide reasonable assistance with access, correction, deletion, restriction, portability, objection, impact assessments, prior consultation, and evidence needed for Customer’s compliance. Assistance beyond standard service functionality may be charged at an agreed reasonable rate unless it is required because ML BOOST breached this DPA.

8. Personal data breaches and government requests

ML BOOST will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. As information becomes available, the notice will describe the nature of the incident, affected data and people where known, likely consequences, measures taken or proposed, and a contact for follow-up. Notification is not an admission of fault.

ML BOOST will take reasonable steps to contain, investigate, remediate, and document the incident and will cooperate with Customer’s legally required assessment and notices. Customer remains responsible for notifying its supervisory authority and affected people unless the parties agree otherwise.

Where legally permitted, ML BOOST will notify Customer of a binding government demand for Customer Personal Data, review the demand for validity, seek to narrow excessive demands, and disclose only what it is legally required to disclose.

9. Return and deletion

During the service, Customer should export completed outputs and use available deletion controls. On termination or Customer’s documented request, ML BOOST will return or delete Customer Personal Data within the period stated in the order. If the order is silent, the hosted guided-form default is deletion of saved answers, chat, generated packet, and linked technical receipt no later than 30 days after the relevant session expires or is deleted.

Deletion from backups or provider resilience copies may follow the provider’s ordinary overwrite cycle, during which the data remains protected and is not restored except for continuity or recovery. ML BOOST may retain narrowly required records where Union or Member State law requires it, isolated from ordinary use and deleted when the obligation ends.

10. Information, audit, and order of precedence

ML BOOST will first satisfy reasonable verification requests with current policies, architecture information, provider materials, test summaries, or other existing evidence. If that is insufficient, Customer may conduct one audit per 12-month period through an independent qualified auditor, on reasonable written notice, during normal business hours, under confidentiality, and without accessing another customer’s data or disrupting the service.

Customer bears its audit costs and ML BOOST’s reasonable incremental assistance costs, except where an audit identifies a material breach by ML BOOST. The frequency and notice limits do not restrict a competent supervisory authority or an audit reasonably required after a confirmed material incident.

If this DPA conflicts with the agreement on processing Customer Personal Data, this DPA controls. The signed order controls workflow-specific scope, region, retention, and provider commitments. The governing-law and dispute provisions of the agreement apply to this DPA.

Annex 1 · Details of processing

Annex 2 · Technical and organisational measures

The exact architecture is recorded in the order. The hosted baseline includes:

• Access control: authenticated customer access; scoped API credentials; restricted production and provider administration; service identities and least-privilege permissions where supported.
• Transport and secrets: HTTPS/TLS for public service traffic; managed secret storage for production credentials; no secrets embedded in public legal or landing content.
• Data minimisation: bounded schemas; workflow-specific collection; no general advertising use; no readable answer values in the narrow technical fill receipt; lead forms ask users not to submit case files.
• Isolation and storage: account or session identifiers; access checks on protected routes; managed database controls for persistent service metadata; access-controlled instance-local temporary files for the current hosted processing path; production fails closed when required persistent database storage is unavailable.
• Output safety: rendered-page review, deterministic checks where configured, human-review boundaries, and no representation that an authority has approved or filed an output.
• Retention and deletion: workflow expiry; user-triggered guided-session deletion; bounded enquiry and marketing retention; documented provider deletion cycles.
• Application security: input validation; rate and abuse controls on public collection endpoints; signed payment webhooks; restricted cross-origin configuration; browser security headers; dependency and release tests.
• Release and incident handling: pre-deployment tests; candidate health and configuration checks; rollback for failed backend cutover; logging and investigation procedures; restricted incident contacts.
• Personnel and vendors: confidentiality duties; provider due diligence proportionate to the service; written subprocessor data-protection terms; access limited to operational need.

Customer-run or on-premises deployments require a separate responsibility matrix. Customer is responsible for the environment and providers it controls; ML BOOST is responsible only for the components and support expressly identified in the order.