Data processing agreement

Processing agreement within the meaning of Article 28 of Regulation (EU) 2016/679, annex to the general terms and conditions of sale of the Onelia platform (DCNG SRL), version 4 of 8 October 2026

This data processing agreement (hereinafter the “Agreement”) forms an integral part of the general terms and conditions of sale (hereinafter the “GTCS”) concluded between DCNG SRL and the Client for the use of the Onelia platform. It governs the processing of personal data which DCNG SRL carries out on behalf of the Client in the context of the supply of the Service. It is accepted by the Client when the account is created, at the same time as the GTCS, and applies throughout the duration of the contractual relationship.

Article 1. Parties and roles

1.1. DCNG SRL, a limited liability company under Belgian law with its registered office at Avenue de l’Abbaye d’Aywiers 25, 1410 Waterloo (Belgium), registered with the Crossroads Bank for Enterprises under number 0780.406.273 (Register of Legal Entities, Walloon Brabant), publisher of the platform marketed under the name Onelia (hereinafter “Onelia” or the “Processor”), acts as processor.

1.2. The Client, a natural or legal person acting exclusively for professional purposes, identified when its account is created (hereinafter the “Client” or the “Controller”), acts as controller in respect of the personal data which it enters, imports or has generated in the Service.

1.3. Where the Client uses the Service as a processor on behalf of a third party, it warrants that it holds the authorisations necessary to entrust the processing to Onelia as a sub-processor and this Agreement applies mutatis mutandis.

Article 2. Definitions

2.1. The terms “personal data”, “processing”, “controller”, “processor”, “recipient”, “data subject”, “personal data breach”, “supervisory authority” and “sub-processor” have the meaning given to them by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).

2.2. The “Service” means the Onelia platform, made up of a mobile application for iOS and Android systems, with offline operation, and a web management portal, allowing in particular the management of customers, jobs, sites, quotations and invoices, including electronic invoicing through the Peppol network, as well as of stock, the calendar and teams.

2.3. The “Client Data” means all personal data processed by Onelia on behalf of the Client in the context of the Service, as described in Annex 1.

2.4. The “Users” means the natural persons to whom the Client grants access to the Service.

2.5. The “Applicable Legislation” means the GDPR, the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and, where applicable, the national data protection provisions applicable to the Client in France or in Luxembourg.

Article 3. Purpose and relationship with the other contractual documents

3.1. The purpose of this Agreement is to define the conditions under which Onelia processes the Client Data on the Client’s behalf, in accordance with Article 28 of the GDPR. It is made up of this body of text, of Annex 1 (description of the processing) and of Annex 2 (technical and organisational security measures).

3.2. Annex 3 (list of sub-processors) is a separate document, to which this Agreement refers and which Onelia keeps up to date outside the body of the Agreement. It is published on a permanent basis at onelia.be/sous-traitants and its updates follow the procedure laid down in Article 9. The version in force on the date of acceptance of this Agreement is deemed to be known to and accepted by the Client. The version of Annex 3 in force on the date of this Agreement is reproduced at the end of the document for information.

3.3. In the event of a conflict between this Agreement and the GTCS or any other contractual document on the protection of personal data, this Agreement prevails. For the remainder, the GTCS remain fully applicable, in particular their provisions on duration, termination and liability. Onelia’s privacy policy constitutes published information and not a contractual document; its updating does not entail any amendment of this Agreement.

3.4. Acceptance of this Agreement by electronic means when the account is created, by the person who declares to be authorised to bind the Client, amounts to acceptance in writing within the meaning of Article 28(9) of the GDPR. Onelia keeps evidence of that acceptance, including the version of the Agreement accepted and the date and time of acceptance, and makes it available to the Client on request.

Article 4. Description of the processing

4.1. The subject matter, the nature, the purpose and the duration of the processing, the categories of data subjects and the categories of personal data processed are described in Annex 1. The Client alone determines the purposes and means of the processing of the Client Data and remains responsible for the lawfulness of the collection of the data which it entrusts to Onelia, for informing the data subjects and for compliance with its own legal obligations, in particular in accounting, tax and electronic invoicing matters.

4.2. The Client undertakes not to enter into the Service any special categories of personal data within the meaning of Article 9 of the GDPR, nor any data relating to criminal convictions and offences within the meaning of Article 10 thereof, the Service not being designed for that purpose. The Client shall in particular ensure that photographs, sketches and site notes are limited to what is necessary to document the work carried out.

Article 5. Documented instructions of the Controller

5.1. Onelia processes the Client Data only on documented instructions from the Client, including with regard to transfers of personal data to a third country or to an international organisation, unless it is required to do so by European Union law or by the law of a Member State to which it is subject. In that case, Onelia informs the Client of that legal requirement before the processing, unless the law concerned prohibits such information on important grounds of public interest.

5.2. The following constitute documented instructions of the Client: the GTCS, this Agreement, the configuration of the Service by the Client and its Users, and any use of the functions of the Service in accordance with its documentation. Any further instruction is to be sent in writing to privacy@dcng.be. Onelia may refuse an instruction which goes beyond the functions of the Service or which would give rise to an additional cost, failing agreement on the arrangements for and the remuneration of its implementation.

5.3. Onelia immediately informs the Client if, in its view, an instruction infringes the GDPR or other European Union or national data protection provisions. Onelia may then suspend the carrying out of the instruction concerned until the Client confirms or amends it.

5.4. Onelia does not use the Client Data for its own purposes. It does not sell them, does not rent them, does not analyse them for commercial purposes and does not use them to train or improve artificial intelligence models, whether its own or those of third parties. The usage statistics and the technical telemetry of the Service are designed so as not to contain personal data.

Article 6. Export functions and recipients chosen by the Client

6.1. The Service makes available to the Client and its Users functions allowing Client Data to be transmitted to recipients which the Client itself chooses, in particular the sending of documents by email, the export of data and the subscription of an external calendar to the schedule kept in the Service.

6.2. As regards the calendar subscription, the Service makes a calendar file available behind an address containing a secret, which the User communicates to the calendar software of its choice. It is that software which reads the file; Onelia sends no data on its own initiative to the provider concerned and has no contractual relationship with it. The activation of this function by the Client or by one of its Users constitutes a documented instruction of the Client within the meaning of Article 5.

6.3. The calendar providers thus called upon, as well as any other recipient to which the Client chooses to send Client Data by means of the Service, act towards the Client as recipients and, as the case may be, as separate controllers or as processors of the Client. They are not sub-processors of Onelia and do not appear in Annex 3. It is for the Client to have a legal basis for that communication, to inform the data subjects in accordance with Articles 13 and 14 of the GDPR, to check the terms of the provider chosen, including the location of the data and any transfers outside the European Union, and to frame that communication where this is required.

6.4. Onelia informs the User, within the interface, of the nature of the data exposed by the subscription link, of the strictly personal character of that link and of the possibility of revoking it at any time. Onelia is not responsible for the processing carried out by the recipient chosen, nor for the consequences of a disclosure of the link by the User.

Article 7. Confidentiality of authorised persons

7.1. Onelia ensures that the persons authorised to process the Client Data, including its director, any staff and the providers acting under its responsibility, have undertaken to respect the confidentiality of those data or are under an appropriate statutory obligation of confidentiality, and process those data only to the extent necessary for the performance of the Service.

7.2. Onelia’s access to the Client Data is limited to maintenance, support and security operations. Onelia’s administration accounts with its hosting providers and its providers are protected by two factor authentication, applied directly or through an account which is itself protected in that way. Those accesses are traced by the logs kept by the hosting providers and providers concerned.

Article 8. Security of the processing

8.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of data subjects, Onelia implements the appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. Those measures are described in Annex 2. They include in particular the strict isolation of each Client’s data at the level of the database engine, the encryption of data in transit and at rest, the provision of two factor authentication which each User may activate, the management of access by roles and capabilities, daily backups encrypted before they leave the hosting infrastructure and automated monitoring with alerts.

8.2. Onelia may develop those measures to take account of changes in techniques and risks, provided that the overall level of security is not thereby reduced. The Client remains responsible for the security of its own environment, in particular for the management of its Users’ access, for the named character of the accounts, for the strength of passwords, for the activation of two factor authentication by its Users, for the security of the mobile devices on which the application is installed, for the control of the calendar subscription links and for the revocation of the access of Users who leave its organisation.

Article 9. Sub-processors

9.1 General authorisation

The Client gives Onelia general authorisation to engage sub-processors for the carrying out of specific processing activities in the context of the Service, in accordance with Article 28(2) of the GDPR. The sub-processors authorised on the date of acceptance of this Agreement are those appearing in the version of Annex 3 in force on that date.

9.2 Versioned list and publication

Annex 3 states, for each sub-processor, its identity, its role, the categories of data concerned, the place of processing and, where applicable, the transfer mechanism which applies. It is published on a permanent basis, with the date of its version, at onelia.be/sous-traitants. In accordance with Article 3.2, that list is not incorporated into the body of this Agreement: its updates, made in accordance with the procedure in Article 9.3, do not entail any amendment of the Agreement, the text of which remains unchanged, and call for no new acceptance by the Client.

9.3 Prior information and right to object

Onelia informs the Client of any intended addition or replacement of a sub-processor at least fifteen calendar days before that sub-processor begins to process Client Data. That information is given through two cumulative channels: the sending of an email to the administrator of the Client’s account, together with the updated version of Annex 3, and the dated publication of that version at onelia.be/sous-traitants. The Client undertakes to keep the email address of its administrator up to date.

The Client may, within that period of fifteen days, object to the intended change on reasonable and documented grounds relating to the protection of personal data, by sending its objection in writing to privacy@dcng.be. Failing an objection within that period, the change is deemed to be accepted. In the event of an objection, the parties confer in good faith in order to find a solution. If no reasonable solution can be found within thirty days from the objection, the Client may terminate the part of the Service which requires recourse to the contested sub-processor, or the whole of the Service if it cannot be supplied without that sub-processor, on written notice and without compensation for termination, the sums paid in advance for the period after termination being refunded pro rata.

The replacement of a sub-processor which becomes urgently necessary as a result of a security incident or of the failure of a provider may take place without observing the period of fifteen days; Onelia then informs the Client without delay and the right to object is exercised within fifteen days from that information.

9.4 Obligations imposed on sub-processors

Onelia imposes on each sub-processor, by contract or by another legal act under European Union law or the law of a Member State, the same data protection obligations as those set out in this Agreement, in particular the obligation to provide sufficient guarantees as to the implementation of appropriate technical and organisational measures. Where a sub-processor fails to fulfil its obligations, Onelia remains fully liable to the Client for the performance by that sub-processor of its obligations.

Certain sub-processors themselves have recourse to providers. Onelia ensures that its sub-processors publish or communicate to it the list of those providers and inform it of the changes made to it. The references to those lists appear in Annex 3.

Article 10. Location of the data and transfers outside the European Union

10.1. The Client Data are hosted and processed by default within the European Union. Onelia does not transfer Client Data to a third country or to an international organisation, and does not allow such a transfer by a sub-processor, save in the cases identified in Annex 3 and in compliance with Chapter V of the GDPR.

10.2. Where a transfer to a third country not covered by an adequacy decision of the European Commission is necessary, Onelia ensures that it is based on appropriate safeguards within the meaning of Article 46 of the GDPR, in particular the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914, supplemented, where the assessment of the level of protection in the country of destination so requires, by additional measures. Transfers to organisations established in the United States of America and certified under the EU-US Data Privacy Framework are based on the adequacy decision of the European Commission of 10 July 2023, without prejudice to the standard contractual clauses concluded in the alternative. Onelia keeps available to the Client, on request, a copy of the safeguards which apply and of the transfer impact assessments it has carried out.

10.3. The Client instructs Onelia to carry out the transfers identified in Annex 3 under the conditions described therein. If a transfer safeguard ceases to be valid, Onelia informs the Client and implements, within a reasonable period, an alternative safeguard or a processing solution within the European Union.

10.4. The communications which the Client itself makes to recipients of its choice, under the conditions of Article 6, do not fall within this Article; it is for the Client to assess their consequences in the light of Chapter V of the GDPR.

Article 11. Assistance in complying with the rights of data subjects

11.1. Taking into account the nature of the processing, Onelia assists the Client, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests made to it by data subjects with a view to exercising their rights laid down in Chapter III of the GDPR.

11.2. To that end, the Service makes available to the Client’s authorised Users self service functions allowing in particular the consultation and rectification of the data of an end customer, the export of the entire file of an end customer in a structured and commonly used format, and the erasure of the data of an end customer by anonymisation, that last operation erasing the identity of the person throughout the Service while preserving, in frozen form, the documents which the Client is required to retain by a legal obligation, in accordance with Article 17(3)(b) of the GDPR. Erasure is reserved to Users holding the administrator role of the Client.

11.3. If a data subject addresses a request relating to Client Data directly to Onelia, Onelia does not reply on the substance, unless instructed otherwise by the Client, and forwards the request to the Client within five working days, inviting the data subject to contact the Client. Onelia provides the Client, on request and as far as possible, with the further assistance necessary for the performance of its obligations; that assistance may give rise to reasonable remuneration where it goes beyond the use of the functions of the Service.

Article 12. Assistance with security, impact assessment and prior consultation

12.1. Onelia assists the Client in ensuring compliance with the obligations laid down in Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to it. It provides the Client in particular, on request, with the information relating to the security measures implemented, to the sub-processors and to the transfers which is necessary for carrying out a data protection impact assessment or a prior consultation of the supervisory authority.

12.2. Onelia maintains a record of the categories of processing activities carried out on behalf of the Client, in accordance with Article 30(2) of the GDPR, and cooperates, on request, with the competent supervisory authority in the performance of its tasks.

Article 13. Personal data breaches

13.1. Onelia notifies the Client of any personal data breach affecting the Client Data as soon as possible and at the latest forty-eight hours after becoming aware of it. The notification is sent by email to the administrator of the Client’s account and contains, in so far as that information is available, a description of the nature of the breach, the categories and approximate number of data subjects and of records concerned, the likely consequences of the breach, the measures taken or proposed in order to address it and to mitigate its effects, as well as the point of contact from which further information may be obtained. Where that information cannot be provided at the same time, it is communicated in phases without undue delay.

13.2. That notification enables the Client, where applicable, to notify the breach to the competent supervisory authority within the period of seventy-two hours laid down in Article 33 of the GDPR and to inform the data subjects in accordance with Article 34 of the GDPR. Onelia documents any breach, its effects and the measures taken to remedy it in an internal register of breaches, and cooperates with the Client in the investigation and the remediation. The notification of a breach by Onelia does not constitute an acknowledgement of liability.

Article 14. Duration of the processing, retrieval and erasure of the data

14.1. Onelia processes the Client Data during the trial period and throughout the duration of the contract concluded with the Client. During that period, the Client has at all times, on a self service basis and without any intervention by Onelia, a function for the complete export of its data, comprising all the tables and files together with a completeness manifest, in a structured, commonly used and machine readable format.

14.2. On expiry or termination of the contract, on whatever ground, or at the end of a trial period not followed by a subscription, the Client has a period of ninety calendar days during which access to the Service is maintained on a read only basis for the purpose of exporting its data (hereinafter the “Retrieval Period”). The Client is solely responsible for retrieving its data during that period and for archiving, for the legal period applicable to it in Belgium, in France or in Luxembourg, its books, invoices and supporting documents, including the structured electronic invoices issued through the Service. Onelia assumes no legal archiving obligation on behalf of the Client, either during or after the Retrieval Period.

14.3. At the end of the Retrieval Period, Onelia deletes all the Client Data from its production systems within thirty calendar days, and then from its backups at the end of their rotation cycle, which does not exceed ninety days. The retrieval exports placed in the dedicated download area are deleted automatically seven days after they are generated. Onelia issues to the Client, on written request made within the three months following the end of the contract, a certificate of deletion.

14.4. By way of exception, Onelia may retain the Client Data beyond those periods only to the extent that European Union law or the law of a Member State so requires, for the duration and for the purposes laid down by that law, together with the data strictly necessary to prove the performance of the contract and to defend its rights, those last data falling within Onelia’s own responsibility as described in its privacy policy.

Article 15. Information and audit

15.1. Onelia makes available to the Client all the information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR. To that end it provides, on written request, the documentation of its security measures, the available reports or certifications of its sub-processors and the answers to a reasonable security and compliance questionnaire, at most once a year, save where a supervisory authority so requests or where a data breach affecting the Client occurs.

15.2. If that information is not sufficient to demonstrate compliance with Onelia’s obligations, the Client, or an independent auditor which it has mandated and which is bound by an obligation of confidentiality, may carry out an audit, including an inspection, on thirty days’ written notice, during business hours, at most once a year and under conditions preserving the security of the Service, the confidentiality of the data of Onelia’s other clients and the continuity of its activities. The audit may not cover the infrastructures of the sub-processors, for which the certifications and reports of third parties serve as verification. The reasonable costs incurred by Onelia on the occasion of an audit are borne by the Client, unless the audit reveals a substantial failure by Onelia to comply with this Agreement. The findings of the audit are communicated to Onelia, which remedies the shortcomings identified without undue delay.

Article 16. Liability

16.1. Each party is liable for the damage caused by processing which does not comply with the GDPR under the conditions laid down in Article 82 of the GDPR. Onelia is held liable for the damage caused by the processing only where it has not complied with the obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the lawful instructions of the Client. The limitations and exclusions of liability laid down in the GTCS apply to this Agreement to the extent permitted by the applicable law, without prejudice to the right of data subjects to obtain compensation.

16.2. The Client indemnifies Onelia against any claim, penalty or judgment resulting from the Client’s failure to comply with its obligations as controller, in particular as regards the lawfulness of the collection of the Client Data, the information of the data subjects, the entry of data which are not authorised within the meaning of Article 4 and the communications which it makes to recipients of its choice within the meaning of Article 6.

Article 17. Amendment of the Agreement

17.1. Onelia may amend this Agreement where changes in the Applicable Legislation, in the guidelines of the European Data Protection Board or of the Data Protection Authority, or in the characteristics of the Service so require. Any amendment is notified to the Client by email at least thirty days before it enters into force. If the amendment reduces the level of protection of the Client Data, the Client may terminate the contract without indemnity before the date of entry into force.

17.2. The updates of Annex 3 follow the procedure in Article 9 and do not constitute an amendment of this Agreement.

Article 18. Final provisions, applicable law and jurisdiction

18.1. This Agreement enters into force on the date of its acceptance by the Client and remains in force for as long as Onelia processes Client Data, including during the Retrieval Period and until the complete deletion of the data. The obligations of confidentiality and of deletion survive the end of the contract. If one of the provisions of this Agreement is declared void or unenforceable, the other provisions retain their full effect and the parties shall replace the provision concerned by a valid provision of equivalent effect.

18.2. This Agreement is governed by Belgian law, without prejudice to the mandatory provisions of the Applicable Legislation to the Client. Any dispute relating to its validity, its interpretation or its performance falls within the exclusive jurisdiction of the courts and tribunals of the judicial district of Walloon Brabant, without prejudice to the powers of the supervisory authorities and to the right of data subjects to lodge a complaint or to seek a judicial remedy in accordance with Articles 77 to 79 of the GDPR.

18.3. This Agreement is drawn up in French. In the event of translation, the French version prevails.

Annex 1: description of the processing

1. Subject matter and nature of the processing

Hosting, storage, synchronisation, including offline, organisation, consultation, modification, extraction, transmission by email, by notification and through the Peppol network, provision of a calendar file under the conditions of Article 6, backup, retrieval and erasure of the Client Data, by means of the Onelia mobile application and web portal, together with the maintenance, support and security operations connected with them.

2. Purpose of the processing

To allow the Client to manage its professional activity: management of its customers and contacts, planning of jobs and sites, preparation and monitoring of quotations, work orders, invoices and credit notes, electronic invoicing, monitoring of payments and reminders, management of stock, of the calendar and of its teams.

3. Duration of the processing

The duration of the contract concluded between the Client and Onelia, extended by the Retrieval Period and by the deletion periods laid down in Article 14 of the Agreement.

4. Categories of data subjects

The Users of the Client, namely the manager, the office staff and the field team members; the end customers of the Client, whether natural persons or contact persons within legal persons; the suppliers, providers and other third parties whose contact details are entered by the Client; the persons whose image or property appears incidentally on site photographs and sketches.

5. Categories of personal data

The Service is not intended for the processing of special categories of personal data within the meaning of Article 9 of the GDPR, nor of data relating to criminal convictions and offences. The Client undertakes not to enter any such data, in accordance with Article 4 of the Agreement.

The identification data of the Client’s legal representative communicated when electronic invoicing is activated are not processed by Onelia: they are supplied directly by the legal representative to the Peppol network access point provider, which carries out that verification for its own obligations. Onelia receives only the result of the verification.

Annex 2: technical and organisational security measures

The measures below describe the security arrangements implemented by Onelia at the date of this version. They may change in accordance with Article 8 of the Agreement.

1. Isolation of the data between clients

Every database query is confined to the data of the Client concerned by security rules applied at the level of the database engine, and not by a mere application convention. That isolation is tested on a regular basis. On the mobile application, the local database is tied to a single User and purged automatically when the account is changed on the device.

2. Encryption

The communications between the applications, the web portal and the infrastructure are encrypted in transit. The data are encrypted at rest with the main hosting provider. The backups of the database and of the files are encrypted by Onelia before they leave the hosting infrastructure, including the file names, so that the backup storage provider has access only to encrypted content.

3. Access control and authentication

The authentication of Users is based on an email address and a password. Two factor authentication based on a temporary code is offered to all Users; its activation is a matter for the choice of each User and is not tied to any particular operation. Where a User has activated it, it is requested at each connection. Rights are allocated by role, namely administrator, user and read only, and by delegated capabilities. The aggregated financial data, the payments received and the reminders are reserved to Users holding the corresponding capability, that restriction being applied down to the synchronisation layer, so that those data are not transmitted to the devices of Users who are not authorised. The files are stored in private areas and accessible only through signed links of limited duration. Onelia’s administration accounts with its hosting providers and providers are protected by two factor authentication and limited to what is strictly necessary.

4. Backups and continuity

The database is the subject of a daily encrypted backup, retained on a rolling cycle of ninety days. The files deleted are retained for ninety days in an encrypted and dated recycle bin, then purged automatically. The deletion of the main entities by Users at application level goes through a restorable recycle bin; certain data, in particular the appointments and the photographs, are deleted definitively as soon as they are deleted at application level, subject only to the copy contained in the backups during their rotation cycle. The retrieval exports are placed in a dedicated area, accessible through a link of limited duration and purged automatically after seven days.

5. Monitoring, logging and incident management

The state of the components and the freshness of the backups are the subject of automated daily monitoring with alerts by email, supplemented by a weekly signal of proper operation intended to detect silent failures. The availability of the platform is measured by an external probe which receives only an operating status. The technical error reports are configured so as to contain no personal data. The error messages presented to Users disclose no technical detail. Onelia applies an internal procedure for the management of data breaches allowing notification to the Client within the period laid down in Article 13 of the Agreement and maintains a register of breaches.

6. Hosting and location

The data are hosted by default within the European Union: Ireland region for the database, the authentication and the storage of the files, European Union jurisdiction for the backups and the exports, and France for the web portal and the website. The exceptions and the framework which applies to them appear in Annex 3.

7. Organisational measures

The infrastructure secrets are kept in a dedicated vault and isolated by platform; they never appear in the code. The persons acting for Onelia are bound by an obligation of confidentiality. The sub-processors are selected on the basis of their contractual guarantees and of their certifications and are bound by a data processing agreement. Onelia maintains a record of the processing carried out on behalf of its clients and documents its transfer impact assessments.

8. Built in data protection functions

The Service incorporates functions allowing the Client to discharge its responsibilities: export of the complete file of an end customer, erasure by anonymisation preserving the documents of legal value, complete self service export of the account with a completeness manifest, management of the access of Users, and information of the User on the scope of the calendar subscription link with the possibility of immediate revocation.

Annex 3: list of sub-processors

It is published on a permanent basis, with the date of its version, at onelia.be/sous-traitants.