Last updated: 13 October 2026 · Processing agreement under Article 28 GDPR, annexed to the Terms & Conditions. Working version — to be reviewed by counsel (Me Mac Garry).
This Agreement governs the processing of personal data carried out by Umamy (the “Provider”) on behalf of the Client (controller), within the meaning of Article 28 GDPR. By subscribing to the Terms & Conditions, the Client enters into this Agreement.
For the processing described in Annex I, the Provider acts as processor and the Client as controller. Processing that the Provider carries out for its own account (building and enriching its database, improving its models, analysing interest signals) falls under the personal-data clause of the Terms & Conditions and is not governed by this Agreement.
The Provider processes personal data only on the Client's documented instructions (including as regards transfers), unless required by law. The Terms & Conditions and the Client's use of the Platform constitute those instructions.
Persons authorised to process the data are bound by an appropriate confidentiality obligation.
The Provider implements the technical and organisational measures described in Annex II.
General authorisation; the list is in Annex III. The Provider informs the Client at least 30 days before adding or replacing a sub-processor; the Client may object on reasonable grounds.
The Provider assists the Client in responding to rights requests and forwards without delay any request received directly.
The Provider notifies the Client without undue delay after becoming aware of a breach affecting the Client's data, with the necessary information.
On expiry of the Terms & Conditions, the Provider deletes or returns, at the Client's choice, the data processed as a processor (and deletes copies), unless retention is required by law.
The Provider makes available the information necessary to demonstrate compliance with Art. 28 and allows audits (reasonable notice, confidentiality).