Data Processing Agreement

Last updated: 6 November 2026. The French version prevails in case of discrepancy.

1. Purpose and precedence

1.1. This Data Processing Agreement ("DPA") applies where Pantograph SAS ("Katalyz") processes personal data on behalf of a Customer in providing the Katalyz platform, under the Platform Terms or a Subscription Agreement.

1.2. Where the Customer has signed a Subscription Agreement containing its own data processing annex, that annex prevails over this DPA.

1.3. Terms such as "controller", "processor", "personal data", "processing", "data subject", "sub-processor" and "personal data breach" have the meaning given in Regulation (EU) 2016/679 ("GDPR").

2. Roles

For personal data contained in Content, the Customer is the controller and Katalyz is the processor. Each party complies with the GDPR and the French Data Protection Act No. 78-17 of 6 January 1978 as amended.

3. Description of the processing

4. Customer obligations

The Customer ensures that the personal data it enters in the Platform is collected and transmitted lawfully, that data subjects are informed, and that its instructions to Katalyz comply with the GDPR. The Platform Terms or Subscription Agreement and the Customer's use of the Platform's settings constitute its documented instructions.

5. Katalyz obligations

Katalyz:

• processes personal data only on the Customer's documented instructions, and informs the Customer without undue delay if it considers an instruction to infringe the GDPR;
• restricts access to personal data to staff bound by confidentiality who need it;
• implements appropriate technical and organizational security measures, summarized in the Privacy Policy and detailed in Katalyz's Security Assurance Plan, available to Customers on request;
• assists the Customer, as far as possible, in answering data subject requests and, where legally required, in carrying out data protection impact assessments;
• at the end of the service and at the Customer's choice, deletes or returns the personal data, unless retention is required by law.

6. Sub-processors

6.1. The Customer gives Katalyz general authorization to use the sub-processors listed at katalyz.co/subprocessors.

6.2. Katalyz informs the Customer of any new sub-processor before it processes the Customer's personal data. The Customer may object within 10 calendar days of the notification, with an objective written justification relating to the sub-processor's ability to comply with the GDPR. If the parties cannot resolve the objection, the Customer may terminate the affected service.

6.3. Katalyz imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable to the Customer for their performance.

7. Transfers outside the EEA

The Customer authorizes transfers of personal data outside the European Economic Area where they are covered by appropriate safeguards under Chapter V of the GDPR, such as an adequacy decision, the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. Personal data breaches

Katalyz notifies the Customer in writing without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information available to allow the Customer to meet its own notification obligations. Further information is provided as it becomes available.

9. Audits

Katalyz makes available to the Customer the information needed to demonstrate compliance with this DPA. The Customer may audit Katalyz, at its own expense, once per year, with one month's prior written notice, during business hours and without disrupting Katalyz's operations, and shares the audit report with Katalyz at no cost.

10. Contact

privacy@katalyz.co