ADN Soft and the GDPR

This page explains how ADN SOFT S.A.S. approaches the EU General Data Protection Regulation (GDPR) and the UK GDPR when we process personal data of individuals located in the European Economic Area or the United Kingdom, whether as controller or as processor on behalf of a client.

Our role

We act as controller for data of website visitors, prospects, candidates and business contacts. We act as processor when we build or operate software for a client and, in the course of that work, access personal data of that client's end users.

Data processing agreement

For every project involving personal data we execute a Data Processing Agreement (DPA) covering the elements of GDPR Article 28: subject matter and duration, nature and purpose, categories of data and data subjects, processor obligations, sub-processor regime, assistance to the controller and the fate of data on termination. Request it at dpo@adnsoftsas.com.

International transfers

Where data leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK Addendum, accompanied by a transfer impact assessment where the case requires it.

Sub-processors

We work with a small number of infrastructure and tooling providers. We maintain an up-to-date sub-processor list available to our clients and commit to giving reasonable advance notice of any addition or replacement, allowing the client to object.

Technical and organisational measures

We apply encryption in transit and at rest, least-privilege access control with two-factor authentication, environment segregation, activity logging, backups with restore testing, code review, vulnerability management and regular team training in data protection and secure development.

Breach notification

We operate an incident management procedure. Acting as processor, we notify the controller without undue delay after becoming aware of a breach, with the information available so they can meet their own 72-hour notification duty under Article 33.

Data subject rights

We assist our clients in handling requests for access, rectification, erasure, restriction, objection and portability. If you are a data subject and do not know which company controls your data, write to dpo@adnsoftsas.com and we will point you to the right contact.

Contact

Data Protection Officer: dpo@adnsoftsas.com. For GDPR-related requests, put "GDPR" in the subject line along with the right you wish to exercise.