Personal Data Processing Agreement

Last updated: Oct. 12, 2026

This agreement governs the processing of personal data carried out in connection with the use of Rapprocha, in accordance with Article 28 of the General Data Protection Regulation (GDPR).

1. Parties and purpose

This agreement is concluded between:

• The controller: the business customer who uses Rapprocha and determines the purposes and means of processing the personal data contained in the files they import.
• The processor: Hamza KAMAL, entrepreneur individuel, operator of Rapprocha.

Legal form

« Micro-entrepreneur (entrepreneur individuel) ».

Business address

14 RUE LOUIS BRAILLE, 31830 PLAISANCE-DU-TOUCH

Registration

SIREN 123 456 789

Email

rapprocha.support@gmail.com

The operator's full identity appears in the legal notice.

In providing the service, the processor processes certain personal data on behalf of the controller and in accordance with its documented instructions.

This agreement supplements the general terms applicable to the service. It applies where the use of Rapprocha involves the processing of personal data on behalf of the customer.

2. Subject matter, duration, nature and purpose of the processing

The purpose of the processing is to enable the customer to match their bank transactions and invoices using Rapprocha.

The processing operations may include:

• The receipt and import of the files submitted by the customer.
• The reading and analysis of the data contained in these files.
• The matching of transactions and invoices.
• The detection of transactions requiring verification.
• The generation and export of results, in particular in CSV and PDF format.
• The storage of the data needed for the service to operate.
• The deletion of data in accordance with the applicable retention rules.

The processing is carried out for the duration of use of the service, subject to applicable legal obligations and the technical periods needed to delete the data.

3. Categories of data and data subjects

The data that may be processed includes in particular:

• The dates and amounts of transactions.
• The labels and references of bank transactions.
• Any names and contact details present in the files.
• The names of customers, suppliers and other counterparties.
• Invoice references and numbers.
• The information needed to identify payments and the corresponding invoices.

The data subjects may include customers, suppliers, employees, representatives and other individuals whose data appears in the imported files.

The customer undertakes to submit only the data necessary to use the service and to have an appropriate legal basis for processing it.

It is also for the customer to inform data subjects where the regulations require it.

4. Processor's obligations

The processor undertakes to:

1. Process personal data only on the documented instructions of the controller, unless required to do otherwise by law.
2. Ensure that persons authorised to access the data are bound by an appropriate obligation of confidentiality.
3. Implement appropriate technical and organisational measures to protect the data against loss, unauthorised access, disclosure or alteration.
4. Assist the controller, as far as possible, in responding to requests to exercise data subjects' rights.
5. Provide reasonable assistance to the controller with its obligations relating to security, personal data breaches and impact assessments, where necessary.
6. Inform the controller of any personal data breach as soon as possible after becoming aware of it.
7. Make available the information necessary to demonstrate compliance with its obligations and allow for the audits provided for by Article 28 of the GDPR.
8. Not transfer the data to a country outside the European Economic Area without complying with the conditions laid down by applicable regulations.

Security measures implemented to date:

• Encryption of exchanges: the service is accessed exclusively over HTTPS (automatic redirection, HSTS) and session cookies are restricted to secure connections.
• Segregation: each reconciliation is accessible only to the account that created it, checked on every request.
• Authentication: it is delegated to Google; Rapprocha does not store any customer passwords.
• Hosting: the application and its PostgreSQL database are hosted by Render in Frankfurt (European Union); the database is accessed through the host's private network. Encryption at rest is provided by the hosting providers under their own terms.
• Backups: daily copies of the database in private object storage (Cloudflare R2), accessible with a dedicated key and kept for 30 days at most.
• Control of imported files: checks on format, size and number of rows, and neutralisation of formulas in CSV exports.
• No third-party artificial intelligence: files are not sent to any AI service and are not used to train any model.
• Restricted access: the operator's access to data is limited to administering and supporting the service, and matching decisions are logged.

These measures are supplemented by those described in the privacy policy. As no system is infallible, the processor does not guarantee the complete absence of incidents, but undertakes to handle them in accordance with this agreement.

5. Sub-processors

The processor may use external providers to deliver the service, in particular for hosting and data storage.

Providers processing the data of imported files:

• Render Services, Inc. — hosting of the application and the database (Frankfurt data center, European Union).
• Cloudflare, Inc. — private object storage (Cloudflare R2): daily database backups and, where this storage is enabled for files, imported files.

Stripe (subscription payments) and Google (authentication) process account and billing data as separate controllers; they do not receive the content of imported files. To date, no email-sending, audience-analytics or advertising service is used.

The up-to-date list of providers, their role and the location of the data is set out in the privacy policy.

The use of these providers is governed in accordance with Article 28 of the GDPR. The processor ensures that they are subject to data protection obligations at least equivalent to those incumbent on it for the operations concerned.

In the event of a planned addition or replacement of a sub-processor, the controller is informed under the conditions laid down by the GDPR and may raise a reasoned objection in the manner communicated.

6. Retention and deletion of data

The customer can delete their data themselves at any time using Rapprocha's features:

• Deleting a reconciliation: in one click. The imported files, transactions, invoices, results and reports attached to it are erased immediately from the application. This cannot be undone.
• Deleting the account: from the security settings. All reconciliations and their files, as well as the account data, are erased immediately. Billing data is kept for the applicable legal periods.
• The correspondences between bank labels and supplier names that the service remembers for later reconciliations are attached to the account; they are not deleted with a reconciliation but are deleted with the account.
• The customer can export their data at any time from the security settings.

Backups: deleted data may remain in the daily database backups for up to 30 days at most, after which it is permanently erased. These backups do not contain the imported CSV files, only the data recorded in the database. The database host may keep its own backups for a limited period set by its policy.

At the end of the contractual relationship, the processor deletes or returns the personal data processed on behalf of the customer, as agreed, unless retention is required by a legal obligation.

The processor does not retain data beyond what is necessary for the intended purposes, subject to applicable legal obligations.

7. Customer's responsibilities

The customer remains responsible for:

• The lawfulness of the collection and import of the data.
• Informing data subjects where required.
• Determining the purposes and the legal basis of the processing.
• The accuracy of the files submitted and the limitation of data to what is strictly necessary.
• Managing access to their account and keeping their credentials confidential.

The customer undertakes not to import data that is not necessary for matching transactions and invoices.

8. Contact and requests

For any question about this agreement or the protection of personal data, the customer can contact the operator of Rapprocha:

Email : rapprocha.support@gmail.com

They can also use the Contact page.

Business address : 14 RUE LOUIS BRAILLE, 31830 PLAISANCE-DU-TOUCH

9. Entry into force

This agreement applies for the entire duration of the processing of personal data carried out on behalf of the customer.

It supplements the general terms of use and sale of Rapprocha and must be interpreted in accordance with the GDPR and applicable law.