Data Processing Agreement (DPA)
RESEARCH NOTES — NOT LEGAL ADVICE — REVIEW WITH A LICENSED ATTORNEY BEFORE SIGNING
The Processor
Renaud Patris, sole trader (natural person) trading as Red Panda Studio, registered with the Belgian Crossroads Bank for Enterprises under number 1043.832.341 (VAT BE 1043.832.341 — establishment unit 2.395.215.357), Rue Entre-Deux-Portes 108, 4500 Huy, Belgium. Contact: privacy@ordavena.app.
The Controller
[Customer company name] — [company registration number] — [address] — [country]. DPA contact: [DPO or legal representative email address].
Together the "Parties".
Preamble
The Processor provides the Controller with the Ordavena service (online management tool: quotes, invoices, payments, reminders, AI assistant) under the Terms of Use. In doing so, the Processor processes personal data on behalf of the Controller within the meaning of Article 4(8) of Regulation (EU) 2016/679 (GDPR). This agreement (the "DPA") governs that processing in accordance with Article 28 GDPR. In the event of conflict with the Terms of Use, this DPA prevails for all matters relating to the processing of personal data.
1. Subject-matter and duration
The Processor processes the personal data described below on behalf of and under the instruction of the Controller, for the purpose of providing the Ordavena service. This DPA takes effect on the date of subscription to the Terms of Use and remains in force for as long as the Processor processes personal data on behalf of the Controller. It terminates automatically upon the expiry or termination of the service contract.
2. Nature, purpose and type of processing
Nature: collection, storage, structuring, consultation, modification, export and deletion of data in the context of providing the Ordavena service. Purposes: (a) creation and management of quotes, invoices and credit notes on behalf of the customer; (b) payment tracking and sending reminders to the customer's contacts; (c) drafting and analysis assistance by AI; (d) maintenance of the activity log and provision of accounting exports. The Processor does not process data for any other purpose without prior instruction from the Controller.
3. Categories of data and data subjects
Categories of data processed: identification data (name, trading name, VAT number), contact data (postal address, email, phone), financial data (amounts, payment terms, payment statuses), documentary data (quotes, invoices, credit notes in PDF format), communication data (content of reminder emails), excerpts of data transmitted to the AI provider for drafting and analysis. No special categories of data (Art. 9 GDPR) are processed. Data subjects: the Controller's customers, prospects and business contacts, and their legal representatives.
4. Processing only on documented instructions (Art. 28(3)(a))
The Processor processes personal data only on documented instructions from the Controller. The Terms of Use and this DPA constitute the initial instructions; any further instruction is provided in writing (email or configuration interface). If a legal obligation under Union or Belgian law requires the Processor to carry out processing not covered by those instructions, the Processor informs the Controller beforehand, unless the law prohibits such notification.
5. Personnel confidentiality (Art. 28(3)(b))
The Processor ensures that persons authorised to process personal data (staff, contractors) are bound by an appropriate confidentiality obligation, whether contractual or statutory, which survives the end of their engagement.
6. Security measures (Art. 28(3)(c) and Art. 32 GDPR)
The Processor implements appropriate technical and organisational measures to achieve a level of security appropriate to the risk: per-company data isolation at database level (row-level security); encryption of data in transit (TLS); role-based access control and available multi-factor authentication; logging of every access — including support interventions — visible in the Controller's activity log; encrypted backups every six hours to a volume separate from the database, kept for 35 days, with a daily automated restore test; a documented security incident management procedure. On request, the Processor provides an up-to-date description of its security measures.
7. Sub-processors (Art. 28(2), (3)(d) and (4))
General authorisation: the Controller grants the Processor a general authorisation to engage the sub-processors listed in Annex A. The Processor imposes on them obligations equivalent to those of this DPA and remains fully liable for their failures. Changes: the Processor notifies the Controller of any intended addition or replacement of a sub-processor with at least 30 days' advance notice, by email to the Ordavena account address. The Controller may object in writing with reasons within that period; if the Parties cannot agree, the Controller may terminate the contract without penalty.
8. Assistance with data subject rights (Art. 28(3)(e))
The Processor assists the Controller, as far as possible, in fulfilling the Controller's obligations to respond to data subject requests (access, rectification, erasure, portability, restriction, objection — Art. 15–22 GDPR). The interface export function (CSV, full archive) allows the Controller to respond directly to most requests. For specific assistance requests: privacy@ordavena.app, handled within a timeframe that allows the Controller to meet its own legal deadlines.
9. Assistance with GDPR Art. 32–36 obligations (Art. 28(3)(f))
The Processor assists the Controller in ensuring compliance with obligations relating to: security of processing (Art. 32); notification of personal data breaches (Art. 33–34); data protection impact assessments (Art. 35); prior consultation with the supervisory authority (Art. 36) — taking into account the nature of the processing and the information available to the Processor.
10. Return and deletion of data (Art. 28(3)(g))
Export at any time: the Controller may export all its data (CSV and full archive) from the Ordavena interface throughout the contract. Deletion: at the end of the contract, or at any time at the Controller’s request from the interface or by email, the Processor deletes the personal data after a 30-day grace period (during which the request can be cancelled and export remains available); the data disappears from backups at the latest 35 days later. Legal retention of the Controller’s accounting documents is the Controller’s responsibility and is met through the export; the Processor does not retain its data on that basis. On request, a written deletion certificate is provided within 15 days of deletion.
11. Audit and information (Art. 28(3)(h))
The Processor makes available to the Controller all information necessary to demonstrate compliance with this DPA, and cooperates with audits and inspections. Audit requests must be addressed to privacy@ordavena.app with at least 30 days' advance notice. In the first instance, the Processor responds to the audit by providing written documentation. Any physical audit is subject to confidentiality conditions protecting the data of other customers.
12. Personal data breach notification (Art. 33(2) GDPR)
The Processor notifies the Controller without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the Controller. The notification is sent to the Ordavena account email address and includes, to the extent possible: the nature of the breach and the approximate categories and number of individuals and records affected; the contact details of the Processor's point of contact; the likely consequences; the measures taken or proposed. The Processor assists the Controller in its own notification obligations to the supervisory authority and to data subjects.
13. International transfers (Art. 28(3) and Chapter V GDPR)
All data is hosted and processed within the European Union. Hosting, backups included, is provided by OVHcloud SAS (France). AI assistance is provided by Mistral AI SAS (Paris, France) through its European endpoint (api.eu.mistral.ai). The Processor makes no transfer outside the EEA. Any access from a third country by Mistral AI’s own sub-processors (security, content delivery network) is covered by Mistral AI’s DPA in accordance with Chapter V GDPR. Any other future transfer would be notified in accordance with Article 7.
14. Liability (Art. 82 GDPR)
Each Party is liable for damage caused by processing that does not comply with the GDPR and is attributable to it. The Processor is liable only if it has not complied with the GDPR obligations specifically applicable to processors, or if it has acted outside or contrary to the Controller's lawful instructions. The Processor's financial liability under this DPA is capped in accordance with the Terms of Use.
15. General provisions
Form: this DPA is in writing, including in electronic form (Art. 28(9) GDPR). Amendments: any amendment requires written agreement. The Processor may amend this DPA to comply with new legal obligations, with 30 days' notice. Governing law: Belgian law. Courts: courts of the judicial district of Liège (Belgium), without prejudice to the right of either Party to contact the competent supervisory authority. Processor's supervisory authority: Data Protection Authority (APD/GBA) — autoriteprotectiondonnees.be — 35 Rue de la Presse, B-1000 Brussels, Belgium.
Annex A — Authorised sub-processors
List of authorised sub-processors under Article 7 of this DPA. Any change triggers 30 days' advance notice under Article 7.
| Sous-traitant / Sub-processor | Rôle / Role | Localisation / Location | Garantie / Safeguard |
|---|---|---|---|
| OVHcloud SAS (RCS Lille Métropole 424 761 419)Sub-processor's DPA ↗ | Hosting (dedicated server), encrypted backups included | France (European Union) | Data in the EU — no transfer outside EEA |
| Mistral AI SAS (RCS Paris 952 418 325)Sub-processor's DPA ↗ | AI assistance (drafting, analysis of data excerpts) and receipt reading | European Union (endpoint api.eu.mistral.ai) | Processing in the EU; any access from outside the EEA by Mistral's own sub-processors (security, network) covered by Mistral's DPA (Chapter V GDPR) |
Up-to-date list available on request at privacy@ordavena.app.
Signatures
For the Processor — Renaud Patris (Red Panda Studio)
Capacity: sole trader, business owner
Date: _______________
Signature: _______________
For the Controller — [Company name]
Represented by: _______________
Title: _______________
Date: _______________
Signature: _______________
Version of 22 October 2026. This DPA is accepted together with the terms of use at subscription. To receive a signed copy: privacy@ordavena.app.