Data processing agreement

1. Parties

The organization created on Prestaday is the controller of its clients' data. Prestaday is the processor for that data. User account data (name, email, password, subscription billing) is not covered here: Prestaday is the controller for it, as described in the privacy policy.

2. Purpose

Prestaday hosts and processes, on the organization's behalf, the data its users enter to run their jobs: contact details, quotes, contracts, signatures, schedules, invoices, messages, and files.

3. Instructions

The organization authorizes the processing needed to provide the service, keep it secure, and answer support it requested. Prestaday does not process this data for its own purposes, does not sell it, and does not use it for prospecting.

4. Subprocessors

The service relies on the providers below. The organization is informed by the publication of this page.

Prestataire	Rôle	Localisation
Resend	Envoi des e-mails transactionnels	UE
Stripe	Paiements en ligne des clients de l'organisation	USA
Cloudflare Turnstile	Protection anti-spam du formulaire d'inscription	UE
Cloudflare R2	Stockage des fichiers des clients	UE
Open map	Affichage des cartes	UE
Google / Microsoft	Synchronisation agenda et contacts — uniquement si l'organisation connecte son compte	UE / USA
Oracle Cloud Infrastructure	Hébergement de l'application	Oracle Cloud Infrastructure, 10000 Oracle Parkway, Redwood Shores, CA 94065, USA

5. Security and confidentiality

Prestaday takes appropriate measures to prevent unauthorized access, loss, or alteration. People who can access the data are bound by confidentiality.

6. Data-subject rights

When an organization's client exercises a right, the organization answers. Prestaday helps the organization, within the product, export or delete the organization's data.

7. End of processing

When the organization is deleted, the data is erased, subject to retention the law requires (issued invoices, signature evidence). What deletion keeps is shown before you confirm.

8. Acceptance

Acceptance is recorded for the organization, by its owner, with the date and the version of this document. A new version that requires it is shown to the owner before processing continues.

Personal data is deleted within 30 days after the end of the organization, subject to the period made available for export and to data that must be retained by law. Invoices and accounting records are retained for 10 years; signature and acceptance evidence is retained for the applicable limitation period. Any transfer outside the European Economic Area is covered by an adequacy decision, appropriate safeguards or another lawful mechanism under Chapter V of the GDPR. The processor provides information reasonably necessary to demonstrate compliance and makes available relevant documentation; audits are limited to what is necessary, proportionate and does not compromise the security or confidentiality of other customers.