Data Processing Agreement (Article 28 GDPR): Nawame, Organization plan

Version 1.1 of 22 October 2026

Article 1: Parties and purpose

1.1. This agreement is entered into between:

• the customer organization of the Nawame Organization plan (Article 3 bis of the terms of sale), represented by the person who subscribes or administers it, hereinafter "the Customer", acting as controller;
• HTTP5000, a French SAS with a share capital of €15,024, registered with the Lyon Trade and Companies Register under number 431 903 376, whose registered office is at 3 rue Passet, 69007 Lyon, France, publisher of the Nawame service, hereinafter "the Publisher", acting as processor.

1.2. It sets out the conditions under which the Publisher processes, on behalf of the Customer, the personal data contained in the Customer's organization, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR").

1.3. Formation and precedence. This agreement forms an integral part of the Organization plan contract from the subscription or from the creation of the organization, without separate signature. In case of conflict regarding data protection, it prevails over the terms of service and the terms of sale. A Customer who wishes to receive a signed copy obtains one on request at info@nawame.eu.

Article 2: What is covered, and what is not

2.1. Covered: the Customer's organization. The content of its spaces, folders and working memories, the accounts of its members in their capacity as members (display name, login address, role, team membership), its invitations, its declared domains, its service identities and connection keys, and the organization's audit and read logs.

2.2. Not covered: each member's personal space. Each member has an account and a personal space of their own. The Publisher is the controller of these towards the member, under the privacy policy. The Customer has no access to them, and what a member stores in their personal space falls outside this agreement. A member who belongs to several organizations has a single account: each organization only sees what was stored within it.

2.3. Not covered: connected AIs. When a member connects a third-party AI (chat assistant, coding tool), the provider of that AI receives what the member has it read, on its own behalf or the Customer's, under the contract the member or the Customer has entered into with it. That provider is not a sub-processor of the Publisher (privacy policy, §7). The Publisher only executes the reads and writes authorized by the member's rights.

2.4. Not covered: billing. Subscription billing data is processed by the Publisher on its own behalf (accounting obligation), and by the payment provider under its own terms.

Article 3: Description of the processing

Article 4: Obligations of the Customer

4.1. The Customer documents its instructions through its use of the Service and its settings (roles, teams, restricted folders, domain policy, connection keys). These settings constitute instructions.

4.2. The Customer ensures a legal basis for the data it stores, informs data subjects, and carries out any data protection impact assessment incumbent on it (for example for employee data or data under Article 9 GDPR).

4.3. The Customer appoints at least one administrator and keeps its members informed of the organization's rules.

Article 5: Obligations of the Publisher

5.1. Instructions. The Publisher processes the data only on documented instructions from the Customer, including with regard to transfers outside the European Union, unless required by law; in that case it informs the Customer before processing, unless the law prohibits it. It informs the Customer if it considers that an instruction infringes the GDPR.

5.2. No other use. The Publisher does not use the Customer's content to train a model, for advertising, for profiling or for any purpose of its own. No data is sold.

5.3. Confidentiality of personnel. Only authorized persons bound by confidentiality, by contract or by law, have technical access to production data, and only to operate, maintain and secure the Service, or to respond to a lawful judicial request. Routine diagnostics use a limited technical role that reads no content, title, address or name. Any write in production goes through a traced operation, never a manual command.

5.4. Security. The Publisher implements the measures in Annex 1 and maintains them at an at least equivalent level throughout the term of the contract.

5.5. Visible operator access. When access is opened in a member's name (for example a diagnostic key they requested), it is visible to the member in their account and logged with its reason.

Article 6: Sub-processors

6.1. General authorization. The Customer authorizes the Publisher to use the sub-processors listed in Annex 2. The Publisher imposes on them by contract data protection obligations at least equivalent to those of this agreement, and remains liable to the Customer for their performance.

6.2. Changes. The Publisher informs the Customer's administrators by e-mail at least thirty days before adding or replacing a sub-processor that processes the organization's data. The Customer may object on reasonable data protection grounds, in writing, within that period. If no solution is found within that period, the Customer may terminate the subscription at no cost, the Publisher refunding the paid and unused portion.

6.3. A change imposed urgently for the security or continuity of the Service is notified without delay, with the same right to object and terminate.

Article 7: Location and transfers

7.1. The organization's data is hosted in the European Union (Germany; encrypted backup copy in the Netherlands). Hosting in the European Union does not, by itself, exclude every international transfer: a sub-processor established outside the Union, or subject to the law of a third country, may have remote access or be required to answer a request from a foreign authority. The Publisher never presents this location as automatically excluding every transfer.

7.2. Off-site backup copy. It is entrusted to Backblaze, Inc. (a US-law company), which stores archives already encrypted by the Publisher before upload, with a key it does not hold. Any resulting transfer is covered by the standard contractual clauses of its data processing agreement (module applicable according to the characterisation of each data item) and, additionally, by its declared participation in the EU-U.S. Data Privacy Framework (Annex 2). The Publisher documents these elements transparently to the Customer on request, including the provider's possible access and the supplementary measures.

7.3. The Publisher checks the contractual mechanisms and possible access of its sub-processors before engaging them and at each notable change (Article 6.2). Any other transfer outside the Union would be subject to the prior notice of Article 6.2 and covered by an adequacy decision or appropriate safeguards within the meaning of Article 46 GDPR.

Article 8: Assistance to the Customer

8.1. Data subject rights. The Service enables the Customer to handle most data subject requests itself: viewing, correction and export of memories according to the administrators' rights, removal of a member, audit log. Since a change does not destroy the previous version, the permanent deletion of content is carried out by the Publisher on the Customer's written instruction, within thirty days. If a person contacts the Publisher about the organization's data, the Publisher refers them to the Customer and informs the Customer without delay, without responding itself unless instructed.

8.2. Impact assessment and prior consultation. The Publisher provides the Customer, on request, with the information it holds for its impact assessment (description of measures, flows and sub-processors).

8.3. Cost. The assistance under this article is free of charge as long as it remains reasonable and requires no specific development.

Article 9: Personal data breach

9.1. The Publisher notifies the Customer of any personal data breach affecting the organization without undue delay after becoming aware of it, by e-mail to the administrators. Its operational objective is 24 hours after confirmation of the breach; it does not wait for that deadline if notification can happen sooner. This objective is not a guaranteed deadline and does not limit the legal obligation.

9.2. The notification describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Further information is provided progressively, without waiting to be complete.

9.3. It is for the Customer, as controller, to notify the supervisory authority and, where applicable, the data subjects. The Publisher assists it.

Article 10: End of the contract

10.1. Return. At any time, and in particular at the end of the contract, the Customer's administrators may export the organization's memories in an open, documented format (export from their account, covering what they can read in the organization's spaces). On written request, the Publisher provides within thirty days an export of all the organization's shared content. A member's private drafts remain private: each member exports them from their own account.

10.2. Deletion. On written request from the Customer, the Publisher deletes the organization's content from the active database within thirty days, then from the encrypted backups by rotation within the following thirty days. It confirms the deletion in writing.

10.3. Legal retention. Only items required by a legal obligation are kept, without content (billing data: 10 years; de-personalized audit log, for the periods set out in the privacy policy).

10.4. Without a deletion request, an organization that returns to the free plan remains accessible to its members: the end of the paid subscription deletes nothing by itself.

Article 11: Documentation and audit

11.1. The Publisher makes available to the Customer the information necessary to demonstrate compliance with this agreement: description of the security measures, list of sub-processors, and a written answer to a reasonable security questionnaire.

11.2. If that information is not sufficient, the Customer may have an audit carried out, by itself or by an independent auditor bound by confidentiality, at most once a year (except in case of a proven breach or at the request of an authority), with thirty days' notice, during business hours, without access to other customers' data or impairment of the Service's security. Audit costs are borne by the Customer.

Article 12: Liability, term and governing law

12.1. Each party is liable for its breaches of this agreement under Article 82 GDPR and the terms of sale. Data subjects' rights are not limited by this agreement. Between the parties, the Publisher's liability is capped according to the terms of sale, subject to mandatory provisions (in particular gross negligence or wilful misconduct, and liability that cannot lawfully be limited).

12.2. This agreement lasts as long as the contract, and its Articles 9 to 11 for as long as the Publisher holds data of the organization.

12.3. The Publisher may amend this agreement to follow the law or the Service; an amendment that reduces data protection only applies to the Customer after thirty days' notice, with the right to terminate under Article 6.2.

12.4. This agreement is governed by French law. Disputes fall within the competent French courts, after the prior complaint provided for in Article 12 of the terms of sale.

Annex 1: Technical and organizational measures

• Server-side access control: every read and write is checked by the server according to the member's role, teams and restricted folders; a connected AI inherits at most the member's rights, never more.
• Separation between organizations: no publication, merge or move crosses an organization's boundary, and a person only reads the organizations they are a member of.
• Connection keys that can be restricted to one organization or space, stored hashed, with expiry and revocation; people log in with a single-use, short-lived code sent by e-mail.
• Audit log of sensitive actions and read log of reads made by a connected AI (without content), available to administrators.
• Encryption in transit (TLS) and at rest (database volume and backups); daily encrypted backups, kept 30 days.
• Versioning: a change does not destroy the previous version; a mistake can be restored.
• Staff access: named authorization, limited diagnostic role without content, any production write through a traced and reviewed operation.
• Erasure: erasing an account removes its personal data and anonymizes its link to shared content.

Annex 2: Sub-processors (as of 22 October 2026)

Search representations (embeddings) are computed by a self-hosted service on the Publisher's infrastructure, without any third party. No language-model provider receives the organization's content from the Publisher. The providers used by the personal companion Nawa (privacy policy, §6) do not process the organization's data.

Annex 3: Contact

For any question, request for a signed copy, export, deletion, audit or objection: info@nawame.eu, stating the name of the organization.