1. DESCRIPTION OF THE SERVICES

Extract-It is a web hosted application connected to SAP Concur that allows to extract expenses and associated receipts. Extract-It application main features:

• Search expenses and receipts by queries
• Save queries for future use
• Display receipts
• Extract expense and receipts to a PDF or a ZIP

2. APPLICABLE LAW

This Contract is governed by the French law, and the General Data Protection Regulation (EU 2016/679) (GDPR) regarding data privacy. In the event of a dispute, and after attempts to reach an amicable solution, jurisdiction is assigned to the Paris Commercial Court (Tribunal de Commerce).

3. DATA PRIVACY

A. PURPOSE

In the course of the performance of the Services, ARAGO Consulting will have access to or will be provided by the Client, its affiliated companies, subsidiaries and holding company, with certain Personal Data which the Supplier will need to process on behalf of the Client as specified in the description of the Services. The purpose of this data processing is to provide to the Client with an integrated reporting tool based on SAP Concur existing data.

B. DEFINITIONS

The following terms have the following meanings when used in this Terms of Service: Data Protection Laws means the General Data Protection Regulation (EU 2016/679) (GDPR), the Directive on privacy and electronic communications (2002/58/EC) and any other applicable laws, including any implementing national laws, any regulatory requirements, guidance and codes of practice applicable to the processing or Personal Data (as amended or replaced from time to time) in the various countries involved in the Services. Personal Data, Process or Processing, Data Subjects, Data Controller (or Controller) and Data Processor (or Processor) have the meaning given to those terms under Data Protection Laws.

C. DATA COLLECTION AND DATA SUBJECT

In order to deliver the Services, ARAGO Consulting collects the data issued from SAP Concur, including the receipts related to each expense. Additional data is collected based on the usage of the Service by the different users: login, report, extraction operation shall be traced. Data subject are Service’s users, employees, and contractors of the Client. The collected can be (non-limitative list): first name, last name, email, employee id, email, expenses details, and also all personal data collected using the Services.

D. SECURITY AND DATA TRANSFER

By using the Services, the Client authorize ARAGO Consulting to transfer and store the collected data for the purposes described here. Data is hosted in the same country where the data comes from. Data is stored on SAP data centers and is transferred to a dedicated server for the purpose of the services.

E. RETENTION POLICY

Collected data is stored on the server for the purpose of the services. Retention time belongs to the Client’s specific requests. In any case, data cannot be stored longer than 6 months after a person had been deactivated or erased from the original Concur data base where data comes from.

F. DATA PROCESSING

ARAGO Consulting commits to respect of the Processing of the Personal Data:

• Process the Personal Data only for the purposes of and in compliance with the terms set out in this Terms of Services and on written instructions and directions received from the Client;
• not Process the Personal Data or permit it to be processed or access, in whole or in part, other than for the provision of the Services and only to the extent reasonably necessary for the performance of this Terms of Services;
• not copy, export or extract any Personal Data in any manner except as necessary to perform the Services and ensure full compliance of this obligation by its representatives and potential sub-processor;
• keep the Personal Data confidential, and not disclose, in whole or in part, the Personal Data to any person or entity, except to its employees:
  • on a need-to-know basis and only as necessary for the performance of the Services;
  • who are duly authorized to this effect as a result of their position and qualification and bound by obligations equivalent to those set out under this clause;
  • who have received appropriate training about the Data Protection Laws concerning the handling of Personal Data;
  • who are informed of the confidentiality nature of the Personal Data; and
  • who are subject to a duty of confidence.
• implement privacy by design and privacy by default principles in relation to the tools and applications the company uses to provide the Services;

G. RETURN AND DESTRUCTION OF THE PERSONAL DATA

Except to the extent prohibited by applicable law, at the Client’s written request at any time, the company and the authorized sub-processor (if any) shall promptly return all data as well as authorized copies (if any) of the data, including extracts or other reproductions (if any), whether in written, electronic or other readable and processable format or media, to the Client.

Except to the extent prohibited by applicable law, upon termination of retention periods as defined by the Client for each category of Personal Data or upon termination or expiration of the Services, ARAGO Consulting shall securely delete, remove and destroy all Personal Data processed on behalf of the Client as well as authorized copies (if any) of the Personal Data, including extracts, backups or other reproductions (if any), whether in written, electronic or other form or media, except where necessary to retain such Personal Data strictly for the purposes of compliance with applicable law.

H. SUB PROCESSORS

The list of sub processor is available on line: https://www.aragoconsulting.eu/fr/ressources-subprocessors. It is updated when required, provides an overview of ARAGO Consulting sub-processors providing data processing relevant services on behalf of ARAGO Consulting to the Client. A sub-processor is any further ARAGO Consulting affiliate, or third party involved by ARAGO Consulting (with a prior agreement from the final customers) that processes personal data (as defined in applicable data protection laws) on behalf of ARAGO Consulting and its customers or may have access to systems containing personal data. Operation being sub-processed are:

• Technical operation, parametrization and maintenance operation on SaaS (Software as a Service) solutions
• Data load of personal information in the corresponding systems based on instructions and data provided by the customers

All question or contacts related to GDPR, data privacy or sub-processing must be sent to ARAGO Consulting’s Group Data Privacy Offcier: dpo@aragoconsulting.com.

I. THE DATA PROTECTION OFFICER

ARAGO Consulting’s data protection officer, if it has designated one in accordance with Article 37 of the GDPR. He can be contacted at: dpo@aragoconsulting.com.

J. RESPONSIBILITY FOR DATA

The Client is solely responsible for any content submitted, post or transmit via the Service. You may not post or submit any Data that: (i) infringes the copyright, trademark, or other intellectual property rights of any person; (ii) is defamatory; (iii) contains nudity or sexually explicit content, or is otherwise obscene; (iv) may disparage any ethnic, racial, sexual, religious, or other group by stereotypical depiction or otherwise; (v) depicts or advocates the use of illicit drugs; (vi) makes use of offensive language or images; (vii) characterizes violence as acceptable, glamorous or desirable; (viii) provides a link to any other websites.

4. TERM AND TERMINATION

Client access to the Service will continue until such time as Client withdraws such access, or Client’s subscription to access the Service expires. ARAGO Consulting may also revoke or suspend access for any reason in ARAGO Consulting’s sole discretion, including, for instance, in response to misuse of the Service, denial of service attack, violation of these terms.

5. WARRANTY / LIABILITY

A. MUTUAL WARRANTIES

Each party represents and warrants to the other that it is duly authorized to execute this Agreement and perform the obligations set forth herein.

The Client acknowledge and agree that the Service may be subject to interruption, limitations, delays, and other problems inherent in the use of Internet applications and electronic communications. ARAGO Consulting is not responsible for any such delays, delivery failures, or any other damage resulting from events beyond ARAGO Consulting’s reasonable control, without regard to whether such events are reasonably foreseeable by ARAGO Consulting.

B. LIMITATION

Client’s exclusive remedy and ARAGO Consulting’s, its suppliers’ and licensors’ total aggregate liability relating to, arising out of, in connection with, or incidental to this agreement, whether for breach of contract, breach of warranty, indemnification or any other claim shall be limited to the actual direct damages incurred by Client, up to the aggregate amounts paid by client and received by ARAGO Consulting hereunder during the twelve months immediately preceding the applicable claim. The existence of multiple claims or suits under or related to this agreement will not enlarge or extend this limitation of damages. client hereby releases ARAGO Consulting, its suppliers and licensors from all obligations, liability, claims or demands in excess of this limitation. The provisions of this section do not waive or limit ARAGO Consulting’s ability to obtain injunctive or other equitable relief for breach of this agreement.

C. EXCLUSION OF CERTAIN DAMAGES AND LIMITATIONS OF TYPES OF LIABILITY

In no event will ARAGO Consulting be liable for any special, consequential, incidental, indirect or punitive damages, or lost profits or lost revenue arising out of or related to the subject matter of this agreement or the use of or inability to use the service. The foregoing exclusion and liability limitations apply even if such party has been advised of the possibility of such damages and even in the event of strict or product liability.