Data processing agreement
Translation — the French text prevails. French version. Version in force of 18 October 2026.
Version of
1. Roles
The firm ("the controller") decides why and how it processes its clients' data. Fiplan ("the processor") processes it on the firm's behalf, solely to provide it with the software.
2. What is processed
| Item | Content |
|---|---|
| Subject matter | hosting and processing of the data the firm enters into Fiplan, to prepare and share financial plans |
| Operations | recording, calculation, display, production of documents, sharing in the client area, sending of notification e-mails, backup, deletion |
| Data subjects | the firm's clients (entrepreneurs, directors, partners and shareholders), their contacts and the users of the client area |
| Data | identity and contact details, company numbers, financial and tax data, directors' remuneration, messages and documents exchanged |
| Sensitive data | none expected: the firm does not enter data on health, opinions or other special categories (GDPR, Art. 9) |
| Location | European Union (Frankfurt); transfers only through the sub-processors of annex 1 |
| Duration | that of the subscription, plus the 30 days of export following its end |
3. Fiplan's commitments
- Processing the data only on the firm's documented instructions (this contract and its use of the software), including for a transfer outside the Union; informing it if an instruction appears to it to infringe the law.
- Never using this data for any other purpose: no advertising, no resale, no training of an artificial intelligence model.
- Ensuring confidentiality by every person authorised to access it; no access to the content of a file without the firm's authorisation (support access: read-only, 48 hours at most, logged). Fiplan respects the professional secrecy to which the firm is bound.
- Applying the security measures of annex 2 and keeping them up to date.
- Helping the firm answer the requests of data subjects (access, rectification, erasure, portability), in particular through the software's export and deletion features.
- Notifying the firm of any data breach concerning it without undue delay and at the latest 48 hours after becoming aware of it, with the information needed for the firm to inform the Authority within its 72 hours.
- Helping the firm, within reason, with its impact assessments and its consultations of the Authority.
- At the end of the contract, letting the firm export its data for 30 days, then deleting it, backups included by rotation, unless a legal retention obligation applies.
- Making available the information that demonstrates compliance with this agreement, and allowing an audit: first on documents; on site at most once a year, announced 30 days in advance, at the firm's expense, by an auditor bound to secrecy.
4. Sub-processors
The firm authorises the sub-processors of annex 1. Fiplan announces by e-mail any addition or replacement at least 30 days in advance; a firm that objects for a reasonable reason may terminate at no cost before the announced date. Fiplan imposes on each of them obligations equivalent to these and is answerable for them towards the firm.
5. The firm's commitments
It has a legal basis for each item of data it enters, informs its clients (including of the use of Fiplan) and enters only the necessary data.
6. Liability
Each party is liable for its own breaches of this agreement and of the GDPR, within the limits of the general terms and conditions (A13 and B4), except where the law prohibits them.
Annex 1 — Sub-processors
| Sub-processor | What it does with the firm's data | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | stores and processes all the data (database, files, authentication) | European Union (Frankfurt) | not applicable |
| Cloudflare | routes the pages and exchanges (encrypted); does not store the files | worldwide network | EU–US framework (certified provider); standard contractual clauses as a fallback |
| Resend | sends the client area e-mails (name, e-mail address, subject) | United States | EU–US framework (certified provider); standard contractual clauses as a fallback |
Annex 2 — Security measures
| Area | Measure |
|---|---|
| Encryption | HTTPS (TLS) everywhere; data encrypted at rest by the host (AES-256), itself certified SOC 2 Type 2 and ISO 27001 |
| Segregation | each firm sees only its own data, a rule enforced by the database itself (row-level security), checked by automatic audits at each version |
| Authentication | hashed passwords and strength rules; two-factor authentication offered to everyone, mandatory for Fiplan administration, also enforced server-side |
| Fiplan access | the administrator sees only counters, never the content; support access on the firm's authorisation, 48 h, read-only, logged |
| Backups | daily database backups by the host, kept for 7 days (uploaded files, such as logos and PDFs, are not included); restoration tested before opening |
| Development | automatic tests and rights audits before each release; no real data in test environments |
| Incidents | notification procedure (point 3.6); technical logs kept for the investigation |