Data Processing Agreement

01Important notice

This document is a working draft and summary template. A full, legally binding DPA must be prepared and validated by a qualified legal professional before customer execution. This template does not constitute legal advice.

02Roles

The Customer is the data controller: it determines the purposes and means of processing the personal data present in its directory (Microsoft Entra ID or Google Workspace).

RingSync is the data processor: it processes personal data only on the documented instructions of the Customer, as set out in the Terms of Service and this DPA.

03Subject matter and nature of processing

Subject matter: the provision of the directory synchronisation service described in the Terms of Service.

Nature of processing: reading directory data from the Customer's directory provider via API; proxying (streaming) contact records to enrolled employees' devices; storing synchronisation metadata (job records, per-contact action logs by Entra Object ID).

Critical point — no contact storage: RingSync does not store directory contact field values (names, email addresses, phone numbers, photos, job titles) on its servers. These data points exist only in the Customer's directory and on employees' devices.

Duration of processing: for the term of the Customer's subscription, plus the applicable retention grace period after termination (see Terms of Service §Billing).

04Categories of data subjects and data

Data subjects: employees, contractors, and other individuals whose accounts are present in the Customer's directory and within the configured synchronisation scope.

Categories of personal data proxied (not stored by RingSync): given name, surname, work email address, work phone number(s), mobile phone number, job title, department, company name, profile photo.

Categories of personal data stored by RingSync: Entra Object IDs (internal Microsoft identifiers, not directly visible to end users) in sync logs; mobile user email address and display name; push notification tokens.

Special categories of data (Art. 9 GDPR): the standard synchronisation service does not process special categories of data. If the Customer's directory contains special category data, the Customer is responsible for ensuring it is excluded from the synchronisation scope or that a valid legal basis under Art. 9 exists.

05Customer instructions

RingSync shall process personal data only on the documented instructions of the Customer. The Customer's instructions are: (a) synchronise the directory data within the configured scope to enrolled employees' devices; (b) apply the configured group filters and exclusions; (c) perform selective wipe when deprovisioning events occur.

If RingSync is required by applicable law to process data beyond these instructions, it will inform the Customer to the extent permitted by law.

06Sub-processors

RingSync uses the sub-processors listed in the Privacy Policy at /legal/privacy. The current list is also available on request via /contact.

RingSync will inform the Customer of any intended changes to the sub-processor list with at least {{À VALIDER : délai — 30 jours recommandé}} prior notice, giving the Customer the opportunity to object.

{{À VALIDER : mécanisme contractuel avec les sous-traitants — SCCs, clauses de traitement de données}}.

07Security measures

RingSync shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in the Security page at /legal/security.

{{À VALIDER : article 32 RGPD — liste précise des mesures techniques et organisationnelles à annexer}}.

08Assistance with data subject rights

RingSync shall assist the Customer in fulfilling its obligations to respond to data subject rights requests, taking into account the nature of the processing.

Note: as RingSync does not store directory contact records, erasure and access requests in relation to contact data must be addressed by the Customer through its directory provider (Microsoft Entra ID or Google Workspace) and directly on the employee's device. RingSync can provide assistance for data stored by RingSync (sync metadata, mobile user data) upon request.

09Personal data breach notification

RingSync shall notify the Customer without undue delay and within {{À VALIDER : délai — 72 heures recommandé}} of becoming aware of a personal data breach affecting Customer data. The notification will include available information as set out in Art. 33(3) GDPR.

10Return and deletion of data

Upon termination of the subscription, RingSync will delete or return all personal data processed on behalf of the Customer, in accordance with the retention schedule set out in the Terms of Service.

{{À VALIDER : modalités de restitution — format, délai, procédure de certification de suppression}}.

11Audits and inspections

RingSync shall make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, and shall allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer.

{{À VALIDER : modalités pratiques d'audit — préavis, périmètre, fréquence, coût}}.