Last updated: 04/04/25

This Data Processing Agreement (“DPA”) is part of the Terms of Use and Terms of Sale of the NEXTLEAD CRM platform, operated by CREACH AGENCY, a SAS (simplified joint-stock company) with a share capital of €2,500, registered under number 979 948 551 with the Paris Trade and Companies Register, headquartered at 60 rue François 1er, 75008 Paris, France.

1. Purpose

This agreement defines the terms under which CREACH AGENCY, as a data processor, processes personal data on behalf of the data controller (the user of the NEXTLEAD platform), in accordance with Article 28 of the GDPR.

2. Description of the Processing

Processing operations may include collection, hosting, structuring, consultation, and deletion of personal data entered by the user.

This includes, but is not limited to:

• Contact information (names, emails, phone numbers)
• Company data
• Communications or activity logs

3. Obligations of CREACH AGENCY (Processor)

CREACH AGENCY commits to:

• Process personal data solely on documented instructions from the data controller (user).
• Not use the data for its own purposes.
• Ensure confidentiality by all persons authorized to process the data.
• Implement appropriate technical and organizational security measures.
• Assist the data controller in responding to data subject requests (access, deletion, etc.).
• Notify the data controller of any data breach within 72 hours.
• Maintain a record of processing activities carried out on behalf of the controller.

4. Subprocessors

The data controller authorizes CREACH AGENCY to engage subprocessors for the purposes of hosting or providing technical services related to NEXTLEAD, including:

• Supabase (database hosting in Ireland – EEA)
• Vercel (backend hosting using Amazon Web Services – potentially outside the EEA)

CREACH AGENCY ensures that all subprocessors are GDPR-compliant and contractually bound to confidentiality and data protection obligations, including the use of Standard Contractual Clauses when applicable.

5. Duration

This agreement is valid for the entire duration of the user’s subscription to the NEXTLEAD platform. Upon termination of the contract, CREACH AGENCY agrees to delete or return all personal data, unless legal obligations require further retention.

6. Data Location and International Transfers

Data is primarily hosted in the European Economic Area (EEA), specifically in Ireland (Supabase).

However, certain technical operations (e.g., through Vercel) may involve data processing outside the EEA. In such cases, CREACH AGENCY ensures adequate safeguards are implemented, such as EU Standard Contractual Clauses (SCCs).

7. Liability and Responsibility

The user (data controller) remains responsible for the legality of the personal data processed through NEXTLEAD and for obtaining all necessary consents from data subjects.

CREACH AGENCY assumes responsibility for complying with its obligations as a processor under the GDPR.