Data Processing Addendum (DPA)

1. DEFINITIONS

• "Personal Data" means any information relating to an identified or identifiable natural person processed within Orsana.
• "Processing" means any operation performed on data, including generating text, storing prompts, or similar operations.
• "Sub-processor" means any third party, including AI model providers or hosting services, appointed by Orsana to process data.

2. SUBJECT MATTER AND DURATION

Processor shall process Personal Data only to provide the AI content generation services for LinkedIn and LinkedIn as requested by the Controller. The duration of processing is the term of the active subscription.

3. CONTROLLER OBLIGATIONS (THE USER)

The Controller, meaning the User, represents and warrants that:

• they have a legal basis, including consent or legitimate interest, to process any data they input into Orsana or pull from LinkedIn or LinkedIn;
• they will not input highly sensitive data, such as health, biometric, or criminal records, into the AI tool;
• they are responsible for the accuracy and legality of the generated outputs they choose to publish.

4. PROCESSOR OBLIGATIONS (ORSANA)

Orsana shall process data only on the documented instructions of the User, for example when clicking "Generate".

5. SUB-PROCESSORS

The Controller grants a general authorization to Orsana to engage Sub-processors, including AI providers or hosting services. Orsana shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors via its website or email. If the Controller does not agree with such change, the subscription may be terminated with a 30 day notice.

6. DATA BREACH NOTIFICATION

In the event of a confirmed personal data breach affecting the Controller's data, Orsana shall notify the Controller without undue delay and provide reasonable cooperation to help the Controller meet their reporting obligations under GDPR.

7. DELETION OF DATA

Upon termination of the subscription, Orsana shall delete or return the User Content within 30 days, unless French or European Union law requires the continued storage of the data.