Version 2.0 of 13/10/2026
Between the undersigned:
Oxemis SARL, hereinafter referred to as the “Processor”, on the one hand, and the customer, acting as Data Controller, hereinafter referred to as the “User”, on the other hand,
It is agreed as follows:
1. Purpose of the Agreement
This agreement sets out the conditions under which Oxemis SARL, as Processor, undertakes to carry out, on behalf of the User, the personal data processing operations defined below.
Under this agreement, the User acts as Data Controller, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the “General Data Protection Regulation” (GDPR).
2. Definitions
For the interpretation of this agreement, the following terms are defined as follows:
2.1 Personal Data: any information relating to an identified or identifiable natural person within the meaning of the GDPR, which the Processor processes on behalf of the Data Controller.
2.2 Personal Data Breach: any breach of security leading to the destruction, loss, alteration, disclosure of, or unauthorised access to Personal Data.
2.3 Processing: any operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, combination, restriction or erasure of Personal Data.
3. Processing Details
3.1 Types of Personal Data
Contact information such as email addresses, phone numbers, surnames, first names, job titles, as well as any other type of data determined and controlled by the User according to their preferences and the settings of the services provided by Oxemis SARL.
3.2 Categories of Data Subjects
All categories of natural persons, determined and controlled by the User at their sole discretion, including in particular: customers, prospects, employees, subcontractors, suppliers, etc.
3.3 Subject Matter and Nature of the Processing
The Processor processes Personal Data in order to provide services to the Data Controller, involving the Processing of Personal Data and the performance of the Processor’s obligations in accordance with the agreement and the terms agreed between the parties. The services include, in particular, the processing of recipient databases, the analysis of recipient behaviour, the definition of marketing communication strategies, etc.
3.4 Duration of the Processing
Personal Data is processed for the entire duration of the contractual relationship between the parties. It is kept for a maximum of 18 months after the end of the contractual relationship to allow a contract to be reactivated after a period of inactivity, and is then permanently deleted. The User may request early deletion at any time, under the conditions set out in article 6.
4. Obligations of the Parties
4.1 Obligations of the User
The User is responsible for the Processing carried out as part of the subscribed services. The User undertakes to provide the necessary Personal Data, to document Processing instructions, to ensure compliance with GDPR obligations, to supervise the Processing through audits, and to take the necessary security measures.
4.2 Obligations of the Processor
Oxemis SARL processes Personal Data only on documented instructions from the User, implements appropriate security measures, undertakes to inform the User in the event of a Personal Data Breach, and provides assistance regarding the rights of data subjects.
4.3 Supervisory Authorities
The Parties cooperate with the competent data protection authorities.
4.4 Data Protection Officer
Oxemis SARL has appointed a data protection officer, who can be reached at dpo@oxemis.com.
4.5 Application of the General Terms
This agreement supplements the general terms and conditions applicable to the services subscribed by the User, and prevails in the event of any contradiction.
4.6 Amendments
This agreement may be amended at any time. In the event of amendments, the User may terminate the services free of charge within thirty days of the date on which these amendments come into force.
5. Sub-processing
5.1 General Authorisation: the User authorises Oxemis SARL to engage sub-processors for the hosting and operation of the infrastructure required for the services. The list of current sub-processors is set out in Appendix 1.
5.2 Location: sub-processors host Personal Data exclusively in France and the European Union. No transfer outside the European Union takes place.
5.3 Sub-processors’ Obligations: Oxemis SARL contractually imposes on each sub-processor data protection obligations at least equivalent to those of this agreement. Oxemis SARL remains fully liable to the User for the performance of these obligations by its sub-processors.
5.4 Change of Sub-processor: Oxemis SARL informs the User of any addition or replacement of a sub-processor at least 30 days before it takes effect, by email and by updating Appendix 1. The User may object in writing, giving reasons, within this period. Failing agreement between the parties, the User may terminate the services concerned free of charge.
6. Fate of the Data at the End of the Contract
6.1 Retention then Deletion: upon expiry or termination of the services, Personal Data processed on behalf of the User is kept for a maximum of 18 months to allow the contract to be reactivated. At the end of this period, Oxemis SARL permanently deletes it. No copy is kept, either by Oxemis SARL or by its sub-processors.
6.2 Deletion on Request: the User may at any time request the deletion of all or part of their Personal Data, including during the 18-month period provided for in article 6.1, by email to dpo@oxemis.com. Oxemis SARL carries out the deletion within 30 days and confirms it in writing.
6.3 Return of Data: before the services expire, the User can export their data from their customer area or request its return in a standard format (CSV).
6.4 Backups: Personal Data contained in backups is erased at the end of their rotation cycle, no later than 90 days after deletion. During this period, it is not subject to any processing.
6.5 Legal Exception: only data whose retention is required by a legal obligation may be kept, for the strictly necessary period.
7. Data Security
7.1 Measures Implemented: Oxemis SARL implements the technical and organisational measures described in its Information Security Policy (ISSP). The main measures are summarised in Appendix 2.
7.2 Evolution of the Measures: Oxemis SARL may update these measures to keep up with the state of the art, provided the overall level of security is never reduced.
7.3 Staff Confidentiality: persons authorised to process Personal Data are bound by a confidentiality obligation and receive appropriate training.
7.4 Breach Notification: in the event of a Personal Data Breach, Oxemis SARL notifies the User within a maximum of 48 hours after the incident has been qualified. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken to address it.
8. Assistance to the Data Controller
8.1 Impact Assessments and Prior Consultation: Oxemis SARL provides the User, on request, with the information needed to carry out a data protection impact assessment and, where applicable, a prior consultation of the supervisory authority. This information includes in particular the description of the processing, the ISSP, the list of sub-processors and the location of the data.
8.2 Data Subjects’ Rights: Oxemis SARL forwards to the User without delay any request to exercise rights received directly from a data subject. It helps the User respond, in particular through the editing, export and deletion features available in the services.
8.3 Audits: Oxemis SARL makes available to the User the information needed to demonstrate compliance with this agreement. It allows audits to be carried out by the User or by an auditor appointed by the User and bound by confidentiality, subject to 30 days’ notice and limited to one audit per year, except in the event of a Personal Data Breach.
Appendix 1 — List of Sub-processors
| Sub-processor | Registered office | Service | Data location |
|---|---|---|---|
| OVH SAS (OVHcloud) | 2 rue Kellermann, 59100 Roubaix, France | Dedicated server hosting | France |
| Scaleway SAS | 8 rue de la Ville l’Évêque, 75008 Paris, France | Dedicated server hosting | France and the Netherlands (Amsterdam) |
For the SMS service, Oxemis SARL also uses an SMS delivery provider established in the European Union. Its identity is disclosed to any User of the SMS service upon request to dpo@oxemis.com.
Appendix 2 — Technical and Organisational Measures
Summary of the Oxemis ISSP. The ISSP prevails in case of discrepancy.
| Area | Measure |
|---|---|
| Hosting | Dedicated servers (OVHcloud, Scaleway) located in France and the European Union. No public cloud (hyperscaler) for sensitive data. |
| Segregation | Each customer’s data is isolated by a unique identifier (Tenant ID) injected into every request. |
| Encryption in transit | TLS 1.2 minimum and HTTPS mandatory. Any unsecured connection is rejected. |
| Minimisation | The bodies of messages sent via SMTP and the API are not kept: they are purged once delivery is complete. |
| Administrator access | Least privilege. Authentication by SSH keys or certificates, never by password alone. Audit logs. |
| Customer access | Strong passwords and multi-factor authentication (MFA). Unique API keys, instantly revocable. |
| Continuity | Services spread across several remote data centres. Switchover to a backup site documented and tested. |
| Backups | Restore tests at least once a year. |
| Updates | Critical security patches applied automatically. Major updates tested in a staging environment. |
| Workstations | Full-disk encryption (BitLocker). Storing customer data locally is prohibited. |
| Staff | Risk awareness from onboarding and on an ongoing basis. Vulnerability monitoring (CVEs). Immediate revocation of access when an employee leaves. |
| Incidents | Incidents can be reported 24/7 via support@oxemis.com. Customer notified within 48 hours after a breach has been qualified. |
This English version is provided for convenience. In case of discrepancy, the French version prevails.