Data Processing Agreement

Version: v1.0
Last updated: 1 August 2026

Preamble

In the course of using the neuronxcrm SaaS service published by Kraken Labs, the Customer collects and processes personal data in its tenant workspace (CRM records, files, connected mailbox content, and related configurations). For those processing activities, the Customer acts as Controller within the meaning of Regulation (EU) 2016/679 (GDPR), and Kraken Labs acts as Processor.

This Data Processing Agreement (the “Agreement”) defines the conditions under which Kraken Labs processes such data on behalf of the Customer. It is annexed to the main contract or applicable Terms of Sale for neuronxcrm.

Article 1. Definitions

Terms used in this Agreement (Personal Data, Processing, Data Subject, Controller, Processor, Personal Data Breach, etc.) have the meaning given by the GDPR.

Article 2. Subject and scope

This Agreement governs Personal Data Processing that Kraken Labs performs on behalf of the Customer in providing neuronxcrm. Details of processing, purposes, data categories, and subprocessors are described in the Annexes and related documentation (Privacy Policy, Subprocessors, Retention).

Article 3. Controller instructions

Kraken Labs undertakes to process Personal Data only on documented instructions from the Customer, unless required to do so by Union or French law. Kraken Labs informs the Customer if, in its opinion, an instruction infringes applicable data-protection law.

Article 4. General obligations of Kraken Labs

Kraken Labs undertakes to:

• process Personal Data only for the purposes provided in the Contract;
• ensure confidentiality of Personal Data;
• implement appropriate security measures;
• assist the Customer in handling data-subject requests;
• notify the Customer of any Personal Data Breach;
• make available information necessary to demonstrate compliance.

Article 5. Security of data

Kraken Labs implements appropriate technical and organisational measures, including access control, multi-tenant isolation (including database row-level security), TLS encryption in transit, encrypted backups, and a documented incident-management procedure. In case of breach affecting processing for the Customer, Kraken Labs notifies the Customer without undue delay and at the latest within twenty-four (24) hours of becoming aware.

Article 6. Sub-processing

Kraken Labs is authorised to engage subsequent subprocessors that present sufficient guarantees. The list of main providers is kept up to date in contractual documentation (Subprocessors page). Significant changes are communicated to the Customer.

Article 7. Assistance and cooperation

Kraken Labs assists the Customer with compliance obligations, including data-subject rights, DPIAs where relevant, and notifications to supervisory authorities.

Article 8. Notification of Personal Data Breaches

Any breach affecting processing performed on behalf of the Customer is notified without undue delay and at the latest within twenty-four (24) hours, with available information. It is for the Customer to assess whether notification to the supervisory authority and data subjects is required.

Article 9. Retention, return, and deletion

Retention periods are described in the Privacy Policy and Retention documentation. At contract end, Kraken Labs returns data in usable formats supported by the product, then deletes remaining Personal Data from production systems within a maximum of thirty (30) days, subject to legal obligations and normal backup overwrite cycles. Disconnecting a Gmail integration cascades deletion of that connection’s synced mailbox data.

Article 10. Audit rights

Kraken Labs makes available information necessary to demonstrate compliance. The Customer may exercise a reasonable audit right (30 days’ notice, once per year, except urgency or serious incident), at the Customer’s expense unless a material breach is established.

Article 11. Transfers outside the European Union

Core platform Personal Data are hosted in the European Union. Any transfer outside the EU occurs only with the Customer’s prior written agreement and appropriate safeguards (Standard Contractual Clauses or equivalent), except where the Customer instructs optional integrations (for example Google services) whose locations are governed by those providers’ terms.

Article 12. Confidentiality

Each Party undertakes to keep strictly confidential information (Personal Data, trade secrets, technical elements) received in performing this Agreement. This obligation survives for five (5) years after the end of the contractual relationship.

Article 13. Liability between the Parties

Each Party remains responsible for its legal obligations. Kraken Labs’ liability is limited to direct and certain damages, capped at the amount paid by the Customer over the twelve (12) months preceding the triggering event. Indirect damages are excluded. Exceptions to caps concern fraud, wilful misconduct, or processing deliberately outside instructions.

Article 14. Duration

This Agreement enters into force on the effective date of the main Contract and remains applicable until complete return or deletion of the Personal Data.

---

Annexes (incorporated by reference to published documentation): 1. Description of processing; 2. Subprocessors; 3. Security measures; 4. Audit modalities.