Data Processing Agreement (DPA)
Last updated : 14 October 2026
This document sets the data processing agreement entered into, under GDPR article 28, between the customer agency (controller) and the Tolus provider (processor). It is accepted together with the terms of service.
1. Purpose and scope
Scope of the agreement and relationship with the terms of service.
- Parties: the Customer (agency, controller) and Digitz, 73 Cours Albert Thomas, 69003 Lyon, France, publisher of the Tolus service (processor).
- Purpose: govern the processing of personal data carried out by the processor on behalf of the Customer as part of the Tolus service.
- Relationship: this agreement supplements the terms of service; in case of conflict about the processing of personal data, it prevails.
- Effective date and acceptance: this agreement is accepted together with the terms of service, through the sign-up checkbox, and takes effect when the organization is created.
2. Definitions and roles
GDPR terms and qualification of the parties.
- Definitions: personal data, processing, controller, processor, subprocessor, data subject, personal data breach (reference to GDPR article 4).
- The Customer determines the purposes and means; the processor acts on instructions.
- Special case: the Customer’s account and billing data, for which the provider is the controller, are covered by the privacy policy.
3. Description of the processing
Content of the descriptive annex required by article 28.
- Nature and purpose: hosting and provision of a ticketing and maintenance-retainer tracking tool; sending transactional emails to users.
- Optional writing assistance with Mistral AI: correcting, clarifying or shortening text at an authorized user’s request, with manual review and application. Only the selected text, or the draft text when nothing is selected, is sent with the language and writing instruction. No project history or attachment content is loaded automatically. Optional import assistance with Mistral AI: suggesting how a retainer tracking sheet imported by the Customer maps to Tolus, confirmed by the Customer before any import.
- Categories of data subjects: agency members and end clients invited by the agency.
- Categories of data: identity and contact details (email, name), submitted content (tickets, comments, attachments, internal notes), logged time, sign-in data.
- Sensitive data: the service is not designed to receive data covered by GDPR article 9; the Customer undertakes not to submit any.
- Duration of processing: duration of the subscription, then retention of the data for 90 days after termination before permanent deletion.
4. Controller’s instructions
Obligation to process only on documented instructions.
- Initial instructions consist of the terms of service, this agreement and the Customer’s use of the service features.
- Using this assistance does not grant permission to use tickets, drafts or responses to train a model. Permission concerning the public website does not extend to private content.
- Additional instructions: in writing, by email to hello@tolus.app.
- The processor informs the Customer if an instruction appears to infringe the GDPR or applicable law.
- Processing required by Union or Member State law: prior information to the Customer unless prohibited by law.
5. Staff confidentiality
Commitment of authorized persons.
- Access limited to persons with a need to know; contractual confidentiality commitment for anyone working on the service.
- Authorized persons are informed of the confidentiality and security rules that apply to the service.
6. Subprocessors
Authorization regime and list (annex A).
- General authorization: the Customer authorizes the use of subprocessors. Any addition or replacement is announced by email to the owner at least 30 days in advance; the Customer may object within the same period and terminate their subscription without penalty in case of disagreement.
- List (annex A): Contabo GmbH (hosting, Germany), Stripe (payments, Stripe Payments Europe Ltd, Ireland), Resend (transactional email), Sentry (error monitoring, only if the tool is enabled on the service), Mistral AI (France, optional writing and import assistance).
- Publishing this list does not replace the email notice promised to existing Customers.
- Third-party tools and agents the Customer connects to the service itself are not subprocessors of the provider: they are chosen and governed by the Customer. Connecting such a tool is a documented instruction from the Customer to transmit to it the data the issued access covers.
- The inference region does not guarantee that Mistral AI retains no data. Retention of requests and responses depends on the terms and settings of the API service used, including its abuse-prevention controls. Tolus does not promise immediate deletion or zero data retention.
- The processor imposes equivalent obligations on its subprocessors and remains liable to the Customer for their performance.
7. Security measures
Technical and organizational measures (annex B), GDPR article 32.
- Encryption of data in transit (HTTPS). The database and its backups are not encrypted at rest: they sit on a server whose access is restricted to authorized persons.
- Authentication by password or through single-use, time-limited links; rate limiting on link sends and invitations.
- Logical isolation of data per organization, role-based access control (owner, admin, member, client).
- Access and error logging, kept for 12 months.
- Backups: one daily database snapshot is kept for 30 days on the service’s persistent volume. The off-server copy and a formalized restore test are not active yet.
- Vulnerability and update management: security updates applied to the system and to the dependencies, with no contractual schedule.
- Organizational measures: access rights limited to the people working on the service and reviewed at every change. No certification and no external audit is claimed.
8. Personal data breach notification
GDPR article 33, processor side.
- Notification to the Customer without undue delay and at the latest 72 hours after becoming aware of it, by email to the account owner.
- Content: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, point of contact.
- Documentation of the breach and cooperation with the Customer for notifications to the authority and to data subjects.
9. Assistance to the controller
Help with data subject rights and the Customer’s obligations.
- Data subject rights: requests received directly are forwarded to the Customer without undue delay; assistance goes first through the service features (export, deletion), supplemented within reasonable limits and chargeable beyond that.
- Impact assessments and prior consultation of the authority: provision of available information, within reasonable limits and chargeable beyond that.
- Security: reasonable cooperation to allow the Customer to comply with article 32.
10. Audits and documentation
Demonstrating compliance.
- Provision of the information necessary to demonstrate compliance with article 28: description of the technical and organizational measures set out in this agreement and written answers to the Customer’s questions.
- Audits: 1 audit per year at most, on 30 days’ notice, on written documentation and at the Customer’s expense.
11. International transfers
Location and safeguards.
- Hosting location: Germany (European Union), with Contabo GmbH.
- Resend may process data outside the European Union; those transfers are governed by the European Commission standard contractual clauses. Writing assistance uses Mistral AI’s European endpoint (api.eu.mistral.ai), with inference in the European Union or EFTA. This choice does not guarantee the location of the provider’s account data, billing data or other technical metadata. Any Mistral AI transfers outside countries recognized as adequate are subject to the safeguards in its data processing agreement, including standard contractual clauses.
12. Deletion and return of data
End of processing, GDPR article 28.3(g).
- Return: full export of the organization’s data (JSON and CSV) in self-service, at the owner’s initiative, available for the 90 days following the end of the subscription.
- Deletion: automatic 90 days after termination, including in backups at the end of their rotation of 30 days.
- Deletion certificate: provided on the Customer’s written request.
- Residual retention required by law: billing data kept for 10 years under accounting obligations.
13. Term and termination
Aligned with the main contract.
- This agreement lasts as long as the processor processes data on behalf of the Customer.
- If the processor breaches its obligations, the Customer may terminate their subscription without penalty, after a formal notice by email left without effect for 15 days.
14. Governing law and jurisdiction
Dispute resolution.
- French law, the courts of Lyon, consistent with the terms of service.
15. Annexes
The annexes required by article 28 are part of the body of this agreement.
- Annex A, list of subprocessors: the Subprocessors section.
- Annex B, technical and organizational measures: the Security measures section.
- Annex C, description of the processing: the Description of the processing section.