Data processing agreement (GDPR Article 28)

Subject matter, nature and duration

• Subject matter and purpose: receive the QR codes read by the app, rebuild and decrypt each file, verify it and make it available to the account, only to provide the service.
• Nature: receipt, decryption, integrity check, temporary storage, making available, deletion.
• Duration: that of the subscription; each file is kept for 7 days at most, or deleted as soon as it is downloaded with the option provided.
• Data: the content of the files you choose to transfer, their names, and account data (username, e-mail address, sign-in logs).
• Data subjects: the users of your accounts, and anyone whose data appears in the transferred files.

Instructions and confidentiality

• We process the data only on your documented instructions: use of the service and the settings of your account or instance. If an instruction seems to us to infringe the GDPR, we tell you.
• We never open a file for any other purpose, sell it or use it to train a model.
• The people authorised to access the server are bound by confidentiality.

Security measures (Article 32)

They are described, limits included, on the security page; in short:

• transfers encrypted with a key specific to each account (XSalsa20-Poly1305), HTTPS-only transport;
• named accounts, scrypt password hashes, limited attempts, TOTP second factor;
• tamper-evident audit trail of every transfer, kept 365 days, exportable;
• short retention, optional deletion after download, quotas;
• organisation options: four-eyes approval, allowed file types, authorisation on file, directions authorised separately.

The server decrypts files to rebuild them; the application claims no encryption at rest. If your analysis requires it, a dedicated instance or an installation on your own servers is possible.

Sub-processors

You give us a general authorisation to use the sub-processors listed below, each for its own part:

• Hetzner Online GmbH: server, database and transferred files, Helsinki data centre (Finland, EU). Transferred files are processed there only.
• Stripe Payments Europe, Ltd. (Ireland): payment; no transferred file.
• Cloudflare, Inc. (United States): domain names and receipt of e-mails sent to contact@getbouraq.com; the application's traffic does not go through its servers.
• Google Ireland Limited: our mailbox, for the e-mails you send us.

We tell you by e-mail about any addition or replacement at least 30 days in advance; you may object and, failing agreement, terminate at no cost. Each sub-processor is bound by contract to obligations equivalent to this agreement. Transfers outside the European Union that some of them involve are covered by the EU-U.S. Data Privacy Framework or by the European Commission's standard contractual clauses.

Assistance and personal data breaches

• We help you answer requests from data subjects exercising their rights, and carry out your impact assessments and prior consultations, as far as we know the processing.
• If a personal data breach affects your data, we tell you without undue delay and at the latest 48 hours after becoming aware of it, with its nature, the categories and approximate number of people and records concerned, its likely consequences and the measures taken.

End of processing

At the end of the contract, or at your request, we delete the files and the account data; you can retrieve them first, as one ZIP file from your space. Only the audit-trail entries (account, file name, size, fingerprint and time, never the content) remain for the trail's retention (365 days), kept for proof and security, then deleted.

Information and audits

We make available the information needed to demonstrate compliance with this agreement: the security page, the approval pack, audit-trail exports and signed receipts. You may carry out, or have an independent auditor bound by confidentiality carry out, one audit a year at your expense with 30 days' notice, or at any time after a breach affecting you.