Data processing agreement

This agreement forms part of the terms of use. It governs the processing of personal data by Hadi Tahini (the processor) on behalf of the customer (the controller), in accordance with article 28 GDPR. The French version prevails.

Updated 2026-10-18

Subject matter and duration

The processor provides the Tosloc service to the customer. The agreement lasts as long as the customer uses the service, then until the data is deleted or returned (clause g).

Nature and purpose of the processing

Hosting, storing, retrieving and presenting the data the customer enters to run its business (scheduling, jobs, clients, quotes, invoices, teams), solely to provide the service.

Categories of data and data subjects

Data subjects: the customer’s clients, site contacts and employees.
Data: identity, contact details, addresses, job and attendance data, uploaded files and photos, and live position while sharing is switched on.

Processor obligations

(a) Documented instructions: the processor processes the data only on the customer’s documented instructions, including for transfers outside the Union, unless required by law, in which case it informs the customer.
(b) Confidentiality: persons authorised to process the data are bound by confidentiality.
(c) Security measures (article 32): truncated IP addresses in visit and sign-in records; keyed (HMAC) hashing of IP addresses on signatures; GPS and EXIF metadata stripped from uploaded photos; audit logs.
(d) Sub-processors: the customer gives a general authorisation. Sub-processors are listed on the dedicated page; the customer is told of any change 30 days ahead through that page and may object.
(e) Data subject rights: the processor helps the customer respond to requests, notably through the service’s export and erasure functions.
(f) Assistance (articles 32 to 36): the processor helps the customer with security, breach notification, impact assessments and prior consultation.
(g) End of the service: the customer can export its data at any time. A canceled workspace is deleted 90 days after cancellation; workspaces holding invoices or payroll records are retained until those records’ legal retention period has been addressed. Erased data can persist in backups until the backup retention period ends.
(h) Audits: the processor makes available the information needed to demonstrate compliance with the agreement and allows audits, including inspections, by the customer or a third party it mandates.

Contact

For any question about this agreement: contact@tosloc.fr.