Data Processing Agreement

Version 2026-10-24 — Last updated: October 24, 2026

Article 28 of Regulation (EU) 2016/679 (GDPR) — supplements Section 11 of the Terms

This Data Processing Agreement (the “DPA”) forms part of the Terms of Service of jenvoie (the “Terms”) between Gravity5, a French simplified joint-stock company (société par actions simplifiée) with variable share capital of €150, registered with the RCS Créteil 931 799 860, with its registered office at 6bis, rue Jean Mermoz, 94450 Limeil-Brévannes, France, represented by its President, Mr Yohann MEPA (the “Processor” or “Gravity5”), and the business that accepted the Terms, including by installing the jenvoie app for Shopify (the “Controller” or the “Merchant”). Capitalised terms not defined here have the meaning given in the Terms.

1. Roles

For the personal data (“Personal Data”) of the participants in the Merchant’s games (“Players”) and of the Merchant’s contacts and email recipients, including its store’s customers (“Contacts”), processed through jenvoie (the “Service”), the Merchant is the controller and Gravity5 is the processor. Gravity5 processes that data only on the Merchant’s documented instructions, which are: the Terms and this DPA, the settings and actions the Merchant performs in the Service (directly, through the API or through an AI assistant connected via MCP with the Merchant’s credentials), and any specific written request. Gravity5 informs the Merchant if, in its opinion, an instruction infringes data protection law.

2. Description of the processing

Subject matter and nature: Hosting the Merchant’s promotional games, recording entries, determining and certifying results, issuing discount codes in the Merchant’s Shopify store, storing contacts, sending emails and producing statistics.
Purposes: Allowing the Merchant to run promotional games, manage its contacts and send newsletters to the contacts who consented.
Categories of data subjects: Players of the Merchant’s games; the Merchant’s contacts and newsletter recipients.
Categories of data: Email address and the other form fields chosen by the Merchant (e.g. first name, phone number, answers, predictions); marketing and open-tracking consent choices with their date; play records (date, language, result, prize, discount code, user agent, certificate reference); email activity (sends, delivery, bounces, unsubscribes, complaints, clicks, opens unless opted out).
Special categories: None. The Merchant must not collect data covered by articles 9 or 10 GDPR through the Service.
Duration: The term of the Terms, plus the deletion period described in Section 9.

3. Processor’s obligations

process the data only on the Merchant’s documented instructions, including with regard to transfers outside the EU;
ensure that the persons authorised to process the data are bound by confidentiality;
implement the security measures described in Annex 2 (article 32 GDPR);
assist the Merchant, taking into account the nature of the processing, in answering data subjects’ requests and in complying with articles 32 to 36 GDPR;
make available the information necessary to demonstrate compliance with this DPA.

4. Controller’s obligations

have a valid legal basis for each processing, in particular the prior, free, specific, informed and unambiguous consent of each Player to receive marketing emails, collected through the game’s consent checkbox (never pre-ticked);
inform the data subjects as required by articles 13 and 14 GDPR, including about open tracking and how to opt out of it;
publish the rules of its games and remain responsible for its prizes;
not import lists collected without valid consent;
answer the data subjects’ requests, with the Processor’s assistance where needed.

5. Data subjects’ rights and Shopify privacy webhooks

The Service lets the Merchant view, export (CSV), modify and delete contacts. Every newsletter contains an unsubscribe link and every email carrying an open-tracking pixel contains an opt-out link. In addition, the Processor handles Shopify’s mandatory privacy webhooks:

customers/data_request: the Processor identifies the data it holds about the customer for the store and sends it to the Merchant as a file, by email to the store’s address;
customers/redact: the Processor deletes the customer’s contact record, form answers and email history and anonymises their plays;
shop/redact (received 48 hours after uninstallation): the Processor deletes the personal data of all the store’s Players and Contacts and the store’s access credentials.

Where a data subject contacts the Processor directly, the Processor forwards the request to the Merchant without undue delay and does not answer it itself unless instructed to.

6. Personal data breaches

The Processor notifies the Merchant of any personal data breach without undue delay and at the latest within seventy-two (72) hours after becoming aware of it, with the information available on its nature, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. Information that is not available immediately is provided as it becomes available. The Merchant remains in charge of notifying the supervisory authority and the data subjects where required.

7. Subprocessors

The Merchant gives the Processor a general authorisation to engage the subprocessors listed in Annex 1. The Processor informs the Merchant of any intended addition or replacement at least thirty (30) days in advance; the Merchant may object on reasonable data protection grounds and, failing an agreed solution, terminate the Terms without penalty by uninstalling the App. The Processor imposes on each subprocessor, by written contract, data protection obligations equivalent to those of this DPA and remains liable to the Merchant for their performance.

8. Transfers outside the European Union

The Players’ and Contacts’ data is hosted in the European Union (Germany) and emails are sent from the Processor’s own mail servers (mail.jenvoie.fr) in the European Union. Where a subprocessor located outside the EU is involved, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses (Decision 2021/914).

9. Deletion at the end of the Terms

The Merchant can export its contacts at any time before uninstalling. When the App is uninstalled, the Processor stops displaying the Merchant’s games immediately and, upon the shop/redact webhook sent by Shopify 48 hours later, permanently deletes the Personal Data of the Merchant’s Players and Contacts; play records are kept only in anonymised form for statistics. For direct customers who close their account, deletion takes place at the end of a thirty (30) day period during which they may ask for an export. Residual copies in encrypted backups disappear as the backups rotate. Data that the law requires the Processor to keep is excluded. The Processor provides a deletion statement upon written request.

10. Audits

The Processor answers reasonable written requests for information, primarily by providing this documentation and answers to a standard security questionnaire. The Merchant may, at its own expense, with at least thirty (30) days’ notice and no more than once a year (except after a proven breach), carry out an audit limited to this DPA, during business hours, without disrupting the Service and respecting the confidentiality of other customers.

11. Liability, precedence and governing law

Each party is liable for damage caused by its breach of this DPA or of the GDPR under article 82 GDPR; otherwise, the limitations of the Terms apply, to the extent permitted by law. In case of conflict between the Terms and this DPA on data protection matters, this DPA prevails. This DPA is governed by French law and disputes are settled as provided in the Terms. It is accepted together with the Terms, as provided in their preamble (checkbox when creating an account on jenvoie.fr, checkbox and confirmation button when first opening the App, or approval of a quote), and the Processor keeps a record of that acceptance (account identifier or store domain, date and time, version accepted).

Annex 1 — Subprocessors

List as of October 24, 2026.

Hetzner Online GmbH: Hosting of servers, databases, backups and of the Processor’s mail servers — Germany (EU) — all data — no transfer.
Shopify: For Shopify merchants: platform on which the App runs; delivers the privacy webhooks and stores the discount codes created by the App in the Merchant’s store — under Shopify’s terms.
OpenAI: Optional AI translation of game texts written by the Merchant — United States — no Player or Contact data — DPF / SCC.
Stripe: Payment of direct (non-Shopify) customers — EU and United States — the customer’s billing data only, never Players or Contacts — DPF / SCC.

Emails are delivered by the Processor’s own mail infrastructure (mail.jenvoie.fr), hosted in the European Union; no third-party emailing provider is involved.

Annex 2 — Security measures

Infrastructure: ISO 27001-certified data centres (Hetzner, Germany), firewalls and minimal exposed ports, regular updates, monitoring and alerting, encrypted daily backups stored separately.
Communications: TLS 1.2 minimum everywhere, HTTPS with security headers, SPF, DKIM and DMARC on sending domains, HMAC verification of every Shopify webhook.
Stored data: logical separation between merchant accounts, hashed passwords, login codes and API keys, per-play secret values allowing certificates to be unlinked from Players on erasure.
Access control: individual administrator accounts, least privilege, logging of administrative access, immediate revocation when a person leaves.
Application security: input validation, protection against injections (SQL, XSS, CSRF), rate limiting on sensitive endpoints, dependency monitoring.
Email hygiene: unsubscribe link in every newsletter, automatic and permanent suppression of unsubscribed and bouncing addresses, open-tracking opt-out, bot filtering of opens and clicks, automatic pausing of campaigns with abnormal bounce or complaint rates.
Organisation: confidentiality undertakings, incident management procedure, register of processing activities as a processor (article 30(2) GDPR), recovery time objective of 24 hours for critical services.