DPA - Data Processing Agreement

This DPA is an integral part of the contract between Navinspire IA (processor) and the Client (data controller). It governs the processing of personal data carried out in the context of using Lynara.

1 PURPOSE

Governs the processing of personal data performed by Navinspire IA on behalf of the Client via Lynara.

2 ROLES

• Client : Data controller
• Navinspire IA : Processor

Processing performed only on documented instructions.

3 DATA & PURPOSES

Nature of data

• Identities & HR Data
• Commercial & financial data
• PDF/Excel/Image documents
• Customer emails
• AI prompts & outputs

No sensitive data unless voluntarily provided.

Authorized purposes

• Service provision
• Execution of AI, RAG, OCR, CRM, HR modules
• Infrastructure maintenance
• Platform security

5 SECURITY MEASURES

• AES-256 & TLS 1.2+ encryption
• Supabase HA + replication (AWS Europe)
• Multi-tenant isolation (RLS)
• OCR on Google Document AI Europe
• Anti-prompt injection AI
• Audit, logging, Grafana Monitoring

6 TRANSFERS & SUBCONTRACTING

Transfers Outside EU

Possible only via Standard Contractual Clauses (SCC) or compliant providers (Google, OpenAI, AWS...). Client controls AI BYOK location.

Approved subcontractors

Supabase (AWS EU), Google Cloud (EU), AWS, Redis, Grafana Labs, OpenRouter, SendGrid/Mailersend.

Data breach

Detection, immediate containment, Client notification without delay, CNIL notification < 72h, final report.

Contract termination

Deletion or return of data (30-day retention period).

Audit

Client can audit Navinspire. Provision of technical evidence, certificates and logs.