1. Purpose and parties
This agreement (the “Agreement”) sets out the conditions under which Pepiva Technology, [TO BE COMPLETED: legal form, RCS or SIREN number, registered office address] (“Pepiva”), processes personal data on behalf of the Customer as part of the hosted ProxTrace service (the “Service”).
It forms an integral part of the Terms of Service (the “Terms”) and applies as soon as they are accepted, whatever the plan. Terms defined in the Terms and in the GDPR have the same meaning here. In case of conflict, the Agreement prevails over the Terms for everything relating to personal data protection.
The Agreement does not apply to the self-hosted edition, where data stays on the Customer’s infrastructure and is not processed by Pepiva. Nor does it cover the processing for which Pepiva is the controller (console accounts, sign-in security, commercial relationship), described in the privacy policy.
2. Description of the processing
The nature and purposes of the processing, the categories of data and data subjects and the retention periods are described in annex 1. The processing lasts for the term of the contract, extended by the return and deletion period set out in section 12.
3. Customer instructions
Pepiva processes personal data only on the Customer’s documented instructions. The Terms, this Agreement, the configuration chosen by the Customer in the console (enrolled infrastructures, collection profiles, retention period, AI assistant activation, notifications) and its written requests constitute those instructions.
Pepiva immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or another applicable provision. If Union or Member State law requires Pepiva to process data, it informs the Customer before processing, unless that law prohibits it on important grounds of public interest.
4. Customer obligations
As controller, the Customer:
- has a legal basis for having the data described in annex 1 processed, in particular the account names and IP addresses found in its infrastructure logs;
- informs data subjects, in particular its administrators, users and contractors whose activity is logged, in accordance with articles 13 and 14 GDPR;
- enables optional collection profiles, including reading services, packages and listening ports inside guests, and the AI assistant knowingly;
- does not knowingly place special-category data within the meaning of article 9 GDPR, or secrets, in the names, comments or free-text fields of its infrastructure.
5. Confidentiality
Pepiva ensures that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to data is limited to those who need it to provide the Service, support or security.
6. Security
Pepiva implements the technical and organisational measures described in annex 2, appropriate to the risk in accordance with article 32 GDPR. It may change them without lowering the overall level of protection.
7. Sub-processors
The Customer grants Pepiva a general authorisation to engage sub-processors. Those in place on the date of the Agreement are listed in annex 3 and on the public Sub-processors page.
Pepiva informs the Customer of any intended addition or replacement by email to its Organisation’s administrators at least thirty days before it takes effect, and updates the public page. The Customer may object in writing, on reasonable data protection grounds, within fifteen days of that notice. The parties then seek a solution in good faith. Failing that, the Customer may terminate the affected part of the Service without penalty before the change takes effect; when the sub-processor only serves an option, such as the AI assistant, the Customer may also simply keep it disabled.
Pepiva imposes on each sub-processor, by contract, data protection obligations at least equivalent to those of the Agreement. It remains liable to the Customer for the performance of their obligations.
8. Transfers outside the European Union
Pepiva transfers personal data outside the European Economic Area only in the cases and with the safeguards described in annex 4. On the date of the Agreement, only the optional AI assistant involves such a transfer.
9. Data subject rights
Pepiva assists the Customer, through appropriate technical and organisational measures, in responding to requests to exercise data subject rights. If a person contacts Pepiva directly about data processed on the Customer’s behalf, Pepiva forwards the request to the Customer without undue delay and does not answer it itself unless instructed by the Customer.
10. Assistance to the Customer
Taking into account the nature of the processing and the information available to it, Pepiva assists the Customer in meeting its obligations relating to security, breach notification, data protection impact assessments and prior consultation of the supervisory authority (articles 32 to 36 GDPR). In particular, it provides the available security documentation and answers the Customer’s reasonable questionnaires.
11. Personal data breaches
Pepiva notifies the Customer of any personal data breach affecting its data without undue delay, and no later than forty-eight hours after becoming aware of it, by email to its Organisation’s administrators. The notification includes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it and a contact point. Missing information is provided as soon as it becomes available.
Notifying the CNIL or other competent supervisory authority and, where applicable, informing data subjects remain the Customer’s responsibility, with Pepiva’s assistance. Pepiva documents every breach, its effects and the measures taken.
12. Data at the end of the contract
At the end of the contract, Pepiva makes an export of the Customer’s data available in a structured format, on request made no later than thirty days after the end, under the conditions of section 9 of the Terms. After that period, it deletes the personal data processed on the Customer’s behalf from the production database; backup copies are erased as the backups rotate, at the latest [TO BE COMPLETED: backup rotation period]. Pepiva confirms deletion in writing at the Customer’s request.
This obligation does not apply to data whose retention is required by Union or Member State law.
13. Records, information and audits
Pepiva keeps the record of categories of processing activities carried out on behalf of its customers required by article 30(2) GDPR.
Pepiva makes available to the Customer the information needed to demonstrate compliance with the Agreement: description of security measures, list of sub-processors and, where they exist, recent audit or test reports. If these are not sufficient, the Customer may have an audit, including an inspection, carried out by itself or by an independent auditor bound by confidentiality and not a competitor of Pepiva, no more than once a year except after a confirmed breach or at the request of a supervisory authority, with at least thirty days’ written notice. The audit takes place during business hours, without disrupting the Service or giving access to other customers’ data; its costs are borne by the Customer. Pepiva receives a copy of the report.
14. Liability and term
Each party’s liability under the Agreement is governed by the Terms, within the limits allowed by article 82 GDPR. The Agreement remains in force for the term of the contract and until all data processed on the Customer’s behalf has been deleted.
Annex 1: description of the processing
Purposes
- Provide the Service: receive, store and structure the Collector’s observations, build the change history and inventory, link events to their evidence, evaluate best-practice checks, produce the reports and notifications chosen by the Customer.
- Answer, at a User’s request, through the AI assistant when the Customer has enabled it.
- Provide the support requested by the Customer, and ensure the security and proper operation of the Service.
Nature of the operations
Collection by the Collector installed by the Customer, encrypted transmission, recording, structuring, storage, consultation, comparison, provision to the Customer’s Users, transmission to the AI assistant provider when the assistant is used, erasure.
Categories of data subjects
- The Customer’s administrators, users and contractors holding an account or API token on its Proxmox VE nodes or Proxmox Backup Server instances.
- People whose IP address or account appears in infrastructure logs and events (SSH, web interface, API, tasks).
- Holders of host system accounts and, if the Customer enables the relevant profile, of services running inside guests.
- Console Users, for the comments, acknowledgements and actions they record in the Organisation.
Categories of data
- Technical identifiers: Proxmox user names and authentication realms, API token names, host system accounts.
- Connection and log data: source IP addresses, timestamps, task identifiers, node concerned, log lines retained as evidence of an event.
- Configuration and inventory: nodes, virtual machines and containers, host and guest names, networks, firewall rules and logs, storage, Proxmox Backup Server backup metadata, before and after values of observed configurations.
- If the Customer enables this profile: services, packages and listening ports inside guests.
- Content entered in the console: comments, exception justifications, AI assistant conversations.
Not collected: the content of machine disks and backups, the content of Proxmox’s private folder, infrastructure passwords and private keys. No special-category data within the meaning of article 9 GDPR is sought; names and comments entered by the Customer may nevertheless contain some if the Customer places it there.
Retention periods
Observations, events and reports are kept for the period set by the subscribed plan; where the console allows it, the Customer may choose a shorter period within that limit. Older data is deleted automatically. AI assistant conversations are kept in the console until the User deletes them or until the end of the contract [TO BE COMPLETED: maximum retention of conversations]. At the end of the contract, section 12 applies.
Place of processing
Data is hosted by OVH SAS in the European Union [TO BE CONFIRMED: data centre location]. Only the AI assistant, when used, sends extracts outside the European Union (annex 4).
Annex 2: technical and organisational measures
Console access
- TLS encryption between the browser and the console, and between the Collector and the console.
- Mandatory two-factor authentication for every account; passwords stored hashed.
- Session cookie reserved to the server (HttpOnly), sent over HTTPS only (Secure) and limited to the originating site (SameSite=Strict), lasting at most eight hours.
- Per-Organisation roles (administrator, operator, auditor); logging of sign-ins and sensitive actions.
- Platform operations access reserved to Pepiva operators, protected by two-factor authentication and logged.
Isolation
- Each Organisation is a separate scope; isolation is enforced server-side on every request, independently of the interface.
Collection on the Customer’s infrastructure
- Read-only collection: the Collector receives and executes no command from the console; data flows only from the infrastructure to the console.
- Dedicated system account on the nodes, without a usable shell, whose privilege elevation is limited to a single reader; Proxmox audit roles for the API.
- Strict SSH host key verification, with pinned keys and no automatic update: a changed key set is refused.
- Collector releases signed with Ed25519 and verified before installation.
- Bounded local send queue; transmissions are acknowledged by the console.
AI assistant
- Disabled until the plan or the Customer enables it; triggered only at a User’s request.
- Proxmox credentials, SSH keys, passwords and installation secrets are not sent; sensitive fields are filtered and known secrets masked before conversations are stored.
- Requests sent with the no-storage option offered by the provider’s API [TO BE VERIFIED: residual retention by the provider for abuse monitoring].
Continuity and organisation
- Encrypted off-site backups of the console database: being set up [TO BE COMPLETED: go-live date, frequency, location and retention].
- Encryption of data at rest: [TO BE COMPLETED].
- Data access limited to authorised persons bound by confidentiality; incident and breach management procedure [TO BE COMPLETED: description of the procedure].
- Transactional emails sent by a mail relay operated by Pepiva on its own infrastructure, without a third-party provider.
Annex 3: sub-processors
The current, dated list is on the Sub-processors page. On the date of the Agreement:
- OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of the Service infrastructure (virtual private server), all data, European Union [TO BE CONFIRMED: data centre location].
- OpenAI [TO BE VERIFIED: contracting entity and address]: language model for the AI assistant, only when the assistant is enabled and used; extracts needed for the answer; United States.
The notice and objection procedure is described in section 7.
Annex 4: transfers outside the European Union
When a User asks the AI assistant a question, the question and the context used to answer it (extracts of the inventory, events and check results of the relevant Organisation) are sent to OpenAI. These extracts may contain Proxmox user names, host names and IP addresses. The transfer to the United States is governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the data processing agreement concluded by Pepiva with OpenAI [TO BE VERIFIED: applicable module, and whether OpenAI is certified under the EU–US Data Privacy Framework]. Pepiva has assessed the safeguards offered by the destination country [TO BE COMPLETED: reference of the transfer impact assessment].
A Customer who wants no transfer outside the European Union keeps the AI assistant disabled; the rest of the Service involves no transfer.