1. Purpose

1.1 Octopush, a simplified joint-stock company with a capital of 30,000 euros, registered with the Marseille Trade and Companies Register under number 538 371 816, with its registered office located at 131, avenue du Prado 13008 Marseille (hereinafter referred to as "Octopush"), is a company that operates a platform allowing its users to benefit from various mobile communication services via different methods (SMS, email, etc.).

1.2 These general terms of service (hereinafter the "GTC") aim to determine the conditions under which users may access and use this platform and benefit from the associated services provided by Octopush (hereinafter the "Services"), subject to payment by the users of the price stipulated below.

1.3 The aforementioned users and Octopush are hereinafter referred to, individually or collectively, as "the Party(ies)".

2. Definitions

In these GTC, terms and expressions identified by a capital letter have the meaning indicated below, whether used in the singular or plural.

• " Subscription ": refers to the subscription plan for the Services based on an annual commitment by the User. The operation of the Subscription is described in Article 7.1.1.
• " API ": refers to the application programming interface, developed and operated by Octopush, which allows the User to integrate and automate certain Services within their own information system, as provided for in the Documentation.
• " Order ": refers to the User's order of a Service.
• " User account ": refers to the User's personal and secure management interface on the Platform, accessed via a username and password.
• " Documentation ": refers to all documents, instructions, Platform pages, FAQs, and user, technical, and functional manuals relating to the type, description, and use of the Services. The Documentation is made available to the User by Octopush on the Platform and is enforceable against the User in accordance with Article 6.1.
• " API Documentation " refers to the API user documentation.
• " User Documentation ": refers to the user documentation for the Platform and Services.
• " Data ": refers to all information, including personal data, owned by the User or under the User's responsibility, processed by the Platform and/or necessary for the performance of the Services.
• " Pack ": refers to the service subscription plan based on a one-off commitment by the User, without a Subscription. The operation of the Pack is described in Article 7.1.2.
• " Platform ": refers to the website (https://www.octopush.com), developed and operated by Octopush, which enables the provision of the Services to the User.
• " Routers ": any party, whether a direct contractor of Octopush or not, involved in the routing of messages.
• " Services ": refers to the services offered to the User via the Platform allowing the transmission of various types of messages to telecommunications operators, the Services being more fully described in the User Documentation.
• " User ": refers to users of the Platform, operating as a company or as an individual, and using the Services exclusively within the scope of their professional activity.

3. Effective Date – Duration – Modification

3.1 The GTC come into effect upon their acceptance by the User during their first login to the Platform to create their Account (hereinafter the "Effective Date").

3.2 The GTC have the following duration:

i. In the case of a Subscription, the GTC have an annual duration starting from the Effective Date. Upon expiration of this initial Subscription period, the GTC are automatically renewed for identical successive periods, unless terminated by either Party via email with acknowledgment of receipt thirty (30) days before the end of the current Subscription period.

ii. In the case of a Pack, the GTC remain in effect until the expiration of a one (1) year period from the User's last use of the Services. Upon expiration of this period, if the User has not renewed the Pack, the GTC will terminate.

3.3 The GTC may be modified at any time by Octopush in accordance with the following terms. Changes will be notified to the User by email and will come into effect one (1) month after the notification is sent. If the User does not agree with the new GTC, they may terminate them in accordance with the terms of Article 3.2 (i)

4. Access to the Platform

4.1 Technical requirements

The operation of the Platform requires an Internet connection, for which Octopush is not responsible and which is therefore entirely the User's responsibility. Similarly, the User is responsible for the computer equipment required to access the Platform; Octopush does not provide this equipment and assumes no liability in this regard.

4.2 User Account

4.2.1 Access to the Platform requires the User to create a User Account, under the conditions specified in the Documentation.

4.2.2 Creating the User Account:

• is carried out directly by the User if they operate as a sole trader;
• is carried out by one or more of the User's employees if the User operates as a company. In this case, the User acknowledges that the employees who proceed with the creation of the User Account must be legal representatives of the company or, failing that, must provide proof of authorization. Any act performed by an employee therefore binds the User and cannot be challenged on these grounds.

4.2.3 The User agrees to provide correct and complete information when creating the User Account and to update it in the event of any changes.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4.2.4 Connection to the User Account is made using a username and password. The User is solely responsible for the use and confidentiality of the username and password associated with the User Account. They agree to ensure the confidentiality of these access codes and to ensure that they are neither communicated to nor accessible by unauthorized third parties. Octopush cannot be held liable for the consequences of such communication or access, which will be deemed to be the act of the User.

5. General use of the Platform

In addition to what is stipulated elsewhere in the General Terms and Conditions, the User acknowledges the following.

5.1 The User acknowledges that the Platform may only be used as part of their professional activity, to the exclusion of any personal use. The User is therefore deemed to be using the Platform and the Services in a professional capacity. Consequently, the User acknowledges and agrees that no right of withdrawal applies to the Services.

5.2 The User agrees not to introduce, voluntarily or even involuntarily, any virus or file of any kind that disrupts the proper functioning of the Platform or allows third parties to access the Platform or the Data it contains. To this end, the User shall ensure that they install recent and updated anti-virus software and a recent and updated firewall on their computer equipment.

5.3 The User is solely responsible for the Data and, more generally, for any content of any nature whatsoever that they publish on the Platform or use as part of the Services. The User warrants that they hold the necessary rights to such Data and content. They also warrant that such Data and content are not unlawful. Octopush is under no general obligation to monitor the User's Data and content stored on the Platform, nor any general obligation to seek facts or circumstances indicating unlawful activities. However, the User is informed that Octopush may temporarily or permanently remove, without notice, any Data or content that is manifestly unlawful or whose unlawful nature becomes apparent, in accordance with Article 6 of Law No. 2004-575 of June 21, 2004, known as the "LCEN".

5.4 The User acknowledges that they are obligated to regularly back up their Data and content.

5.5 The Data is confidential. Octopush therefore undertakes to apply the same protection measures to this Data as it does to its own confidential information, and in particular, not to disclose it to third parties, in any form, on any medium, or for any reason whatsoever, and to require the same confidentiality commitment from any employee or third party who may become aware of the Data for the purposes of performing the General Terms and Conditions.

6. Services

6.1 Types and description of Services – Documentation

The various types of Services and their terms are described on the Platform, and in particular, in the Documentation. The Documentation is by nature subject to change. The User acknowledges that they must consult the Documentation regularly and that it is enforceable against them in its entirety at any time during the performance of the General Terms and Conditions.

The User is informed that the Services may be provided in France and/or abroad and are therefore subject to various local regulations. The Documentation may specify the local terms and conditions for the User's use of the Services. Furthermore, it is the User's responsibility to comply with any national or international regulations applicable to the Services, particularly regarding prospecting, marketing, advertising, and the protection of personal data. Octopush cannot be held liable for any use of the Services by the User that does not comply with the Documentation or any applicable local regulations.

The User further agrees that the technical conditions and features (specified in the Documentation) and the financial terms (set out in each Order) of the Services may vary depending on the territory and the duration of the General Terms and Conditions.

6.2 Ordering

To benefit from a Service, the User places an Order on the Platform; all Orders are subject to the legal framework of the GTC.

6.3 Performance of Services

6.3.1 The User acknowledges that Octopush is bound by an obligation of means in the performance of the Services: Octopush performs the Services according to the instructions given by the User and is only liable in the event of proven fault if the Services are not provided in accordance with said instructions. It is also reiterated that the Services consist of transmitting messages to the Routers, which are solely responsible for their delivery.

6.3.2 The User is the sole judge, given their unique knowledge of their internal strategy and professional activities, of how they use the Services. Octopush is not responsible for the impact of the Services on the User's business. In particular, Octopush does not guarantee the User any conversion rate.

6.3.3 The Services are provided via the Internet, and more generally via telecommunications networks. Consequently, the User is warned of the technical risks that may affect these networks and lead to slowdowns or unavailability of the Services, for which Octopush cannot be held liable.

6.3.4 Octopush may suspend access to the Services, without prior formal notice but with immediate notification, if the User fails to comply with their obligations under the GTC.

6.3.5 The User agrees to cooperate in good faith with Octopush in the performance of the Services and to alert Octopush to any difficulties they become aware of that could affect the Services.

6.3.6 The User shall indemnify Octopush against any claim or action brought by a third party against Octopush under the GTC, particularly for any action related to the User's misuse of the Services. This indemnity covers, in particular, any legal fees necessary to defend Octopush's interests.

6.3.7 For security reasons, API user accounts may be blocked in the event of numerous consecutive failed requests.
If this happens to you, please contact us at support(@)octopush.com to reactivate your account.

6.4 Support – Maintenance

6.4.1 The Documentation allows the User to quickly obtain the operational procedures for the functioning of the Platform and the Services.

6.4.2 Octopush also provides technical support for the Platform and Services, accessible according to the procedures specified in the Documentation.

6.4.3 Octopush will use its best efforts to provide corrective and evolutionary maintenance for the Platform, under the conditions set out in the Documentation. Octopush reserves the right to suspend access to the Platform and/or the Services for scheduled maintenance, of which the User will be notified in advance, except in emergencies.

7. Financial terms

7.1 Service pricing

When creating their User Account, the User chooses between the Subscription and the Pack.

The price of each Service will be determined by Octopush for every Order, based on the prices currently charged by its own suppliers for the relevant territory. The price of each Service is therefore set by Octopush before each Order, automatically via the Platform.

7.1.1 Subscription plan

The Subscription plan entails:

• at a fixed annual price, billed monthly, corresponding to the price of the Subscription granting the User the right to use the Platform;
• and at an additional price, billed monthly, corresponding to the Services actually provided to the User during the past month.

In the event of termination of the General Terms and Conditions, for any reason whatsoever, before the end of the current Subscription period, no refund will be made by Octopush and the User will be liable to Octopush for the balance of the Subscription price until the end of the current period.

The price and volume of the Services vary according to the Subscription plan chosen by the User. Before the provision of Services begins, the User pays in advance the price of the Services corresponding to the selected Subscription plan. Each Service Order will be deducted from the price of the Services paid in advance.

If, during the month, the User exceeds the price of the Services paid in advance, they will pay an additional price for the Services according to the price list for said Services to be provided, with any remaining balance applied to the price of the Services for the following month.

The Octopush unlimited email plan includes a monthly sending volume subject to safeguards (i.e., 1,000,000 – one million – emails per month). This volume constitutes the standard limit for reasonable use of the service for the monthly billing period. Important note: This volume is per calendar month (from the 1st to the last day of the month) and cannot be carried over from one month to the next. Any volume not used during a given month cannot be carried over to the following month.

7.1.2 Pack plan

The Pack plan requires the User to pay a fixed price in advance, covering the right to use the Platform and the provision of Services during the period indicated in Article 3.2 ii). This price remains the property of Octopush regardless of the Services ordered by the User during the aforementioned period. The same applies in the event of termination of the General Terms and Conditions and/or the Order, for any reason whatsoever, during the aforementioned period.

By accepting the Terms and Conditions after purchasing a pack, no refund will be issued by Octopush.

The price, volume, and type of Services provided will depend on the Pack chosen by the User from those listed on the Platform.

Each Service Order will be deducted from the aforementioned price within the limit of the Pack selected by the User.

7.2 Taxes

All prices for the Services are exclusive of taxes, and VAT, at the rate in force on the date of invoicing, or any other tax applicable to the Services, will be added.

7.3 Billing and payment terms

Invoices are issued monthly for the Subscription plan and upon purchase of a Pack for the Pack plan. They are due immediately upon issuance of the invoice.

Invoices are accessible to the User within the Platform, in their User Account.

In the event of a dispute regarding an invoice, the User must inform Octopush in writing within fifteen (15) calendar days from the date the invoice in question is made available. After this period, the invoices are deemed accepted by the User.

Payment is made by the User via credit card, bank transfer, SEPA direct debit, check, or a third-party payment provider such as PayPal or Stripe.

In the event that payment is not made before the Service is provided, any late payment of an invoice by its due date will result in the suspension of access to the Platform and the Services without notice and without Octopush being held liable in this regard.

Any late payment will automatically result in the application of (i) a late payment penalty equal to three (3) times the legal interest rate then in force and (ii) a fixed indemnity for recovery costs of forty (40) euros.

8. Intellectual Property

Octopush is and remains the owner of all intellectual property rights to the Platform and the Documentation (the "Elements"), and the Terms of Service do not transfer any intellectual property rights to the User.

Octopush grants the User, for the duration of the Terms of Service, a simple, non-exclusive, non-transferable, and non-assignable right to use the Elements, solely for the purposes of providing the Services and excluding any other use.

Consequently, the User is prohibited from any other use of the Elements, including, but not limited to: (i) representing, distributing, marketing, and/or making them available to third parties, whether free of charge or for a fee; (ii) reproducing, adapting, modifying, correcting, or translating them; and (iii) assigning, renting, or licensing them.

9. Liability

9.1 Octopush shall only be liable for the foreseeable, immediate, and direct harmful consequences of a breach on its part under the Terms of Service, in accordance with Articles 1231-3 and 1231-4 of the Civil Code.

9.2 It is expressly agreed that the following damages shall not be compensated by Octopush, even if they were directly caused by a failure to fulfill its contractual obligations:

• loss of profit related to any type of economic damage, such as, for example, loss of orders, loss of business, loss of clients, loss of revenue, or loss of anticipated savings;
• loss and/or alteration of Data, provided that the User is obligated to back up such data in accordance with the provisions of these Terms of Service;
• damage to the User's reputation;
• actions of third parties.

9.3 Furthermore, Octopush shall under no circumstances be held liable in the following cases, regardless of the nature of the damage:

• Platform malfunction related to hosting, telecommunications, Internet, or telephone network issues;
• Platform malfunction attributable to the User;
• Authentication failure or error attributable to the User;
• Relationship between the User and their own clients;
• Failure in the delivery of messages by the Routers.

9.4 If the User believes that Octopush has failed to fulfill its obligations under the Terms of Service, they must notify Octopush in writing within one (1) month of the event in question.

In any event, should Octopush fail to fulfill its obligations under the Terms of Service, causing damage to the User, Octopush's liability shall be limited, regardless of the nature or legal basis of the claim, to the amount paid by the User during the twelve (12) months preceding the event giving rise to the claim.

Octopush shall not be held liable after the expiration of a two (2) year period from the date the event giving rise to the claim occurred.

9.5 To ensure optimal service continuity, Octopush regularly performs disaster recovery tests. Our latest tests allow us to estimate a minimum recovery time of 4 hours (time observed during our best test: 3 hours and 1 minute).
However, external factors and/or factors independent of Octopush, such as the availability of qualified operators at a given time, or the availability of suppliers/partners to validate new connections and IPs used, may have a significant impact on this timeframe.
Octopush cannot, therefore, contractually commit to a recovery time but will do its utmost to ensure a return to normal as quickly as possible.

10. Termination – Consequences of the end of the Terms and Conditions

10.1 Termination clause

In the event of a serious and/or repeated breach by the User of any of their obligations under the Terms and Conditions, which is not remedied within seven (7) calendar days of a formal notice to remedy sent by email with acknowledgment of receipt, Octopush may automatically terminate the Terms and Conditions at the User's fault, without prejudice to any damages it may claim.

10.2 Consequences of the end of the Terms and Conditions

In addition to what is stipulated in Article 7, in the event of the termination of the Terms and Conditions for any reason whatsoever, the User will no longer have access to the Platform or the Services. As such, Octopush may, consequently, immediately and without notice, interrupt the User's access to the Platform and the Services, without the User being able to hold Octopush liable.

Consequently, it shall be the User's responsibility to:

• to retrieve their Data from the Platform before the expiration of the Terms and Conditions under the conditions of Article 3.2;
• or, if the Terms and Conditions are terminated under the conditions of Article 10.1, to request that Octopush return their Data within seven (7) calendar days from the termination of the Terms and Conditions.

10.3 Prohibited behavior

In the event of prohibited behavior as described below, the notice period applicable under clause 10.1 shall not apply to the User.

It is strictly prohibited to use the Platform or the Services for the following purposes:

• engaging in illegal or fraudulent activities, or activities that infringe upon the rights or safety of third parties,
• breaching public order or violating applicable laws and regulations,
• intruding into a third party's computer system or any activity intended to harm, control, interfere with, or intercept all or part of a third party's computer system, or to violate its integrity or security,
• sending unsolicited emails,
• manipulations intended to improve the search engine ranking of a third-party site,
• aiding or inciting, in any form or by any means, one or more of the acts and activities described above,
• and, more generally, any practice that diverts the Services for purposes other than those for which they were designed.

Users are strictly prohibited from copying and/or misappropriating the concept, technologies, and/or any other element of the Platform for their own purposes or those of third parties.

The following are also strictly prohibited:

(i) any behavior likely to interrupt, suspend, slow down, or prevent the continuity of the Services;

(ii) any intrusions or attempted intrusions into Octopush's systems;

(iii) any misappropriation of Octopush's system resources;

(iv) any actions likely to impose a disproportionate load on the latter's infrastructure,

(v) any compromise of security and authentication measures,

(vi) any acts likely to infringe upon the financial, commercial, or moral rights and interests of Octopush or other users of its Platform,

(vii) and finally, more generally, any breach of these GTC.

It is strictly prohibited to monetize, sell, or grant access to all or part of the Services or the Platform, as well as to the information hosted and/or shared therein.

10.4 Consequences of breaches

In the event of a breach of any of the provisions of these GTC or, more generally, a violation of applicable laws and regulations by the User, Octopush reserves the right to take any appropriate measure, including:

(i) suspend or terminate the User's access to the Services,

(ii) remove any content posted on the Platform

(iii) notify any relevant authority,

(iv) initiate any legal action.

11. Force majeure

Neither Party shall be held liable for any failure or delay in the performance of one or more obligations under the GTC due directly or indirectly to a case of force majeure as defined by Article 1218 of the Civil Code, provided that the Party affected by the force majeure event informs the other Party by email with acknowledgment of receipt within seven (7) days of the occurrence of the force majeure event. It is understood that the User may not invoke force majeure regarding their financial obligations or the inability to use Services that have been paid for in advance.

Performance of obligations under the GTC is suspended for the duration of the force majeure event. However, if the inability to perform or the delay in performance continues for a period exceeding one (1) month from the aforementioned notification, either Party may terminate the GTC with immediate effect by written notice, without either Party being entitled to any compensation.

12. Personal data protection

12.1 Octopush acting as data controller

In the context of the Terms and Conditions, Octopush is required to process certain personal data of the User or the User's employees if the User is a legal entity.

Octopush acts as the data controller for personal data within the meaning of EU Regulation 2016/679 of April 27, 2016 (GDPR) and Law No. 78-17 of January 6, 1978, on Information Technology, Data Files and Civil Liberties (collectively the "Personal Data Regulations") and undertakes to comply with the obligations incumbent upon it in this capacity.

Information regarding the processing of personal data is available on the Platform.

12.2 Octopush acting as a data processor

For certain Services, Octopush may be required to process certain personal data for which the User is the data controller, on behalf of the User.

In such cases, Octopush acts as a data processor within the meaning of the Personal Data Regulations, and the Parties shall enter into a data processing agreement as per Article 28 of the GDPR, which is attached to these Terms and Conditions.

13. Final provisions

13.1 Subcontracting – Assignment

13.1.1 The User acknowledges and accepts that the Services may be subcontracted, in whole or in part, by Octopush, under its responsibility and in compliance with the provisions of Article 12 above.

13.1.2 Neither Party may assign its status as a party to the Terms and Conditions without the prior written consent of the other Party. Any assignment of the status of a party to the Terms and Conditions shall be carried out in accordance with Articles 1216 to 1216-3 of the French Civil Code.

Notwithstanding the foregoing, Octopush may freely assign its status as a party to the Terms and Conditions to any company that controls, is controlled by, or is under common control with Octopush at the time of the assignment, with control defined in accordance with Article L.233-3 of the French Commercial Code.

13.2 Agreement on evidence

The Parties expressly acknowledge that the following shall have the same evidentiary value as an original written document and shall benefit from a presumption of validity: simple letters, faxes, electronic messages exchanged between the Parties in the performance of the Services, postal mail, telephone recordings made by Octopush, and computer logs of operations performed by the User on the Platform.

13.3 Reference

The User authorizes Octopush to use their name and logo as a commercial reference.

13.4 Consequences of contractual non-performance

The Parties expressly agree that the User may not invoke Articles 1219 to 1223 of the French Civil Code against Octopush.

13.5 Severability

If any provision of the Terms and Conditions is held by a court of competent jurisdiction to be unenforceable or invalid, in whole or in part, the remainder of that provision and/or the other clauses of the Terms and Conditions shall remain in full force and effect. In such an event, the Parties shall negotiate in good faith to replace the invalid provision with a valid and enforceable one that reflects as closely as possible their original intent.

13.6 Waiver

Any waiver by one of the Parties to invoke the existence or the total or partial breach of any of the provisions of the GTC, regardless of its duration, shall not constitute a modification or deletion of that provision, nor a waiver by that Party to invoke prior, concurrent, or subsequent breaches of the same or other provisions.

13.7 Survival of Obligations

Obligations intended to survive will remain in force after the termination of the GTC, for any reason whatsoever, and will continue to have effect after its conclusion.

14. Governing Law – Jurisdiction Clause

14.1 The GTC are governed by French law, excluding the provisions of the United Nations Convention on Contracts for the International Sale of Goods (Vienna Convention).

14.2 In the event of a dispute regarding the validity, execution, or interpretation of the GTC, exclusive jurisdiction is granted to the Commercial Court of Marseille, notwithstanding multiple defendants or third-party claims, including for emergency procedures or protective measures in summary proceedings or by petition.

15. Commitment Period and Subscription Renewal Terms

Subscriptions offered by Octopush, including SMS plans and unlimited Email plans, are subject to a minimum commitment period.

1. Commitment Period

All subscriptions are subject to a minimum commitment period of twelve (12) months.

By way of derogation from a strict twelve-month calendar duration, the commitment period is defined as running from the date of subscription until the last day of the eleventh (11th) month following the end of the calendar month in which the subscription was initiated.

For example, a subscription taken out on January 5th commits the Client until December 31st of the same year.

2. Renewal

At the end of the initial commitment period, the subscription is automatically renewed starting from the first day following the end of said period.

The Client may choose the renewal method applicable to their subscription:

• either a monthly renewal,
• or an annual renewal.

In the absence of an explicit choice by the Client, the renewal will be processed according to the terms in effect at the time of subscription or the last renewal.

Any unused prepaid Service credits at the end of a month are automatically rolled over to the following month, with no limit on accumulation during the current Subscription period. However, any balance remaining at the end of the annual Subscription period may not be carried over and will be permanently forfeited, with no possibility of refund or transfer to the next Subscription period.

3. Termination

The Client may request the termination of their subscription at the end of the commitment period, subject to providing notice.

Any termination request must be notified at least thirty (30) days before the end of the commitment period.

If not terminated within this timeframe, the subscription will be automatically renewed for a new period according to the terms defined above.

Termination takes effect on the expiration date of the current subscription, with no refunds provided for the period already committed.

4. Commitment and pricing conditions

Preferential pricing conditions associated with subscriptions, particularly regarding SMS pricing or access to unlimited Email features, are contingent upon compliance with the minimum commitment period defined in this article.

Any early termination or failure to comply with the commitment terms may result in the loss of granted pricing benefits, without prejudice to any other applicable contractual provisions.

Appendix – Personal Data Protection

In this appendix, the terms below have the meanings defined in Regulation (EU) 2016/679 of April 27, 2016 (General Data Protection Regulation, hereinafter the "GDPR" or the "Regulation"):

• Data controller
• Data subject
• Personal data
• Processing
• Data Processor
• Transfer

The performance of the Services involves the Processing of personal data for which the User is the Data Controller. Consequently, Octopush acts as a Data Processor, authorized by the User to perform the Processing on the User's behalf and in compliance with this appendix.

1. Description of Processing

2. Octopush's obligations

2.1 General principles

2.1.1 Octopush's general scope of intervention

Octopush shall process personal data only on documented instructions from the User and in strict compliance with the purpose of the Processing and its characteristics as described in Article 1 above.

Octopush shall immediately inform the User in writing if, in its opinion, an instruction constitutes a violation of the Regulation or other provisions of Union or Member State law relating to personal data protection.

2.1.2 Security

Octopush implements all necessary measures to ensure a level of security appropriate to the personal data in accordance with Articles 28(3)(c) and 32 of the Regulation. Octopush guarantees that these measures ensure the ongoing confidentiality, integrity, availability, and resilience of the systems and the Processing.

Octopush regularly monitors these measures in order to adapt or strengthen them if necessary. These changes must in no way diminish the existing level of security.

Octopush shall not make any copies of personal data without the prior written consent of the User, except for copies necessary for the proper execution of the Processing or to comply with legal or regulatory obligations.

Octopush ensures the confidentiality of the personal data processed. In particular, Octopush ensures that its employees and any other parties authorized to process personal data are bound by a contractual or legal obligation of confidentiality. Octopush ensures that said employees and parties have received the necessary training in personal data protection for the performance of their duties and have access only to the personal data strictly necessary for their tasks.

2.2 Transfer of Personal Data

Octopush may need to use Sub-processors under the conditions set out in Article 2.5 below, which may involve the transfer of personal data to countries outside the European Union and the European Economic Area.

In any event, Octopush guarantees that personal data will benefit from an adequate level of protection, in particular through the use of Standard Contractual Clauses adopted by the European Commission based on Article 46(2) of the GDPR, which will be accompanied by a prior analysis of the applicable legislation in the recipient country and, where necessary, the implementation of supplementary measures.

2.3 Obligation of active cooperation

2.3.1 Informing Data Subjects

The User shall provide Data Subjects with the information required under Articles 13 and 14 of the Regulation, with the assistance of Octopush if necessary.

2.3.2 Rights of Data Subjects and the exercise thereof

Data Subjects have, as defined by the Regulation, a right of access (Article 15 GDPR), a right to rectification (Article 16 GDPR), a right to erasure or "right to be forgotten" (Article 17 GDPR), a right to restriction of processing (Article 18 GDPR), a right to data portability (Article 20 GDPR), and a right to object (Article 21 GDPR).

Octopush shall assist the User in fulfilling their obligation to respond to requests from Data Subjects exercising the rights conferred upon them.

If Octopush receives such a request from a Data Subject, it must immediately forward it to the User.

2.3.3 Personal Data Breach

Octopush shall assist the User in the event of a personal data breach as defined in Article 4(12) of the Regulation.

As soon as it becomes aware of any personal data breach, and no later than thirty-six (36) hours thereafter, Octopush shall notify the User by sending an email to the address provided by the User.

Octopush shall assist and cooperate with the User, to the fullest extent possible, in the implementation of these measures.

2.3.4 Data protection impact assessment

Octopush shall assist the User when it is required to carry out a data protection impact assessment for any planned Processing that is likely to result in a high risk to the rights and freedoms of the Data Subjects.

If necessary or requested by the User, Octopush shall assist the User in consulting the supervisory authority when a data protection impact assessment indicates that the processing would result in a high risk if the Data Controller did not take measures to mitigate the risk.

2.3.5 General information and cooperation obligations

Octopush shall provide the User with all information necessary to demonstrate the User's compliance with its obligations under the Regulation, particularly if the User must justify such compliance or is subject to an investigation by a supervisory authority.

Octopush shall also cooperate with the User if it receives requests for information from a supervisory authority.

Octopush shall immediately inform the User in writing of any investigation or other measure to which it is subject by a supervisory authority or any competent authority, insofar as it concerns the Processing.

2.4 Return of Personal Data

Upon termination of the Contract, for any reason whatsoever, Octopush shall return the Personal Data to the User and destroy all existing copies, unless Octopush is required to retain a copy under European Union law or the law of a Member State. Octopush shall confirm the destruction of the copies to the User in writing.

2.5 Sub-processing

Octopush may engage a subsequent Sub-processor for all or part of the Processing operations carried out under the Contract.

Any subsequent Sub-processor of Octopush and any potential subsequent Sub-processor of an Octopush Sub-processor is bound by a written contract to the same obligations as those stipulated in this article.

Octopush and any subsequent Sub-processor must ensure that their subsequent Sub-processor(s) provide sufficient guarantees, particularly regarding the implementation of technical and organizational measures, to ensure that the Processing meets the requirements of the Regulation.

In any event, Octopush remains fully liable to the User for the performance of its Sub-processors' obligations, particularly in the event of a breach of their obligations regarding the protection of Personal Data.

3. User Obligations

The User agrees to:

• Provide Octopush with the Personal Data subject to the Processing;
• Document its instructions to Octopush in writing and, in particular, confirm any oral instructions in writing without delay;
• Comply with the obligations incumbent upon it as the Data Controller under the Regulation;
• Supervise processing.

Appendix 1 – Technical and organizational measures implemented by the Provider

Octopush implements the following security measures to ensure data protection:

Physical access control

• Access to data hosting infrastructure is secured by the data host, which is ISO 27001 certified.

System access control

• Access to the ISMS is restricted to users authenticated via two-factor authentication.
• All access to the ISMS is logged and retained.

Data access control

• Access to data is restricted to users authenticated via two-factor authentication.
• All access to the ISMS is logged and retained.

Data transmission control

• Data transmission is encrypted end-to-end.

Data entry control

• Data integrity is verified by software during every entry.

Protection against data loss or destruction

• Data is protected against loss or destruction through continuous, secure backups.
• A disaster recovery plan (DRP) is in place to ensure recovery in the event of a general failure.

4. Avis Vérifiés

By accepting this document, the customer acknowledges having been informed that their personal data may be transmitted to the third party Avis Vérifiés for the purpose of collecting their feedback following their order. Avis Vérifiés will use the consumers' personal data solely within the framework of its solution and for the needs of that solution only.
Avis Vérifiés is strictly prohibited from disclosing any personal or nominative information to anyone that would identify the consumer or infringe upon their privacy. The consumer has the right to object to the sharing of this information with Avis Vérifiés by contacting: dpo(at)octopush.com