Data-processing addendum for CyberLouis professional customers.
Last updated: Version 1.1 — September 9, 2026
For personal data entrusted by a customer to provide CyberLouis to its staff, the customer is the controller and GROUPE ALRIC is the processor. This agreement applies for the service term.
Processing covers hosting, authentication, account administration, training, progress monitoring, authorised simulations, support and service security. Its nature includes collection, recording, consultation, organisation, transmission needed to operate the service, retention, and deletion or return at the end of the contract.
GROUPE ALRIC processes data only on documented customer instructions, including for transfers to a third country or international organisation, unless required by applicable European Union or French law. In that case, GROUPE ALRIC informs the customer before processing unless prohibited by law. If an instruction appears to breach applicable law, GROUPE ALRIC promptly informs the customer and may suspend that instruction until clarified.
Authorised personnel are bound by confidentiality. GROUPE ALRIC implements technical and organisational measures appropriate to the risks, including access controls, separation of access, logging and protection of exchanges, adapted to the service and state of the art.
GROUPE ALRIC reasonably assists the customer, taking into account the nature of processing and available information, with data-subject requests, data-protection impact assessments, consultation with the competent authority and applicable security obligations.
Where GROUPE ALRIC becomes aware of a personal-data breach, it notifies the customer without undue delay. To the extent available, the notice states the nature of the breach, the categories and approximate number of affected people and records, likely consequences, measures taken or proposed, and a follow-up contact point.
The customer authorises the providers necessary to operate the service, including those listed in the privacy policy. GROUPE ALRIC contracts with them to impose data-protection duties at least equivalent to those in this agreement.
GROUPE ALRIC remains fully liable to the customer for its subprocessors’ performance of their data-protection obligations.
Before adding or replacing a subprocessor that may process customer data, GROUPE ALRIC notifies the customer by reasonable means. The customer may object on legitimate data-protection grounds within thirty days. The parties will seek a reasonable solution; failing that, the customer may terminate the affected feature before it is implemented, without penalty for that feature.
International transfers are protected by the safeguards required by applicable law. Upon a reasonable request, GROUPE ALRIC provides relevant information about the transfer mechanism used.
At the end of the service, the customer chooses return or deletion of the personal data processed on its behalf. After return, GROUPE ALRIC deletes the data and its existing copies within a reasonable period, unless retention is legally required; retained data remains protected and is not processed for another purpose.
GROUPE ALRIC makes available the information necessary to demonstrate compliance. Once in every twelve-month period, or after a security incident materially affecting customer data, the customer may request a reasonable documentary audit. This frequency does not limit an audit required by applicable law or a competent authority. If the documentary audit does not address an evidenced risk, an on-site or remote inspection may be arranged on reasonable notice, during business hours, without compromising security, other customers’ confidentiality or service operation. The customer bears its own costs and GROUPE ALRIC’s reasonable costs where the audit exceeds regulatory requirements or finds no GROUPE ALRIC breach.
Data subjects: customer representatives, administrators, managers, employees, learners, invited people, targets of authorised simulation campaigns and customer support contacts.
Data categories: professional identity and contact details, account credentials, organisation membership and role, billing data managed on the customer’s behalf where relevant, usage and security data, training progress, answers and scores, authorised simulation results, support messages and technical connection data. The service is not intended to process special categories of data under Article 9 GDPR, or passwords, secrets or payment-card data collected in a simulation.
Purposes: provision, operation, support and security of the platform; account management; training; progress monitoring; authorised simulations; reports and exports requested by the customer. The customer’s obligations and rights are those under the GDPR and the service contract; it is responsible in particular for identifying a lawful basis, informing data subjects and providing lawful instructions.
