Data Processing Addendum

The School is the data controller for the personal data it records or generates on the Platform. MSB acts as processor on its behalf.

MSB is the controller, on its own account, of the processing relating to the business relationship, invoicing and account security described in the Privacy Policy. This addendum does not apply to that processing.

Care information may reveal health data about a pupil. The School decides whether to record it, limits it to what is necessary for the child’s safety during transport and restricts access to it to the roles that need it.

MSB processes the data only on the School’s documented instructions. The Contract, the configuration of the Space and the operations performed by authorised Users constitute these instructions. The School may give further instructions in writing, within the limits of the Platform’s features.

MSB informs the School if, in its opinion, an instruction infringes applicable law. It does not use the data for its own purposes, except for the statistics provided for in Article 18 of the Terms of Service, compiled from data dissociated from any identity, for which MSB acts as data controller.

MSB ensures that the persons authorised to process the data are bound by an obligation of confidentiality and access it only to the extent necessary for their duties.

Access by an MSB support agent to the School’s Space requires a personal authorisation limited to sixty (60) minutes, and every access is logged.

MSB implements and maintains the following measures:

• hosting of the data in Amazon Web Services data centres located in France;
• encryption of communications between the Apps, the Console and the servers;
• isolation of each School’s data by access rules enforced by the database itself;
• access control through roles and permissions defined by the School;
• passwords of at least 12 characters combining upper and lower case letters, digits and symbols; two-factor authentication mandatory for MSB staff and available to School users;
• storage of photographs and voice messages in private storage, accessible only through temporary links;
• rate limiting of requests and sign-in attempts;
• logging of sensitive operations in an audit log;
• automated backups, retained for thirty (30) days;
• storage of technical secrets in a dedicated vault.

MSB may change these measures, provided that the overall level of security is not reduced.

The School authorises MSB to engage the following sub-processors:

Maps are displayed using Google Maps Platform: the User’s device obtains map tiles directly from Google, which receives the necessary technical data and, when an address is searched in the Console, the text of that address, without any other data about the pupil. Google processes this data under its own terms.

MSB informs the School of any addition or replacement of a sub-processor at least thirty (30) days in advance, by e-mail or in the Console. The School may object on legitimate grounds relating to data protection. If no solution is found, it may terminate the Services concerned; MSB then refunds the portion of the amounts paid in advance for the remaining period.

MSB imposes on its sub-processors data protection obligations equivalent to those of this addendum and remains liable to the School for their performance.

The data is hosted in France. Messaging and notification services may involve processing in other countries, limited to the data needed to deliver the messages.

MSB completes with the National Commission for the Control of the Protection of Personal Data (CNDP) the formalities incumbent upon it for its own processing (in progress). The School completes those incumbent upon it as data controller, including for the transfer of the data to the host; to that end, MSB provides it with a description of the processing, the security measures and the location of the data.

The Platform allows the School to view, correct, export and delete the data it has recorded — a deleted person is archived, then their identity erased, under the conditions of section 9 of the Privacy Policy — and to erase a family’s exchanges with the School at that family’s request. Parents can obtain a copy of their exchanges themselves from their app.

MSB forwards to the School, within two (2) working days, any request from a data subject that it receives directly, without responding to it itself unless instructed by the School. It assists the School, as far as possible, in responding to requests that cannot be handled through the Platform, within time limits compatible with those that Law No. 09-08 imposes on the School, in particular the ten clear days that apply to rectifications.

MSB provides the School with the information it needs to assess the risks of the processing and for its dealings with the CNDP.

MSB notifies the School of any breach of security leading to the accidental or unlawful destruction, loss, alteration, disclosure of, or unauthorised access to, data processed on its behalf, without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it.

The notification describes, to the extent known, the nature of the breach, the categories and approximate number of persons and records concerned, its likely consequences and the measures taken or proposed. MSB supplements this information as it becomes available and promptly takes the measures needed to limit the effects of the breach.

When the Contract ends, the School may request an export of its data within thirty (30) days. MSB keeps the data for five (5) years after the end of the Contract, then deletes from its production systems the data that identifies individuals, the messages and the files, and dissociates from any identity the attendance, trips and positions, which it keeps under the conditions of Article 18 of the Terms of Service. Deleted data disappears from backups at the end of their thirty (30) day retention period.

MSB confirms the deletion in writing at the School’s request. This does not apply to data that MSB must retain by law, in particular accounting records relating to the Contract.

MSB makes available to the School the information necessary to demonstrate compliance with this addendum.

The School may have an audit carried out once a year by an independent auditor bound by professional secrecy, on thirty (30) days’ written notice. The audit is conducted at the School’s expense, without disrupting the operation of the Platform and without access to other Schools’ data or to information whose disclosure would compromise the security of the Platform.

The School warrants that the data it entrusts to MSB is processed lawfully. To that end, it:

• has a legal basis for each processing operation and obtains the required consents;
• informs the persons concerned, in particular of the location tracking of vehicles and of Crew phones during trips;
• records only the data that is necessary, in particular as regards care information;
• assigns its Users’ roles according to their needs and promptly removes access that is no longer required;
• completes the formalities incumbent upon it with the CNDP, in particular the applications for authorisation relating to location tracking and to care information, which cover the retention periods provided for in Article 2.

Each party’s liability under this addendum is governed by Article 21 of the Terms of Service.

This addendum applies for the entire term of the Contract and until the data has been deleted under Article 10.