Processing agreement (art. 30)

The customer is the controller. Cognita GRC, Inc. acts as processor within the meaning of article 16 and acts only on the customer’s documented instructions.

Subject matter: provision of the Conformia platform and the associated services subscribed to.

Duration: the term of the subscription, extended by the reversibility period.

Nature and purpose: hosting, structuring and retention of registers, formality files, consent proofs, data-subject requests, assessments and the evidence log.

Categories of people: the controller’s customers, prospects, employees, users and partners.

Process data only on the customer’s instructions, and inform them if an instruction appears unlawful.

Ensure that persons authorised to process the data are bound by confidentiality.

Implement the article 27 security measures: encryption in transit and at rest, individual access control, access logging, tested backups, reversibility.

Notify the customer of any data breach without delay after becoming aware of it, with the elements needed for the article 22 notification.

Assist the customer with impact assessments, data-subject requests and exchanges with the Authority.

The customer authorises the sub-processors listed in the privacy policy. Any addition is notified with reasonable notice, allowing the customer to object.

The processor remains fully liable for its sub-processors’ performance.

The chosen hosting region is stated in the contract. Any transfer outside Cameroon is subject to the article 32 safeguards: authorization, standard clauses and a transfer impact assessment, provided to the customer.

At the end of the contract the customer obtains, on request, a full export of their data in an open format, together with the evidence log and its verification script. The data is then deleted, backups included, within the agreed periods.

The customer may verify compliance with this agreement once a year, at their own cost, on reasonable notice, without compromising other customers’ security. For the public sector, an ANTIC audit right may be stipulated.