Data Processing Addendum
Version 1.2 · July 2, 2026
1. Parties
This Data Processing Addendum ("DPA") forms part of the agreement between MCS (French company registered under SIREN 106 942 600, R.C.S. Nantes, EU identification number FR4401.106942600, 5Q Avenue des Naudières, 44800 Saint-Herblain, France) operating PlaceRankFlow ("Processor") and the customer who has accepted the Terms of Service ("Controller").
2. Scope and roles
The Controller determines the purposes and means of personal data submitted to the service. The Processor processes that data only to provide the contracted PlaceRankFlow service and as instructed by the Controller.
3. Subject matter of processing
The Processor processes on behalf of the Controller: Google account identifiers, Business Profile content, scheduled posts, review content and operational logs, for the duration of the subscription.
4. Processor obligations
The Processor shall:
- Process personal data only on documented instructions from the Controller.
- Ensure authorised personnel are bound by confidentiality.
- Implement appropriate technical and organisational security measures (see Section 5).
- Assist the Controller in responding to data subject rights requests.
- Notify the Controller of a personal data breach within 72 hours of becoming aware of it.
- Delete or return all personal data upon termination, at the Controller's election.
- Make available information necessary to demonstrate compliance and support audits.
5. Security measures
- TLS 1.2+ for all data in transit.
- AES-GCM encryption for Google OAuth refresh tokens at rest.
- Access controls restricted to authorised personnel with audit logging.
- Scoped OAuth — only the permissions required by the service are requested.
- Automated retention jobs and documented deletion procedures.
- Incident response procedures with 72-hour breach notification target.
6. Sub-processors
The Controller authorises the use of the following sub-processors:
| Sub-processor | Role | Transfer mechanism |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, CDN | Standard Contractual Clauses |
| Google LLC | Identity, Business Profile APIs | Standard Contractual Clauses |
| Resend, Inc. | Transactional email | Standard Contractual Clauses |
| Stripe, Inc. | Payment processing | Standard Contractual Clauses |
The Processor will notify the Controller at least 30 days before adding or replacing a sub-processor, giving the Controller the opportunity to object.
7. International transfers
Where personal data is transferred outside the European Economic Area, the Processor ensures an adequate level of protection through Standard Contractual Clauses adopted by the European Commission.
8. Governing law
This DPA is governed by French law and is subject to GDPR as implemented in French law (Loi Informatique et Libertés). Disputes are subject to the exclusive jurisdiction of the courts of Nantes, France.
9. Contact
To request a countersigned copy, a list of current sub-processors, or to exercise audit rights:
[email protected]
MCS, 5Q Avenue des Naudières, 44800 Saint-Herblain, France