Data Processing Agreement

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between the customer ("Customer", "Controller", "you") and CostWise SAS, a French simplified joint-stock company (SAS) registered at 47 Rue Vivienne, 75002 Paris, France ("CostWise", "Processor", "we"). It governs the processing of personal data that CostWise carries out on the Customer's behalf when providing the CostWise cloud and AI cost management platform (the "Service"), in accordance with Regulation (EU) 2016/679 (the "GDPR").

If there is any conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the GDPR. "Data Protection Law" means the GDPR and any applicable national implementing or supplementary laws.

2. Roles of the Parties

For personal data processed under the Service, the Customer acts as the controller (or, where the Customer is itself a processor, as a processor acting on behalf of a third-party controller), and CostWise acts as the processor. CostWise processes personal data only on behalf of, and under the documented instructions of, the Customer.

3. Scope and Instructions

CostWise processes personal data only to provide and support the Service and as otherwise documented in the Agreement, this DPA and the Customer's use of the Service, unless required to do otherwise by EU or Member State law. In that case, CostWise will inform the Customer of the legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.

4. Processor Obligations

CostWise shall:

  • process personal data only on the Customer's documented instructions;
  • ensure that persons authorised to process the personal data are bound by appropriate confidentiality obligations;
  • implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR (see Annex 2);
  • respect the conditions for engaging sub-processors set out in Section 5;
  • taking into account the nature of the processing, assist the Customer, insofar as possible, in responding to requests to exercise data subject rights under Chapter III GDPR;
  • assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, breach notification and data protection impact assessments), taking into account the nature of the processing and the information available to CostWise;
  • at the Customer's choice, delete or return all personal data after the end of the provision of the Service, and delete existing copies unless EU or Member State law requires storage; and
  • make available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR.

5. Sub-processors

The Customer provides a general authorisation for CostWise to engage sub-processors to support the provision of the Service (for example, cloud hosting and infrastructure providers). CostWise imposes data protection obligations on each sub-processor that are no less protective than those in this DPA and remains liable to the Customer for each sub-processor's performance. CostWise will make an up-to-date list of sub-processors available on request and will inform the Customer of any intended changes concerning the addition or replacement of sub-processors, giving the Customer the opportunity to object on reasonable data-protection grounds.

6. International Transfers

CostWise primarily processes and stores personal data on servers located within the European Union. Where personal data is transferred outside the European Economic Area, CostWise ensures that an appropriate transfer mechanism is in place, such as a European Commission adequacy decision or the European Commission's Standard Contractual Clauses, together with any supplementary measures required.

7. Personal Data Breach

CostWise will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA, and will provide information reasonably available to assist the Customer in meeting its own breach-notification obligations under Articles 33 and 34 GDPR.

8. Data Subject Requests

If CostWise receives a request from a data subject relating to personal data processed on the Customer's behalf, CostWise will, where legally permitted, promptly forward the request to the Customer and will not respond directly except on the Customer's documented instructions.

9. Term and Deletion

This DPA remains in effect for as long as CostWise processes personal data on the Customer's behalf. On termination or expiry of the Agreement, CostWise will, at the Customer's choice, delete or return the personal data as described in Section 4.

Annex 1 — Details of the Processing

  • Subject matter: provision of the CostWise cloud and AI cost management Service.
  • Duration: the term of the Agreement, plus any period required to return or delete data.
  • Nature and purpose: hosting, storing, analysing and displaying data to provide cost visibility, optimization, forecasting and reporting.
  • Types of personal data: account and contact details (name, business email, job title), authentication data, and usage and log data (for example IP address and access times). The Service is not designed to process special categories of personal data.
  • Categories of data subjects: the Customer's authorised users and personnel.

Annex 2 — Security Measures

CostWise implements technical and organisational measures including: encryption of data in transit and at rest (AES-256), role-based access control and least-privilege access, multi-factor authentication, network segmentation, logging and monitoring, regular backups, vulnerability management, and staff confidentiality and security-awareness obligations. CostWise uses read-only access to connected cloud accounts wherever the integration allows.

Contact

For any question regarding this DPA, or to exercise the rights described above, contact CostWise SAS:

Data Protection Officer
Email: legal@cost-wise.com
CostWise SAS, 47 Rue Vivienne, 75002 Paris, France

Last Updated: July 3, 2026

PrivacyTermsCost-Wise