Data Processing Agreement (DPA)

This English version is provided for information only. The French text prevails in the event of a dispute.

This Data Processing Agreement ("DPA") supplements the Terms of Sales and governs, in accordance with article 28 of the GDPR, the processing of personal data that Zyre ("the Processor") carries out on behalf of its customer ("the Controller") within the Service. It applies automatically to any subscription, without separate signature, and prevails over any contrary provision of the ToS regarding data protection.

1. Subject matter, nature and purpose of the processing

Zyre processes on behalf of the Customer the technical data generated by the traffic of the websites the Customer has placed under protection. The processing operations carried out are:

• Real-time filtering of HTTP requests (web application firewall: detection of SQL injections, XSS, directory traversal, attack tools);
• Logging of detected threats (collection, recording, retention, consultation by the Customer, erasure);
• Blocking of IP addresses identified as malicious (automatic or on the Customer's manual instruction);
• Aggregation of traffic statistics (hourly counts, without retention of individual requests).

The exclusive purpose is securing the Customer's sites (legitimate interest of network and information security, recital 49 of the GDPR). Zyre never reuses this data for its own account, does not cross-reference it between customers, and does not use it for any commercial, advertising or profiling purpose.

2. Categories of data and data subjects

• Data subjects: visitors of the websites protected by the Customer.
• Categories of data: IP address, country of origin (derived from the IP), user-agent, path and method of HTTP requests, timestamp, type of detected threat.
• No sensitive data within the meaning of article 9 of the GDPR is intentionally collected. The content of request bodies is inspected in memory for threat detection but is not retained; only the detection pattern is logged.

3. Duration of processing and retention

This DPA applies throughout the duration of the subscription. Retention periods are applied automatically by daily purge:

• Threat logs: 7 to 365 days depending on the subscribed plan (Starter: 7 days, Pro: 30 days, Agency: 90 days, Enterprise: 365 days).
• Automatically blocked IPs: 6 months by default; the Customer can configure this duration (7 days, 30 days, 3 months, 6 months or 1 year) from their dashboard. This setting constitutes a documented instruction within the meaning of article 28.
• Manual blocking rules: kept as long as the Customer maintains them; they are at their sole discretion.
• Aggregated traffic statistics: 13 months (no individual data).

Suspension and relaying period. Where protection is suspended (section 5.3 of the Terms of Sales), Zyre stops filtering and stops recording any new threat log: no personal data of visitors is collected any longer for that purpose. However, Zyre keeps relaying traffic to the Customer's servers, which constitutes a transit of IP addresses and therefore a processing operation. This DPA accordingly remains applicable for as long as relaying continues, and not only for the duration of the subscription. During that period the only processing operations carried out are the transit of requests and aggregated hourly counting, with no retention of individual requests. Data collected before the suspension keeps being purged under the retention periods above.

4. Zyre's obligations (processor)

Zyre undertakes to:

• process the data only for the purpose described above and on the Customer's documented instruction, materialized by the configuration of the Service (adding/removing domains, filtering rules, retention periods, whitelists/blacklists);
• inform the Customer if, in Zyre's opinion, an instruction constitutes a violation of the GDPR;
• ensure that the persons authorized to process the data are subject to a contractual confidentiality obligation;
• implement the technical and organizational measures described in the Annex (article 32 GDPR);
• assist the Customer, through appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights (access, erasure, objection) that reach it, in particular via the search and deletion of log entries on request;
• assist the Customer with its obligations under articles 32 to 36 of the GDPR (security, breach notification, impact assessment), taking into account the nature of the processing and the information available to Zyre;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting its data, providing the nature of the breach, the categories and approximate volume of data and data subjects concerned, the likely consequences and the measures taken, so as to enable the Customer to make its own notification to the supervisory authority within the 72-hour deadline (article 33 GDPR);
• delete all data processed on behalf of the Customer upon termination of the subscription or deletion of the account, with effective deletion in the database and caches (Redis), not mere archiving. The Customer can export their data before deletion;
• make available to the Customer all information necessary to demonstrate compliance with this agreement, and allow audits to be carried out, limited to one audit per year, remotely, subject to 30 days' written notice, at the Customer's expense, without access to the data of Zyre's other customers;
• keep a record of the categories of processing activities carried out on behalf of the Customer (article 30.2 GDPR).

5. Sub-processors

The Customer generally authorizes the use of the sub-processors listed in the Privacy Policy ("Recipients and processors" section). The data of visitors to protected sites only transits through Zyre's hosting infrastructure, located in Switzerland — a third country covered by an adequacy decision of the European Commission, reviewed and confirmed on 15 January 2024, which allows transfers from the European Union without additional safeguards. It is transmitted neither to Stripe, nor Brevo, nor OpenAI, nor Google, and is subject to no transfer to a country that is not covered by an adequacy decision.

Zyre will inform the Customer of any plan to add or replace a sub-processor affecting this data, by email, at least 30 days in advance. The Customer may object in writing; in case of objection, its sole remedy is the termination of the subscription before the change takes effect, without penalty. Zyre imposes on any sub-processor the same data protection obligations as those of this DPA and remains fully liable to the Customer for their performance.

6. Customer's obligations (controller)

• The Customer warrants that it has a legal basis for processing the data of visitors to its sites (typically the legitimate interest of security, recital 49 of the GDPR) and has carried out, where applicable, the required assessments.
• The Customer undertakes to mention Zyre in the privacy policy of its protected sites, as a processor responsible for security, and to inform visitors of the processing of their IP address for security purposes.
• The Customer warrants that it owns the domains placed under protection or has the express authorization of their owner (see ToS).
• The Customer is solely responsible for the blocking rules it creates manually (choice of IPs, retention duration) and for the configuration of retention periods, which constitute its processing instructions.
• The Customer handles requests to exercise rights from visitors of its sites; Zyre provides assistance in accordance with article 4 of this DPA.

7. Liability

The liability of each party under this DPA is governed by article 82 of the GDPR: Zyre is only liable for damage caused by the processing where it has not complied with the GDPR obligations specifically incumbent on processors, or where it has acted outside the Customer's lawful instructions or contrary to them. The liability caps set out in the ToS apply to this DPA, except in case of gross or intentional misconduct.

8. Annex: technical and organizational measures (article 32 GDPR)

Measures actually implemented by Zyre on the infrastructure processing the Customer's data:

• Encryption in transit: TLS on all communications (auto-renewing Let's Encrypt certificates).
• Multi-tenant partitioning: all data is scoped by organization in the database; a customer's blocking lists never affect the sites of other customers (Redis keys isolated per organization).
• Access control: JWT authentication with token-version revocation, two-factor authentication (TOTP with secret encrypted at rest, or email code), differentiated roles (owner, admin, member, viewer), double CSRF protection on mutations.
• Password hashing: bcrypt (cost factor 12); no plaintext retention.
• Application hardening: exclusively parameterized SQL queries, 30 s server timeout on any database query, per-IP rate limiting with memory eviction, read/write timeouts against slowloris attacks, validation of X-Forwarded-For headers limited to trusted proxies.
• Logging and traceability: audit log of all sensitive actions (kept 12 months), token-protected Prometheus monitoring.
• Minimization and automatic purge: daily purges applying the durations of article 3 without human intervention; inspected request bodies are never retained.
• Secrets management: application secrets outside the source code (environment variables), separate keys per use (JWT, MFA encryption, challenge, proxy), rotation in case of suspected compromise.
• Continuity and incident: graceful shutdown with draining of in-flight requests, internal data breach response procedure with CNIL notification within 72 h and information of affected customers without undue delay.
• Location: hosting and caches (PostgreSQL, Redis) exclusively in Switzerland, a country covered by an adequacy decision of the European Commission.

9. Contact

For any question relating to this DPA, to data protection or to request the assistance provided for in article 4: dpo@zyre.fr.