Data processing agreement

This data processing agreement (hereinafter the "Agreement") is entered into between:

• the customer holding a MUVIA account, operator of tourist accommodation, acting as controller (hereinafter the "Customer");

• and Carl-Marie Miniconi, sole trader (EI) trading under the MUVIA brand, registered with the Ajaccio Trade and Companies Register (RCS) under number 980 224 471, whose address is Piscia Rossa, San Giovanni, 20167 Appietto, France, and who can be reached at contact@muvia-solutions.fr, acting as processor (hereinafter "MUVIA").

The Customer and MUVIA are hereinafter together referred to as the "Parties".

Under MUVIA's general terms of sale (hereinafter the "Terms of Sale"), MUVIA provides the Customer with a conversational assistant that can be embedded on its website and a digital welcome book that its guests can view. To do so, MUVIA processes, on behalf of the Customer, personal data relating to the people who use these tools.

The purpose of the Agreement is to set out the conditions under which MUVIA carries out this processing, in accordance with Article 28 of Regulation (EU) 2016/679 of 27 April 2016 (hereinafter the "GDPR"). It is annexed to the Terms of Sale and forms an integral part of them. It is accepted by the Customer at the same time as the Terms of Sale, when creating its account.

The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given to them by Article 4 of the GDPR. For the purposes of the Agreement, the following terms also mean:

• "Data": the personal data processed by MUVIA on behalf of the Customer in connection with the Services, described in Annex 1;

• "Services": the conversational assistant, the digital welcome book and the associated features provided by MUVIA under the Terms of Sale;

• "Guests": the current or future customers of the Customer who view its welcome book or interact with its conversational assistant;

• "Customer Area": the administration interface available to the Customer at app.muvia-solutions.fr;

• "Sub-processor": any provider engaged by MUVIA to carry out specific processing activities on the Data;

• "Applicable Regulations": the GDPR, French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and any text supplementing or replacing them.

The Agreement applies only to the processing that MUVIA carries out on behalf of the Customer, whose nature, purpose, categories of Data and data subjects and retention periods are described in Annex 1.

It does not apply to the processing that MUVIA carries out on its own behalf, as controller, in particular the management of the account of the Customer and the members of its team, invoicing, support and marketing. This processing is described in MUVIA's privacy policy.

The Agreement takes effect on the date the Customer accepts the Terms of Sale. It remains in force for as long as MUVIA processes Data on behalf of the Customer, including after the end of the subscription, until such Data is deleted under the conditions of Article 13.

As controller, the Customer determines the purposes and essential means of the processing. In this respect, it undertakes to:

• have a legal basis for each processing operation entrusted to MUVIA;

• inform Guests in accordance with Articles 13 and 14 of the GDPR. MUVIA provides, under each data collection form of the assistant and the welcome book, an information notice and a link to an information page; the Customer remains responsible for their suitability for its own processing;

• only upload to the Services, in particular to the assistant's knowledge base, the welcome book or the sources it designates to pre-fill them (website, Booking.com listing, documents), content it is entitled to use, and refrain from introducing third-party personal data that is not necessary;

• not ask Guests, through the Services, for special categories of data within the meaning of Article 9 of the GDPR, nor for data relating to criminal convictions and offences;

• respond to Guests' requests to exercise their rights, with the assistance of MUVIA provided for in Article 10;

• keep the record of processing activities provided for in Article 30(1) of the GDPR;

• ensure that the members of its team to whom it gives access to the Customer Area are bound by confidentiality and only use the Data for the intended purposes.

MUVIA only processes the Data on documented instructions from the Customer. The Customer's complete instructions at the date of the Agreement are: the Terms of Sale, the Agreement and its annexes, and the settings and actions that the Customer or the members of its team perform in the Customer Area (in particular publishing an assistant or a welcome book, activating live conversations, deleting a conversation or the data associated with an email address, exporting data).

Any additional instruction is given in writing, including by email. MUVIA immediately informs the Customer if, in its opinion, an instruction infringes the Applicable Regulations (Article 28(3), second subparagraph, of the GDPR); it may then suspend its execution until the Customer confirms or amends it.

Where MUVIA is required to carry out processing under European Union or French law, it informs the Customer before the processing, unless that law prohibits such information on important grounds of public interest (Article 28(3)(a) of the GDPR).

MUVIA undertakes not to use the Data for purposes other than performing the Services, in particular for its own commercial purposes or for training artificial intelligence models. It imposes the same prohibition on its Sub-processors.

MUVIA ensures that the persons authorised to process the Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b) of the GDPR), and that they only process the Data on its instructions.

MUVIA has an administration console allowing it to view and export the Customer's Data. It only uses it for the following purposes: support requested by the Customer, maintenance and security of the Services, carrying out an instruction from the Customer and compliance with a legal obligation. Access to this console is restricted to a single account designated in the software's code. Each viewing and each export of Data leaves a timestamped trace, kept for twelve months; any viewing that cannot be traced is refused by the software. MUVIA provides the Customer, on request, with the traces relating to its Data.

MUVIA implements the technical and organisational measures provided for in Article 32 of the GDPR, described in Annex 2, to ensure a level of security appropriate to the risk.

MUVIA may change these measures to take account of the state of the art, provided that the overall level of security is not reduced. Annex 2 is updated accordingly.

The Customer gives MUVIA a general authorisation to engage Sub-processors, within the meaning of Article 28(2) of the GDPR. The Sub-processors engaged by MUVIA at the date of the Agreement are listed in Annex 3, which the Customer declares that it accepts.

MUVIA informs the Customer of any addition or replacement of a Sub-processor at least thirty (30) days before it takes effect, by email sent to the account holder or by a message in the Customer Area. The information specifies the identity of the provider, the service concerned and the location of the Data.

The Customer may object to this change, during this period, in writing with reasons relating to the protection of the Data. The Parties then seek a solution in good faith. If no solution is found before the effective date of the change, the Customer may terminate its subscription, without charge or penalty, including during a commitment period; sums already paid for the period after termination are refunded pro rata.

Where the replacement of a Sub-processor is required by an emergency relating to the security or continuity of the Services, MUVIA informs the Customer as soon as possible, and at the latest at the time of the replacement; the Customer then has the same right to object and terminate, for thirty (30) days from this information.

MUVIA imposes on each Sub-processor, by contract, data protection obligations providing sufficient guarantees within the meaning of Article 28(4) of the GDPR. MUVIA remains fully liable to the Customer for the performance by its Sub-processors of their obligations.

MUVIA only transfers the Data to a country outside the European Economic Area in compliance with Chapter V of the GDPR, either on the basis of an adequacy decision of the European Commission, or subject to appropriate safeguards, such as the standard contractual clauses adopted by the European Commission. The transfers existing at the date of the Agreement and their basis are set out in Annex 3.

MUVIA provides the Customer, in the Customer Area, with features enabling it to respond to Guests' requests: viewing the conversation history, deleting a conversation, deleting all data associated with an email address and exporting the account data in a structured format.

Where a data subject sends MUVIA directly a request to exercise their rights relating to the Data, MUVIA forwards it to the Customer without delay, and at the latest within five (5) working days of receipt. MUVIA does not respond to it itself, unless instructed by the Customer.

MUVIA assists the Customer, through appropriate technical and organisational measures and insofar as possible, in fulfilling its obligation to respond to these requests (Article 28(3)(e) of the GDPR). This assistance is provided free of charge within the limits of reasonable use.

Taking into account the nature of the processing and the information available to it, MUVIA assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 of the GDPR: security of processing, notification and communication of data breaches, data protection impact assessment and prior consultation of the supervisory authority (Article 28(3)(f) of the GDPR). For this purpose, MUVIA provides it, on request, with the documentation it has on the processing and the security measures.

MUVIA notifies the Customer of any personal data breach affecting the Data within a maximum of forty-eight (48) hours of becoming aware of it, by email sent to the account holder.

The notification includes, insofar as this information is available, the elements provided for in Article 33(3) of the GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the contact details of the person from whom information can be obtained, the likely consequences of the breach and the measures taken or proposed to address it and mitigate its effects. Where it is not possible to provide all this information at the same time, it may be provided in phases.

It is the Customer's responsibility, as controller, to notify the breach to the French data protection authority (CNIL) and, where applicable, to communicate it to the data subjects. MUVIA only does so on behalf of the Customer on its instruction. MUVIA documents any breach, its effects and the measures taken.

The Customer may at any time, during and after its subscription, export its account data from the Customer Area and then delete the account. Deleting the account results in the immediate and permanent deletion of the Data in the Services.

At the end of the subscription, for whatever reason, the assistant stops answering and the welcome book can no longer be viewed. If the Customer does not delete the account, the Data remains available to the Customer in the Customer Area, read-only, so that it can export it and respond to data subjects' requests. It is deleted at the latest three (3) years after the end of the subscription. The end of the subscription in no way extends the retention periods set out in Annex 1, which continue to apply.

Deleted Data remains in backups until they expire, after seven (7) days for copies kept on the server and around thirty-one (31) days for encrypted copies kept off the server, without it being possible to extract it individually in the meantime.

The obligations in this article apply subject to any Data that MUVIA is required to retain under European Union or French law (Article 28(3)(g) of the GDPR). MUVIA confirms the deletion of the Data in writing at the Customer's request.

MUVIA makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and the Agreement, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by it (Article 28(3)(h) of the GDPR), under the following conditions:

• the audit is first conducted on the basis of documents: MUVIA responds in writing, within thirty (30) days, to the Customer's reasonable questions and provides it with the relevant documentation;

• if the document-based audit does not allow the Customer to verify compliance with these obligations, or following a data breach concerning it, or at the request of a supervisory authority, the Customer may have an on-site audit carried out, limited to one audit per year, except in the case of a data breach or a request from an authority, subject to thirty (30) days' written notice;

• the audit is carried out by the Customer or by an independent auditor who is not a competitor of MUVIA and who is bound by professional secrecy or a confidentiality undertaking; it takes place during working hours, without disrupting the operation of the Services or giving access to the data of MUVIA's other customers;

• the costs of the audit are borne by the Customer, unless it reveals a breach by MUVIA of its obligations, in which case they are borne by MUVIA. The audit report is provided to MUVIA.

As processor, MUVIA keeps the record of categories of processing activities provided for in Article 30(2) of the GDPR. It cooperates with the supervisory authority, at its request, in the performance of its tasks.

Each Party is liable for the breaches attributable to it under the Applicable Regulations and the Agreement. MUVIA's liability to the Customer under the Agreement is governed by Article 18 of the Terms of Sale, without prejudice to the rights that data subjects derive from Article 82 of the GDPR.

In the event of a conflict between the Agreement and the Terms of Sale on a matter relating to the protection of the Data, the Agreement prevails.

The Agreement may be amended under the same conditions as the Terms of Sale. Any new version is brought to the Customer's attention by email or in the Customer Area. Changes of Sub-processors follow the rules of Article 8.

The Agreement is governed by French law. Any dispute relating to its formation, interpretation or performance is settled under the conditions of Article 26 of the Terms of Sale.

1. Data subjects

• the Guests who view the Customer's welcome book or interact with its conversational assistant, including when it is embedded on the Customer's website;

• the people who have published a review on the Customer's Booking.com listing, where the Customer has this listing read to pre-fill its knowledge base or welcome book;

• any person mentioned in the sources the Customer designates for this pre-filling (website, documents), for example a staff member named on the website.

2. Nature, purposes and periods

3. Sensitive data

The Services do not request any special category of data within the meaning of Article 9 of the GDPR. As the content of messages and attachments is freely written or chosen by Guests, such data may nevertheless appear in them without MUVIA being able to detect or prevent it. It is then processed like the rest of the conversation and deleted within the same periods.

4. Deletion

A daily automatic purge deletes the Data at the end of the periods above. Deleted Data remains in backups under the conditions of Article 13.

1. Access control and separation

• Account creation subject to confirmation of the email address; passwords stored in hashed form by the authentication service and never by the application.

• Personal team invitations: an invitation can only be accepted by an account using the invited address, which the server checks.

• Rights that differ according to role: editing content and deleting conversations reserved to the account holder and managers; billing and role management reserved to the account holder; a member with the agent role only has access to conversations, their history and unanswered questions.

• Separation of each customer's data checked by the server on every request. An automated test bench replays, against a real server, cross-account access attempts; the expected result is that none succeeds.

• MUVIA's access to the Data governed by the conditions of Article 6: single account designated in the code, logging of each viewing and each export, refusal of any viewing that cannot be traced.

2. Hosting and encryption

• Hosting of the application, the database and the files on a dedicated server located in France (Paris).

• Encryption of exchanges between browsers and the server, and between the application and the database interface (HTTPS).

• Database not exposed to the Internet: only the authentication and data interfaces, protected by key, are published; the database and its administration tool are only accessible from the server, via an encrypted SSH connection.

• The Data is not encrypted at rest at server level. Only the backup copies kept off the server are encrypted.

3. Backups and continuity

• Full database backup every night, verified, kept for 7 days on the server.

• Copy of this backup, encrypted on the server before sending with a key the storage provider does not hold, kept for around 31 days in the European Union, with no possibility of deletion during the first 30 days.

• Daily snapshot of the whole server at the host; email alert if a backup fails; actual restoration from the encrypted copy verified on 20 October 2026. The maximum data loss if the server is destroyed is one day.

4. Files

• Uploaded files scanned by an antivirus and checked by their binary signature before being made available; documents used for pre-filling deleted after their text is extracted.

• Conversation attachments stored outside any public directory. They are accessible without authentication, through a link combining the conversation identifier and the random file name, two unpredictable values, so that the Guest, who has no account, can retrieve what they sent. Anyone with the full link can obtain the file. The file is always downloaded, never displayed in the browser, and is not cached.

5. Minimisation and logging

• Guests' IP addresses never stored in the database; limit on the number of requests per IP address.

• Full content of a conversation sent to the Customer's browser only when it is opened; lists only show a summary calculated by the server.

• Daily automatic purge of the Data at the end of the periods in Annex 1; email sending log limited to 90 days.

The Guest's browser also loads, from third-party services: as soon as a welcome book opens, the flags of the language menu (flagcdn.com, served by Cloudflare, Inc., United States); when displayed, the map of the surroundings (OpenStreetMap) and the local weather (Open-Meteo); if the Customer has kept the sample images, photographs (Unsplash, served by Imgix, Inc., United States). These services receive the Guest's IP address on this occasion. When the Guest chooses another language, Google Translate sets a session cookie in their browser remembering this choice.