General Terms and Conditions of Sale — Google Workspace

LCMH — SARL (limited liability company) with a share capital of €3,000, registered with the Mulhouse Trade and Companies Register under number 512 161 324, with its registered office at 6, rue de Rougemont — 68200 Mulhouse, France, represented by François Rapp, Managing Director.

SIRET: 512 161 324 00011 EU VAT number: FR07512161324

Last updated: 9 June 2026 (v5)

This English version is provided for information purposes. In the event of any discrepancy, the French version prevails.

Article 1 — Purpose

These General Terms and Conditions of Sale (hereinafter the “GTC”) govern the contractual relationship between LCMH, a company registered with the Mulhouse Trade and Companies Register under number 512 161 324 (hereinafter the “Provider”), and any business customer (hereinafter the “Customer”) in connection with the resale of Google Workspace licences.

These GTC apply to the exclusion of any other terms, in particular those of the Customer. They are deemed accepted without reservation by the Customer upon acceptance of the quotation (acting as a purchase order) or, failing that, upon first use of the Services.

The Provider acts as an authorised Google Workspace reseller. The Provider, Google and the Customer are independent contractors; these GTC do not create any mandate, partnership, joint venture or agency relationship between them.

The Google Workspace Services are provided by Google and subject to the Google Cloud Terms of Service (which, since February 2026, incorporate the former Google Workspace terms), available at: https://cloud.google.com/terms/ (hereinafter the “Google ToS”). The Customer accepts the Google ToS, without alteration or amendment, prior to its first log-in to the Service. The Provider does not accept the Google ToS on the Customer’s behalf, except with the Customer’s express authorisation.

These GTC are intended exclusively for business customers. The Customer declares that it acts within the scope of its professional activity.

Article 2 — Services

The Provider provides the Customer with:

• the provision of Google Workspace licences (Business Starter, Business Standard, Business Plus, Enterprise, or any other plan offered by Google);
• provisioning services: activation and initial configuration of the account and domain, creation, modification and deletion of licences and user accounts, order management, at the Customer’s request;
• consolidated monthly billing of the licences;
• first-level support for these administration, provisioning and billing operations, provided on a reasonable-endeavours basis and with no committed response time (SLA) of its own.

Technical support on the functioning of the Services is provided by Google, directly to the Customer, under the terms of the Google ToS and the Google SLA available at https://workspace.google.com/terms/sla/, in particular via the Google support portal (Customer Care Portal). The Provider relays or escalates to Google any requests it cannot resolve.

Service levels (SLA) and availability are the sole responsibility of Google. The remedies provided under the Google SLA constitute the Customer’s sole and exclusive remedy in the event of a failure to meet the SLA; the Customer requests them from the Provider, who passes them through in accordance with the Google SLA.

2.2 — Ownership of the tenant, domain and data

The Customer remains at all times the sole owner of the Google Workspace tenant, of the associated domain name(s), and of all data stored, sent or received via the Services (emails, documents, files, calendars, contacts, etc.).

The Provider acquires no ownership rights over these items. Where the Provider, at the Customer’s request, handles the technical management of the domain or DNS records, it acts solely as a technical service provider on behalf of the Customer, who retains full ownership and may obtain the return or transfer thereof at any time.

2.3 — Services outside the included support

The first-level support defined in Article 2 is included in the price of the licences. Any service beyond this scope (in particular: data migration, advanced configuration, integration project, training, export assistance in the event of reversibility, on-site intervention) is subject to separate billing.

These services are subject to a prior quotation, accepted by the Customer before any work begins. No out-of-scope service is undertaken without the Customer’s prior agreement.

Article 3 — Pricing and price revision

3.1 — Determination of prices

The prices charged to the Customer are set by the Provider and communicated in the quotation. Unless a specific negotiated rate applies, prices correspond to the Google Workspace public prices in force at the time of billing, as published at https://workspace.google.com/pricing.html.

The Customer acknowledges that prices may change in line with Google’s public rates, without this constituting an amendment to these GTC.

Prices are expressed in euros (€) and are exclusive of tax (excl. VAT). Applicable VAT will be added at the rate in force.

3.2 — Price revision

Google reserves the right to modify its rates at any time, with thirty (30) days’ notice in accordance with its ToS (Section 2.6). The impact on the Customer depends on the plan subscribed to:

• Flexible Plan (monthly): the new pricing applies thirty (30) days after Google’s notification. The Customer will be informed at least thirty (30) days before it takes effect. In the event of disagreement, the Customer may terminate the contract in accordance with Article 9.2.

• Annual Plan (12-month commitment): in accordance with Section 2.6(b) of the Google ToS, the new pricing only applies upon renewal of the annual commitment period. During the current commitment period, the initial price remains unchanged. The Customer will be informed of the new pricing at least thirty (30) days before renewal.

In all cases, the prices charged by the Provider may change to reflect Google’s pricing modifications.

3.3 — Discounts

Commercial discounts may be granted to the Customer by the Provider. They are defined contractually and stated in the quotation. Discounts apply to the Google public price and are automatically recalculated in the event of a change in Google’s rates.

3.4 — Specific pricing terms

The pricing terms specific to the Customer are set out in the quotation (acting as a purchase order once accepted by the Customer), which states, for each plan subscribed to:

• the net unit price excl. VAT per licence (after any discount);
• the discount granted (as a percentage or value);
• the commitment term (Flexible monthly Plan or Annual 12-month Plan) and the start date;
• the number of licences initially subscribed.

The accepted quotation forms an integral part of the contract. In the event of any discrepancy on pricing items between the quotation and the body of these GTC, the quotation prevails.

Article 4 — Billing and calculation method

Licences are billed monthly, in arrears.

4.1 — Calculation basis

The number of users billed corresponds to the assigned licences (“seats”) as measured and billed to the Provider by Google in its official reseller billing report, for the billing month concerned. The count is based on licence assignment, regardless of actual use or user log-in. Accounts without an assigned licence (aliases, mailing lists) are not billed.

Depending on the plan subscribed to:

• Flexible Plan (monthly): billing is prorated by the number of assigned licences and their assignment duration during the month (daily count). Any licence added or removed during the month is billed pro rata to the days of effective assignment.
• Annual Plan (12-month commitment): billing covers the number of licences subscribed under the commitment. Licences added during the commitment are billed pro rata until the end of the period.

4.2 — Price and invoice details

The unit price per licence is determined in accordance with Article 3 (net price, discounted where applicable). The amount of each line is equal to the unit price multiplied by the number of licences billed.

Each invoice details: the Google Workspace plan subscribed to; the number of licences; the unit price excl. VAT per licence; the billing period; the total amount excl. VAT, VAT and the amount incl. VAT. Invoices are sent electronically to the Customer’s email address.

Article 5 — Payment

5.1 — Methods

Payment is made by SEPA direct debit (SEPA Direct Debit — CORE scheme). The Customer authorises the Provider to debit the amounts due from the bank account designated in the SEPA direct debit mandate signed by the Customer.

In the absence of SEPA direct debit (mandate not signed or revoked), payment is made by bank transfer to the Provider’s account whose IBAN appears on the invoice. Invoices are then payable upon receipt, i.e. on their issue date.

5.2 — Due date and prior notification

Invoices are payable by SEPA direct debit executed as from their issue date. The transmission of the invoice by email constitutes prior notification of the debit, in accordance with the requirements of the SEPA CORE scheme. The debit is effective on the Customer’s account five (5) calendar days after the invoice is issued (SEPA CORE bank processing time).

This five (5) calendar-day period constitutes the minimum period agreed between the parties.

5.3 — SEPA mandate

Prior to the first debit, the Customer signs a SEPA CORE direct debit mandate authorising the Provider to initiate debits from its bank account.

The Customer may revoke this mandate at any time with its bank, with immediate effect for future debits. Revocation of the SEPA mandate does not, however, terminate the contract: the Customer remains liable to pay the invoices due by another means of payment (bank transfer) and must notify the Provider of its intention to terminate the contract in accordance with Article 9.

5.4 — Dispute

In accordance with the SEPA CORE scheme, the Customer has a right of dispute of eight (8) weeks from the debit date for any authorised debit, and thirteen (13) months for any unauthorised debit.

5.5 — Late payment

In the event of a debit rejection or non-payment, late payment penalties will be applied at the rate provided for in Article L.441-10 of the French Commercial Code (ECB key rate plus 10 percentage points), without any reminder being necessary.

A fixed recovery indemnity of forty (40) euros will be due as of right, in accordance with Article D.441-5 of the French Commercial Code.

The Provider reserves the right to suspend access to the Services in the event of persistent non-payment after formal notice has remained unsuccessful for fifteen (15) days. Any suspension takes place within the limits authorised by Google’s terms.

Good-faith dispute. No suspension of the Services may occur on account of an invoice disputed in good faith by the Customer, provided that the Customer, within fifteen (15) days of receipt of the invoice:

• notifies its dispute in writing (email), setting out the reasons;
• pays the undisputed portion of the invoice without delay.

The disputed portion is subject to an adversarial review and, where applicable, to the amicable remedy provided for in Article 13. This protection does not apply to the undisputed portion, nor to prior unpaid and undisputed invoices, to which this Article 5.5 remains applicable.

5.6 — Bank fees related to the direct debit

Where an incident occurs on a SEPA direct debit due to the Customer, the bank fees actually incurred by the Provider are re-billed to the Customer identically, without mark-up, in addition to the penalties and indemnities provided for in Article 5.5. The Provider only re-bills these fees to the extent they are actually incurred; supporting documentation (bank invoice) is made available to the Customer on request.

1. Debit rejection

Any debit rejection attributable to the Customer (in particular for insufficient funds, closed account, unjustified objection or incorrect IBAN) gives rise to a re-billing of five (5) euros excl. VAT per rejection.

2. Refund request within the eight (8)-week period

In accordance with Article 5.4, the Customer may ask its bank for a refund of an authorised debit within a period of eight (8) weeks. This request, which constitutes the exercise of a legal right of the Customer, nevertheless gives rise to bank fees actually incurred by the Provider, which are re-billed to the Customer at five (5) euros excl. VAT per request, as a reimbursement of cost and not as a penalty.

It is expressly recalled that:

• the refund obtained from the bank does not extinguish the underlying debt: the Customer remains liable to pay the invoice by another means (bank transfer or new debit);
• the re-billing of the bank cost does not affect the Customer’s exercise of its right to a refund, which remains fully preserved.

3. Change to the bank fee schedule

The above amounts reflect the fees charged to the Provider by its bank (Qonto) as at the date hereof. In the event of a change to this fee schedule, the Provider passes on the new amount identically, after prior information to the Customer.

4. Refund beyond the eight (8)-week period

Bank fees related to a refund of an unauthorised debit (beyond the eight-week period, up to thirteen months — Article 5.4) are not re-billed to the Customer: they remain entirely borne by the Provider.

Article 6 — Provider’s obligations

The Provider undertakes to:

• Provide the Google Workspace licences in accordance with the plans subscribed to;
• Provide the provisioning services and first-level support on a reasonable-endeavours basis;
• Inform the Customer of any change to Google’s rates or terms;
• Send the monthly invoices within the time limits provided.

The Provider acts as an intermediary. The Google Workspace Services are provided by Google “as is”, in accordance with the Google ToS. The Provider cannot be held liable for interruptions, malfunctions or modifications of the Services decided by Google.

Article 7 — Customer’s obligations

7.1 — General obligations

The Customer undertakes to:

• Comply with the Google ToS applicable to the Services, which it accepts without alteration prior to its first log-in;
• Provide accurate and up-to-date information for billing and SEPA direct debit;
• Inform the Provider of any change to its bank details or number of users;
• Not use the Services for unlawful purposes or in breach of Google’s Acceptable Use Policy (AUP);
• Authorise the Provider to transmit to Google the information relating to the Customer’s account (“Customer Information”), where applicable when the Provider relays a support request to Google, strictly to the extent necessary to obtain technical support, in accordance with the Google ToS and the applicable confidentiality and data processing terms;
• Provide the necessary notices and obtain the necessary consents from its own End Users to enable the Provider and Google to perform their respective obligations under the contract.

7.2 — Administration accounts and Provider access

The Customer retains at all times control of at least one super administrator account of its Google Workspace organisation. This account is never held or controlled by the Provider.

In accordance with Google’s reseller model, the Provider benefits from reseller access to the Customer’s admin console, intended for licence management and support. The Customer may, at any time and on its own initiative as super administrator, enable or disable this access from the admin console (“Reseller management” section), without affecting its subscriptions or licences.

The Provider only accesses the Customer’s data strictly to the extent necessary to perform its services, under the confidentiality terms provided for in Article 10.

Article 8 — Liability and warranties

8.1 — Limitation of liability

In accordance with the Google ToS (Section 11), Google excludes any express or implied warranty regarding the Services, including warranties of merchantability, fitness for a particular purpose and freedom from error.

The Provider’s total liability under this contract is limited to the amount of the sums actually received from the Customer during the twelve (12) months preceding the event giving rise to liability.

8.2 — Exclusion

The Provider may under no circumstances be held liable for:

• Indirect damage, loss of data, loss of revenue or loss of profit;
• Interruptions or modifications of the Services decided by Google;
• Loss of data resulting from non-compliant use of the Services by the Customer.

Article 9 — Term and termination

9.1 — Term

The term of the contract depends on the Google Workspace plan subscribed to by the Customer, as defined in the quotation:

• Flexible Plan (monthly): the contract is concluded for an indefinite term, tacitly renewed each month.
• Annual Plan (12-month commitment): the contract is concluded for a term of twelve (12) months, tacitly renewed for successive twelve (12)-month periods, unless terminated by either party.

9.2 — Termination — Flexible Plan

The Customer may terminate the contract at any time, subject to thirty (30) days’ notice given by email. The licences remain active until the end of the current billing month.

9.3 — Termination — Annual Plan

The Customer is committed for the duration of the current annual period. Termination takes effect at the end of the annual period, subject to thirty (30) days’ notice before the renewal date.

In the event of early termination by the Customer before the end of the annual period, the remaining monthly instalments until the end of the commitment period remain due, in accordance with Google’s terms (Section 8.2(b) of the Google ToS).

9.4 — Termination by the Provider

The Provider may terminate the contract:

• In the event of persistent non-payment after formal notice has remained unsuccessful for fifteen (15) days;
• In the event of a breach of the Google ToS by the Customer;
• In the event of discontinuation of the Google Workspace reseller programme, with sixty (60) days’ notice.

In the event of cessation of the Provider’s reseller authorisation, and in accordance with the Google programme terms, the Customer benefits from a transition (wind-down) period during which its subscription is maintained to allow it to be transferred to Google directly or to another authorised reseller (Article 9.8), without interruption of the Services. The Provider provides the Customer with reasonable assistance for this transfer.

9.5 — Change of plan

The Customer may request to switch from an Annual Plan to a Flexible Plan (or vice versa) at the end of its current commitment period, subject to thirty (30) days’ notice and the availability of the desired plan from Google.

9.6 — Effects of termination

Upon termination, access to the Services will be disabled in accordance with the Google ToS. The Customer is responsible for backing up its data before the effective termination date. Sums due remain payable.

9.7 — Data reversibility

As the Customer is the sole owner of its data (Article 2.2) and has permanent super administrator access (Article 7.2), it may export all of its data at any time during the term of the contract, using Google’s native tools (Google Takeout, admin console, Google Workspace APIs), without depending on the Provider.

The Provider retains no copy of the Customer’s data. After termination, the retention and then deletion of the data are governed exclusively by Google’s retention policy (Cloud Data Processing Addendum). On written request, the Provider may provide technical export assistance, billed in accordance with Article 2.3 (services outside support).

9.8 — Transfer of the subscription to Google or another reseller

The Customer may at any time, without having to give reasons, transfer its Google Workspace subscriptions to Google directly or to another authorised reseller. The Provider undertakes to facilitate this transfer and not to obstruct it.

• To another reseller: the Customer generates a transfer token from its admin console and communicates it to the recipient reseller. The Provider provides on request any identifier or information necessary for the operation.
• To Google directly: the Provider initiates the transfer from the partner console as soon as possible following the Customer’s written request, and at the latest within five (5) business days.
• The Provider maintains access and service throughout the operation.

In accordance with how Google operates, the transfer affects neither the data nor the availability of the Services. It entails the revocation of the Provider’s reseller access and purchase consent in favour of Google or the new reseller.

The Customer remains liable for all costs charged in respect of the Services (licences and usage) up to the effective date of the transfer, including for the period in progress on that date, calculated pro rata in accordance with Article 4. The transfer does not constitute a retroactive termination and gives rise to no refund of sums due for the period prior to the transfer.

9.9 — Return and removal of the Provider’s access

The Customer may, at any time and on its own initiative as super administrator, disable the Provider’s reseller access from its admin console (“Reseller management” section), without affecting its subscriptions or licences (Article 7.2).

At the latest on the effective date of termination or transfer of the subscription (Article 9.8), or on the Customer’s first request:

• the Provider ceases all access to the Customer’s admin console and accounts;
• any service administration account held by the Provider is disabled or deleted;
• the Provider retains no administration data of the Customer (credentials, settings) beyond what its legal and accounting obligations require (Article 10.2).

On written request from the Customer, the Provider confirms in writing the effective removal of its access.

Article 10 — Protection of personal data

10.1 — Data processed by Google

The processing of personal data stored, sent or received via the Google Workspace Services (emails, documents, calendars, contacts, etc.) is governed by Google’s Cloud Data Processing Addendum, available at: https://cloud.google.com/terms/data-processing-addendum. In this context, Google acts as a processor on behalf of the Customer, who is the controller.

10.2 — Data processed by the Provider (commercial management)

In connection with the commercial management of the contract, the Provider processes, as controller, the following categories of personal data relating to the Customer and its representatives:

Retention period:

• Active data: term of the contract
• Billing and accounting data: ten (10) years after the end of the financial year (legal obligation — Article L.123-22 of the French Commercial Code)
• SEPA mandate: thirteen (13) months after the last debit (SEPA obligation)

10.3 — Customer’s rights

In accordance with the GDPR, the Customer (and its natural-person representatives) has the following rights over its personal data:

• Right of access, rectification and erasure (Articles 15, 16, 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to object on legitimate grounds (Article 21 GDPR)
• Right to lodge a complaint with the CNIL (the French data protection authority — www.cnil.fr)

These rights may be exercised by email at: rgpd@lcmh.fr, accompanied by proof of identity where necessary.

10.4 — Sub-processors

The Provider uses the following sub-processors to perform the contract:

• Google LLC — provision of the Google Workspace Services (further sub-processor, see Google ToS)
• Qonto — processing of SEPA payments (authorised payment institution)
• Google Cloud Platform — hosting of billing systems (European Union)

The Customer is informed of any change of sub-processor affecting the processing of its data.

10.5 — Transfers outside the EU

The Google Workspace Services may involve transfers of data to countries located outside the European Union. These transfers are governed by the Standard Contractual Clauses of the European Commission or any other transfer mechanism validated by the CNIL, as documented in Google’s Cloud Data Processing Addendum.

10.6 — Security

The Provider implements appropriate technical and organisational measures to ensure the security of the personal data it processes: encryption in transit and at rest, access control, regular backups, incident management policy.

In the event of a personal data breach, the Provider notifies the CNIL within 72 hours and informs the affected Customer in accordance with Articles 33 and 34 GDPR.

10.7 — Access to the admin console and confidentiality

The Provider only accesses the Customer’s Google Workspace admin console occasionally and at the Customer’s request, in the context of support, in particular for administration operations such as configuration, the creation or modification of user accounts or the resetting of passwords, this list being non-exhaustive. On such occasions, the Provider acts as a processor of the Customer, the latter remaining the controller within the meaning of the GDPR.

This access is limited to administration data (account identity: surname, professional email address, settings). The Provider does not access the content of the Customer’s communications and data (emails, files, documents) and does not exploit for its own account any information to which it has access. It is bound by strict confidentiality. The Provider only changes or resets the passwords of the Customer’s or its users’ accounts on the Customer’s instruction.

The terms of this processing (purposes, duration, categories of data and persons, security measures, further sub-processors, assistance, fate of the data at the end of the service) are defined in the Data Processing Agreement (DPA) set out in Annex 1 hereto, compliant with Article 28 of the GDPR. In the absence of Provider access to the Customer’s console, this agreement remains without effect.

Article 11 — Intellectual property

The Google Workspace trademarks, logos and names are the exclusive property of Google LLC. The Provider uses them in the context of its activity as an authorised reseller, in accordance with Google’s brand guidelines.

Article 12 — Force majeure

Neither party will be held liable for the non-performance of its obligations in the event of force majeure as defined by Article 1218 of the French Civil Code, including in particular: natural disasters, pandemics, governmental decisions, interruptions of telecommunications networks, or interruptions of the Services by Google.

Article 13 — Governing law and jurisdiction

These GTC are governed by French law.

In the event of a dispute, the parties undertake to seek an amicable solution. To this end, they undertake to attempt business mediation (a free public service accessible via mediateur-des-entreprises.fr) or any other conventional mediator freely chosen. Failing agreement within thirty (30) days, the dispute will be submitted to the Mulhouse Commercial Court, to which the parties grant exclusive jurisdiction, including in the event of multiple defendants, third-party proceedings or urgent proceedings.

Article 14 — General provisions

14.1 — Entire agreement

These GTC, the accepted quotation (acting as a purchase order), the SEPA mandate and Annex 1 (DPA, where applicable) constitute the entire agreement between the parties concerning the resale of Google Workspace licences, and prevail over any other prior document or agreement.

14.2 — No waiver

The fact that the Provider does not exercise a right provided for herein does not constitute a waiver of that right.

14.3 — Severability

If any clause of these GTC is declared null or unenforceable by a competent court, the other clauses remain in force.

14.4 — Assignment

The Customer may not assign the contract, in whole or in part, without the Provider’s prior written consent. The Provider may assign the contract to a third party in the context of a merger, acquisition or transfer of business, after having informed the Customer at least thirty (30) days in advance.

14.5 — Subcontracting

The Provider may subcontract all or part of its obligations, provided that it remains responsible for the proper performance of the contract towards the Customer.

14.6 — Amendment of the GTC

These GTC may be amended by the Provider. Any substantial amendment will be notified to the Customer by email at least thirty (30) days before it takes effect.

Flexible Plan (monthly). Failing acceptance within this period, the Customer may terminate the contract without penalty before the date on which the new GTC take effect.

Annual Plan (12-month commitment). In line with Google’s commitment terms, any substantial amendment only takes effect upon renewal of the current commitment period. During the commitment period, the GTC accepted at subscription and the corresponding payment obligations remain applicable. A Customer who refuses the amendment informs the Provider; the contract then ends at the expiry of the commitment period, without renewal, and the monthly instalments due until that expiry remain payable.

Failing termination or refusal within the applicable time limits, the new GTC are deemed accepted.

The GTC applicable to a given order are those in force on the date of acceptance of the corresponding quotation, subject to any subsequent amendments notified in accordance with this article. Previous versions are archived and available on request.

14.7 — Archiving and evidence

The Provider archives quotations, invoices and SEPA mandates on a reliable and durable medium. In accordance with Article 1366 of the French Civil Code, the electronic record has the same evidential value as the paper record.

14.8 — Notices

Any notice under this contract is made by email to the addresses indicated in the quotation. The parties undertake to keep these details up to date.

This annex applies only when, and to the extent that, the Provider accesses the Customer’s admin console or data in the context of its services (Article 10.7 of the GTC). In the absence of such access, it remains without effect.

1. Purpose, nature and scope of the processing

The Provider processes personal data on behalf of the Customer (controller), for the sole purpose of performing the Google Workspace console administration operations requested by the Customer: configuration, creation, modification and deletion of user accounts, password resets and equivalent administration operations.

The Provider does not access the content of the Customer’s communications and data (emails, files, documents).

2. Duration

The processing takes place on an occasional basis, for each intervention requested by the Customer, and for the term of the contract. It ends upon the cessation of the Provider’s access (Article 9.9 of the GTC).

3. Categories of data and data subjects

• Categories of data: account identification and administration data (surname, first name, professional email address, role, account settings, licence status).
• Categories of persons: the Customer’s End Users holding a Google Workspace account.

Excluded: content data (emails, files, calendars), which the Provider does not access.

4. Provider’s obligations (processor)

In accordance with Article 28(3) of the GDPR, the Provider undertakes to:

• (a) process the personal data only on the Customer’s documented instructions, including for transfers outside the EU, unless required by law (in which case it informs the Customer, unless the law prohibits it);
• (b) not process this data for any purpose other than the performance of its obligations under the contract;
• (c) implement appropriate technical and organisational measures (Article 32 GDPR) to ensure the security of the data and prevent any unauthorised processing, loss, destruction or alteration (Article 10.6 of the GTC);
• (d) ensure that persons authorised to process the data are bound by an appropriate confidentiality obligation;
• (e) not, by act or omission, place the Customer in a situation of breach of the GDPR;
• (f) inform the Customer without delay of any data breach or any unauthorised processing, loss, destruction or alteration of the data;
• (g) not engage any further sub-processor without the Customer’s prior authorisation, and impose on any further sub-processor data protection obligations at least equivalent to those herein;
• (h) taking into account the nature of the processing, assist the Customer through appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data subjects’ rights;
• (i) assist the Customer in ensuring compliance with its obligations regarding security, breach notification, impact assessments (DPIAs) and prior consultation of the supervisory authority, taking into account the nature of the processing and the information available;
• (j) at the Customer’s choice, delete or return all personal data at the end of the service, and destroy existing copies, unless under a legal retention obligation;
• (k) make available to the Customer all information necessary to demonstrate compliance with the obligations of this article, and allow audits to be carried out by the Customer or an auditor mandated by it, under the following conditions: a documentary audit in the first instance, at most once a year (save in the event of a confirmed security incident), with reasonable notice of at least thirty (30) days, at the Customer’s expense and without disproportionate disruption to the Provider’s activity; information obtained in the context of the audit is covered by confidentiality;
• (l) not process the data outside the European Economic Area without implementing a compliance solution within the meaning of Article 44 of the GDPR.

5. Further sub-processors

In the context of this agreement, the Provider uses Google LLC as a further sub-processor (provision and hosting of the Google Workspace Services), under the terms of Google’s Cloud Data Processing Addendum. The Customer is informed thereof and authorises it. Any new further sub-processor will be subject to prior information to the Customer, who may object on legitimate grounds.

6. Fate of the data at the end of the service

Upon the cessation of the Provider’s access (Article 9.9 of the GTC), the Provider retains no administration data of the Customer, subject to the legal retention periods applicable to commercial and accounting management (Article 10.2 of the GTC). The Provider confirms in writing, on the Customer’s request, the effective deletion of the data and access.

7. Governing law and jurisdiction

This agreement is governed by French law. Any dispute relating to its interpretation or performance falls, failing an amicable solution, within the exclusive jurisdiction of the Mulhouse Commercial Court, in accordance with Article 13 of the GTC.

LCMH — François Rapp, Managing Director