Data Processing Agreement (DPA)

Version 1.0 – 25 October 2026

This agreement is part of the MCPilot Terms of service between the customer ("Controller") and Salah Eddine Jari EI – Martech, Rue des Etats Unis, 77300 Fontainebleau ("Processor"). It applies whenever the Processor processes personal data on the Controller's behalf, as required by article 28 of the GDPR (Regulation (EU) 2016/679).

1. Subject, duration, nature and purpose

• Subject: giving the Controller's authorised users read-only access to the Controller's Oracle Eloqua data from AI assistants they choose.
• Duration: as long as the Controller's account exists, plus the deletion period in section 9.
• Nature: retrieval of data from Eloqua at a user's request, transmission to the user's AI assistant, logging of requests, storage of a structural map of the Eloqua instance.
• Purpose: providing the service described in the Terms. No other purpose.

2. Data and people concerned

• People: the Controller's Eloqua users who connect, and the people recorded in the Controller's Eloqua (contacts, prospects, customers, website visitors).
• Data: user identity (name, user name, email, Eloqua user ID); Eloqua records as requested (e.g. contact details, company, activities, form submissions, custom object records); request logs; names and structure of Eloqua assets.
• Sensitive data: not intended. The Controller must not ask the service for special-category data unless it has a legal basis to process it this way.

Eloqua record contents are transmitted, not stored, except data the user includes in a request, which is kept in the activity log for 30 days.

3. Instructions

The Processor processes personal data only on the Controller's documented instructions, which are these terms and the Controller's use and settings of the service. The Processor informs the Controller if an instruction appears to breach the GDPR.

4. Confidentiality

Everyone authorised to process the data is bound by confidentiality.

5. Security

The Processor applies the measures in Annex 1 and keeps them up to date.

6. Subprocessors

The Controller authorises the subprocessors in Annex 2. The Processor gives at least 30 days' notice by email of a new subprocessor; the Controller may object on reasonable grounds and, failing agreement, cancel without penalty. The Processor imposes the same data protection obligations on its subprocessors and remains responsible for them.

7. Help with rights and obligations

The Processor helps the Controller, as far as reasonably possible, to answer requests from data subjects, and with security, breach notification, impact assessments and prior consultation (GDPR articles 32 to 36).

8. Personal data breaches

The Processor notifies the Controller without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting the Controller's data, with the information available to help the Controller meet its own obligations.

9. End of the service

The Processor deletes the Controller's personal data 30 days after the account's trial or subscription ends, or earlier on the Controller's request (backups expire within a further 30 days), unless the law requires keeping it. On request before closure, the Processor provides the Controller's activity log in a common format (CSV).

10. Audits

The Processor makes available the information needed to show compliance with this agreement and allows reasonable audits, at most once a year, with 30 days' notice, at the Controller's cost, without access to other customers' data.

11. Transfers outside the EU

Data is hosted in the EU. Any transfer outside the EU by a subprocessor relies on an adequacy decision or standard contractual clauses. Data sent to the AI assistant chosen by the Controller is outside this agreement: that provider acts under its own agreement with the Controller.

Annex 1 – Security measures

• Hosting in Microsoft Azure, EU region (France Central); provider certified ISO 27001 / SOC 2.
• Encryption in transit (HTTPS, TLS 1.2+, HSTS) and at rest; Eloqua tokens additionally encrypted (AES-256-GCM) with a key held in Azure Key Vault, separate from the database.
• Read-only access to Eloqua: only GET requests; each user acts with their own Eloqua login and permissions.
• Access control: the Controller's administrators approve, block and remove users; access is checked on every request; AI app connections can be revoked by the user or administrators.
• Our own sign-in tokens are stored hashed, expire (1 hour access, 30 days refresh) and rotate.
• A person's stored Eloqua sign-in is removed after 90 days without use; they sign in to Eloqua again next time.
• Activity log of every request, available to the Controller's administrators; kept 30 days.
• Daily backups, kept 30 days, encrypted at rest.
• Administrative access to the infrastructure limited to the Processor, with multi-factor authentication; deployments without stored passwords (OIDC).
• Security headers, CSRF protection, rate limits on sign-in endpoints.

Annex 2 – Subprocessors