BonTrava

Data processing (GDPR)

The article 28 agreement: what the publisher does with your clients' data, and who else can reach it.

Translated from the French. Where the language versions differ, the French text prevails.

Dernière mise à jour : 2026-09-24

Configuration incomplète : companyName, address, bce, vat, email. Renseignez les variables LEGAL_* avant la mise en ligne.

Parties and roles

You, the account holder, are the controller. the publisher is the processor. This agreement is part of the terms and conditions and applies from the opening of the account, without a separate signature.

Subject matter, duration, nature

  • Subject matter: hosting and processing the data needed to write, sign and send work orders.
  • Duration: that of the account, plus 30 days.
  • Data subjects: your clients, their contacts, your technicians.
  • Categories of data: identity and contact details, site addresses, content of the interventions, photos, handwritten signatures. The service asks for no special category of data within the meaning of article 9.

Instructions

The publisher processes this data only on your documented instructions — using the service is one — and for no purpose of its own. It tells you if it considers an instruction to infringe the GDPR.

Confidentiality and security

The people authorised to access the data are bound by confidentiality. The technical measures are those described in the privacy policy: separation per company, encryption in transit, sign-in without a password, virus scanning of files, encrypted backups.

Sub-processors

You give general authorisation for the sub-processors listed below. Any addition is announced to you before it goes into service, and you may object by terminating free of charge.

  • Hetzner Online GmbH — Hosting of the application, the database and the files. (Germany / Finland (EU))
  • Fournisseur SMTP de l'éditeur — Sending transactional email: sign-in codes, orders sent to clients. (European Union)

Assistance

  • Data subject rights: export and deletion are available from the application; for the rest, the publisher assists you within a reasonable time.
  • Data breach: notification without undue delay after becoming aware of it, with what you need for your own notification to the Data Protection Authority.
  • Impact assessment: the necessary technical information is made available on request.

Fate of the data at the end

At the end of the contract the data is erased within 30 days, save a legal retention obligation. A full export remains possible during that period, from the settings and without the publisher's involvement.

Audit

The publisher makes available the information needed to demonstrate compliance with this article and submits to a reasonable, announced audit at your expense, without the audit being able to affect the confidentiality of other clients' data.