Data Processing Agreement (Article 28 GDPR)

Version of 5 November 2026

In brief

  • This agreement applies automatically when a business Customer uses Nobamouse for its Users (organisation accounts): the Customer is the controller, NOBATECH is the processor (Article 28 GDPR).
  • Webcam images are processed exclusively locally on the device and are never transmitted to NOBATECH.
  • Do not enter any health data in the administration fields; use pseudonymous accounts for patients or residents.
  • Data hosted in the European Union (OVH SAS); no transfer outside the EU planned.
  • Personal data breach: the Customer is informed without undue delay and at the latest 48 hours after discovery.

This Data Processing Agreement (the “DPA”) forms an integral part of the contract between NOBATECH SAS (“NOBATECH”, the “Processor”) and the business customer (the “Customer”, the “Controller”) under the Business Terms of Sale (the “Business Terms”) (the “Contract”). It is incorporated by reference and applies without a separate signature as soon as NOBATECH processes personal data on the Customer’s behalf; a Customer wishing to have a signed copy may use the signature block at the end of this DPA.

It sets out the parties’ obligations under Article 28 of Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act (Law No. 78-17 of 6 January 1978). In case of conflict with the Business Terms on data protection matters, this DPA prevails.

This DPA does not cover processing that NOBATECH carries out as controller, described in the Privacy Policy: managing the relationship with the Customer and its contact persons, orders, payment and invoicing, security of its services and compliance with its legal obligations.

The subject matter, duration, nature and purpose of the processing and the categories of data and data subjects are described in Section 12. Processing lasts for the term of the Contract plus the return and deletion period set out in Section 9.

Local webcam processing. The Desktop Application accesses the webcam to track head and face movements. Images are processed locally and in real time on the User’s device; they are neither recorded nor transmitted to NOBATECH, which has no access to them. The application does not transmit screen content, keystrokes or files (see the End User Licence Agreement (EULA)).

NOBATECH processes the data only on documented instructions from the Customer; the Contract, this DPA and the use of the administration functions of the Service constitute those instructions. NOBATECH immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other applicable provisions. Where Union or Member State law requires processing, NOBATECH informs the Customer before processing, unless the law prohibits this.

The Customer is responsible for the lawfulness of the processing, in particular the legal basis, informing Users (and, for minor pupils, their legal representatives) and the accuracy of the data it enters.

The Service does not require any health data. The Customer, in particular where it is a healthcare, medico-social or educational institution:

  • does not enter any health data or patient-identifying information (diagnosis, condition, room, file number, etc.) in the administration fields, Seat names or support tickets;
  • assigns pseudonymous Seat accounts (neutral identifier, non-nominative or institution-managed e-mail address) to patients, residents or other persons in its care, the mapping table remaining under its sole responsibility;
  • takes into account that the use of the Service by a person in a care institution may in itself reveal information about that person’s health, and limits the data entered accordingly to what is strictly necessary.

NOBATECH is not a health data host within the meaning of Article L1111-8 of the French Public Health Code and does not offer to host such data.

5.1 Confidentiality

NOBATECH ensures that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and access the data only to the extent necessary for their duties.

5.2 Security

NOBATECH implements the technical and organisational measures described in Section 13 to ensure a level of security appropriate to the risk (Article 32 GDPR). It may update them provided that the overall level of protection is not reduced.

5.3 Assistance

Taking into account the nature of the processing, NOBATECH assists the Customer by appropriate technical and organisational measures, insofar as possible, in responding to data subject requests (the administration functions allow User accounts to be viewed, corrected, exported and deleted); it forwards without delay to the Customer any request addressed directly to it. It also assists the Customer in complying with its obligations under Articles 32 to 36 GDPR (security, breaches, impact assessment, prior consultation), taking into account the information available to it.

5.4 Record

NOBATECH keeps a record of all categories of processing activities carried out on behalf of its customers (Article 30(2) GDPR).

The Customer gives NOBATECH general authorisation to engage the sub-processors listed in Section 14. NOBATECH informs the Customer by e-mail or in the administration area of any intended addition or replacement at least 30 days in advance. The Customer may object in writing on reasonable data protection grounds within that period; failing agreement, the Customer may terminate the Contract without charge before the change takes effect.

NOBATECH imposes on each sub-processor, by contract, data protection obligations at least equivalent to those of this DPA and remains liable to the Customer for their performance.

NOBATECH notifies the Customer of any personal data breach affecting data processed on its behalf without undue delay and at the latest 48 hours after becoming aware of it, at the contact address given in Section 15. The notification contains, insofar as available, the information referred to in Article 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, contact point); missing information is provided as soon as possible. NOBATECH takes the measures necessary to mitigate the effects of the breach and assists the Customer with its own notifications to the supervisory authority and data subjects. Notification does not constitute an admission of liability.

The data are hosted and processed in the European Union. No transfer to a third country is planned. Should a transfer become necessary, NOBATECH would inform the Customer in advance under the procedure in Section 6 and would ensure appropriate safeguards within the meaning of Chapter V GDPR (adequacy decision or the European Commission’s standard contractual clauses).

During the Contract, the Customer can export the data of its organisation accounts in the administration area or on request to privacy@nobatech.eu. When the Contract ends, NOBATECH deletes the data processed on the Customer’s behalf within 30 days, unless the Customer requests their return before the end of the Contract, and unless a legal retention obligation applies. Backup copies expire at the end of their 30-day rotation; until erased, they remain protected and are not used for any other purpose. NOBATECH confirms deletion in writing on request.

NOBATECH makes available to the Customer the information necessary to demonstrate compliance with this DPA. The Customer exercises its audit right primarily on the basis of this documentation (description of security measures, record, available certifications, answers to a reasonable questionnaire). If this documentation is insufficient, the Customer may have an audit carried out, at most once per calendar year (except in case of a data breach or a request from a supervisory authority), with thirty (30) days’ notice, during business hours, without disrupting operations, by itself or by an independent auditor bound by confidentiality and not a competitor of NOBATECH. Each party bears its own costs.

This DPA applies for the term of the Contract and for as long as NOBATECH holds data processed on the Customer’s behalf. Each party’s liability is governed by Article 82 GDPR and otherwise by the liability provisions of the Business Terms. This DPA is governed by French law; the competent court is the one designated in the Business Terms. NOBATECH may adapt this DPA to reflect changes in legislation or CNIL recommendations, following the change procedure of the Business Terms.

Subject matter Provision of the Nobamouse service to the Customer’s Users: management of organisation accounts and Seats, verification of licences and activated devices, distribution of updates, technical support.
Nature of the operations Collection, recording, storage, consultation, alteration, hosting, transmission (service e-mails), erasure.
Purposes Performance of the Contract for the Customer: User access to the Service, Seat administration, device-limit control, support and incident resolution, security of the Service.
Data subjects The Customer’s administrators and contact persons; Users assigned a Seat: employees or staff, pupils and students (including minors), persons cared for or supported by the Customer (e.g. patients or residents of a healthcare or medico-social institution).
Categories of data Account identifiers (name or pseudonym, e-mail address, organisation, administrator/user role); Seat assignment (Seat identifier, assignment dates); licence and device data (licence key or code, activation identifiers, device name and operating system, application version, timestamps and IP address during licence checks); support tickets (content, attachments, correspondence); technical logs and crash reports needed for support.
Excluded data Webcam images and video (processed only locally), screen content, keystrokes, files. No special categories of data (Article 9 GDPR) are required; the Customer undertakes not to enter any (Section 4).
Duration Term of the Contract, then deletion within 30 days (Section 9); backups: 30-day rotation.
Location European Union (hosting by OVH SAS, France).
Minimisation Webcam processing exclusively local; no transmission of images, screen content or keystrokes; detailed usage analytics off by default; pseudonymous Seat accounts possible.
Encryption TLS for all communications between the Desktop Application, the website and NOBATECH services; encrypted backups.
Access control Centralised authentication (Keycloak); administrator access limited to authorised NOBATECH personnel, protected by two-factor authentication; need-to-know.
Software security Signed installers and updates; monitoring of dependency vulnerabilities; coordinated disclosure (security@nobatech.eu); security updates during the support period.
Availability Encrypted daily backups kept for 30 days, including one off-site copy in the EU; regular restore tests; offline operation of the application for a grace period.
Incidents Written internal procedure covering personal data breaches (Articles 33/34 GDPR), notice to customers acting as controllers and the obligations under Regulation (EU) 2024/2847 (CRA); breach register.
Personnel and sub-processors Confidentiality undertakings and internal data protection guidelines; access removed on departure; sub-processors bound by an Article 28 agreement and hosted in the EU.
Erasure Erasures re-applied after any restore; backups expire at the end of the 30-day rotation.
Sub-processor Service Location
OVH SAS, 2 rue Kellermann, 59100 Roubaix, France Infrastructure hosting (servers, databases, private network) France (EU)
NOBATECH SAS's own mail server, hosted on its own infrastructure at OVH (France); no external e-mail service provider Service e-mails (invitations, notifications) European Union
NOBATECH SAS's own ticketing system, hosted on its own infrastructure at OVH (France) Support ticket management European Union

Payment service provider. Mollie B.V. (the Netherlands) processes the Customer’s payments within the commercial relationship between the Customer and NOBATECH; it does not process User data on the Customer’s behalf and is therefore not a sub-processor under this DPA. For its own regulatory obligations it acts as an independent controller.

  • Data protection (NOBATECH): privacy@nobatech.eu. NOBATECH has not appointed a data protection officer (Article 37 GDPR not applicable); data protection contact: privacy@nobatech.eu.
  • Security and breach notification (NOBATECH): security@nobatech.eu.
  • Customer contact for notifications: the e-mail address of the main administrator of the organisation account or the one stated in the Quote / Order Form, unless another contact has been provided in writing.

This DPA applies without signature. A Customer wishing to have a signed copy may complete the block below.

Take control

Download