Processing of corporate data

This page presents the clauses proposed for the processing carried out by Brunel on behalf of a professional client. It does not constitute proof that an individualized agreement is signed. It becomes a contractual annex when it is expressly incorporated into a contract accepted by the parties, with identification of the client and description of the processing.

The client determines the essential purposes and means of the processing; the publisher of Brunel, identified in the legal notices, acts as a processor for the agreed operations only. Processing specific to billing, account management, and security are described in the confidentiality policy.

The agreement must specify the subject and duration, the nature and purposes of the operations, the categories of data and persons concerned, as well as the obligations and rights of the client. The scope may cover the analysis of deposits, the generation of architectures, support, or an authorized cloud audit.

The annexes must also define the accounts, deposits, and regions concerned, the integrations, the AI policy, the processing locations, the authorized service providers, the retention periods, and the instructions for return or deletion. Sensitive data or data subject to a sectoral regime are not included without explicit examination and agreement.

Brunel processes data only on documented instructions from the client, including for international transfers, unless otherwise required by law. In the latter case, the client is informed before processing when the law permits. Brunel informs the client if an instruction appears to be contrary to applicable regulations.

Persons authorized to access the data are subject to a confidentiality obligation and rights adapted to their functions. The client retains responsibility for the lawfulness of the collection, the information of the persons, and the necessary authorizations for transmission.

The agreed measures must be proportionate to the risks and documented: access control, encryption, separation of environments, protection of secrets, logging, backups, and incident tracking. The page Security provides a technical presentation; it does not replace a contractually accepted measures annex.

For cloud audits, the scope and permissions are limited in reading and time. Client accesses are revocable. The requirements for location or regional inference must be verified on the configuration actually selected, without inferring complete residence from the mere hosting of the database.

The use of a subprocessor requires the specific or general written authorization of the client, according to the regime provided for in the agreement. In the case of general authorization, Brunel informs the client of the changes envisaged and allows him an agreed period to formulate a reasoned objection. The consequences of an unresolved objection are defined in the contract.

Brunel imposes on subprocessors the required protection obligations and remains responsible to the client for the execution of these obligations under the conditions of Article 28 of the GDPR. The applicable register must specify the contracting entities and the processing concerned; the public list of service providers does not replace this annex.

A transfer outside the European Economic Area requires an applicable legal mechanism, documented and, where necessary, an assessment and additional measures. The choice of an AI provider or an access point is part of this review.

Given the nature of the processing and the information available, Brunel assists the client in responding to requests for the exercise of rights, documenting security, assessing impacts, and fulfilling its obligations to consult the supervisory authority. The practical modalities and possible costs are fixed in the contract, without derogating from legal obligations.

In the event of a personal data breach concerning the client's processing, Brunel notifies the client as soon as possible after becoming aware of it. The available information covers the nature of the incident, its probable consequences, the measures taken, and the follow-up contact; it may be supplemented progressively.

The data controller determines the notifications to the authorities and persons concerned. The deadline of seventy-two hours provided for in Article 33 of the GDPR concerns, when it applies, its notification to the supervisory authority; it does not constitute a waiting period granted to the processor.

Brunel makes available the information necessary to demonstrate compliance with subcontracting obligations and allows the audits provided for in Article 28, according to proportionate modalities that protect the security of the service and the data of other clients.

The review may begin with existing documents and evidence, then include additional justified checks. The practical conditions of an on-site audit, its confidentiality, and its organization must be agreed upon without rendering the legal right of audit inoperative.

At the end of the service, the data is returned or deleted according to the client's choice and documented instructions, except for legal retention obligations. Data whose retention is legally necessary remains protected and limited to this purpose.

The agreement must distinguish the active base, backups, reports, and any migration archive. The withdrawal deadlines and the reapplication of deletions in case of restoration must be documented. The indicative durations of the confidentiality policy do not constitute proof of realized deletion.

To prepare the annex, send your request to contact@brunel.cloud with the scope of the service, the categories of data, the location constraints, and the security requirements. Do not include production data or access secret in this initial contact.

The parties must finalize the annexes, the register of authorized processors, and the protection measures before any processing requiring these commitments. A commercial presentation, an API key, or a declaration of conformity does not replace this agreement.