LenKore data processing agreement.

1. The parties and acceptance

Controller: the holder of the LenKore account who uses a tool for their business (“you”).

Processor: GO TO AGENCY (GTA), a French simplified joint-stock company (SAS) with a share capital of €1,000, RCS Dijon 944 980 762, 9 rue Jean-Jacques Rousseau, 21000 Dijon, France. Contact: contact@lenkli.com.

You accept this agreement by creating your LenKore account, or the first time you open a tool if your account existed before. We keep the version and date of your acceptance.

2. What we process for you

Subject matter and duration: providing the tools you use, for the whole life of your account.

• Lenkli: the clicks and scans of your links and QR codes, the emails your pages collect, reviews, and the measurement tools you add to your pages. Detailed sheet: lenkli.com/dpa.
• Calenkli: your guests’ bookings (name, email, phone, answers, payments, deposits, card kept, packs, polls, waiting lists, reminders, reviews). Detailed sheet: calenkli.com/dpa.
• Datalenk: the measurement of your sites (visits, sources, events, linked sales), the identification you send, A/B tests, and the Stripe and Search Console connections you set up. Detailed sheet: datalenk.com/dpa.

Each sheet gives the tool’s data, data subjects and retention periods. Where the tool allows it, you choose a shorter period in its settings.

3. Your instructions

We only process your data on your written instructions: this agreement, the terms of use and your settings in each tool. If an instruction seems to us to breach the GDPR, we tell you immediately.

4. Links between tools

When you use several LenKore tools with the same account, you instruct us to pass from one tool to another, for your account only, the data these features need: Calenkli bookings and payments, clicks and emails collected by Lenkli (addresses replaced by a hash), to your Datalenk sales; purchases seen by Datalenk, to your Calenkli guests. This data does not leave your account and only serves you. You can turn off each link in the tool’s settings.

5. AI assistants

Connecting a third-party assistant is an instruction from you; you choose its publisher. What the assistant reads in your tools is sent to that publisher (for example Anthropic for Claude, OpenAI for ChatGPT), which processes it under its own terms, sometimes outside the European Union. You can remove its access at any time.

6. Confidentiality

The people authorised to process your data have committed to confidentiality.

7. Security

We take measures suited to the risk: encrypted exchanges (HTTPS), hashed passwords, two-factor authentication available, team access limited to what is strictly needed, data separated by account, servers and databases in the European Union. Each tool’s sheet details its own measures.

8. Sub-processors

You authorise us to use the sub-processors on the shared list of the LenKore tools: lenkore.com/subprocessors. We impose on each sub-processor, by contract, the same obligations as in this agreement.

We email you at least 30 days before adding or replacing a sub-processor. You can object on data protection grounds; failing a solution, you can cancel at no cost and export your data.

9. Data subjects’ rights

We help you, through the tools’ features (view, export) and on simple request, to answer people who exercise their rights. We pass on to you without delay the requests we receive about them.

10. Assistance and data breaches

We assist you, with the information available to us, with security, data breaches, impact assessments and prior consultation of the supervisory authority.

Data breach: if a breach affects your data, we tell you without undue delay after becoming aware of it, with what we know (nature, data and people concerned, measures taken), so you can report it to the authority within 72 hours if it presents a risk.

11. Transfers outside the European Union

Your data is stored in the European Union. Some sub-processors are based in the United States: transfers are covered by the EU-U.S. adequacy decision of 10 July 2023 for certified companies, otherwise by the European Commission’s standard contractual clauses. Details, sub-processor by sub-processor: lenkore.com/subprocessors.

12. End of the contract

Before closing a tool or your account, you can export your data. Then we delete it according to the tool’s sheet, except what the law requires us to keep.

13. Audits

We give you the information needed to demonstrate compliance with this agreement. We allow audits, including on-site inspections, by you or an auditor you appoint, at most once a year (except after a data breach), with 30 days’ notice, at your expense and under a confidentiality undertaking. We answer first with questionnaires and documents.