Data Processing Agreement
Version of November 6, 2026.
Under Article 28 of the EU General Data Protection Regulation (GDPR).
1. Roles
For the data it enters in C2O ONE (clients, contacts, employees, jobs, documents), the customer company is the data controller. Vonus IA, publisher of C2O ONE, acts as data processor: it processes this data only to provide the service and on the customer’s documented instructions, which consist of the use of the application and the provisions of this agreement.
2. Subject, duration, nature and purposes
- Subject: hosting and processing of the data needed for the management software.
- Duration: that of the subscription, then the time needed for return and deletion.
- Purposes: commercial management (clients, estimates, invoices, payments received), organization of jobs and teams, reports, communication with clients, assistance from Vonix.
- Categories of people: the customer’s clients and prospects, their contacts, the customer’s employees and staff, cleaners.
- Categories of data: identity, contact details, billing data, schedules and job locations, report photos and signatures, HR information entered by the customer. No sensitive data within the meaning of Article 9 of the GDPR is required by the service: the customer refrains from entering any.
3. The publisher’s obligations
- Process data only on the customer’s instructions, and inform it if an instruction seems unlawful.
- Ensure confidentiality: the people authorized to access the data are bound by it.
- Ensure security: separation of data by company enforced by the database, role-based access, encryption of bank details, encrypted connections.
- Help the customer respond to requests from the people concerned to exercise their rights.
- Notify the customer of any data breach concerning it as soon as possible, and no later than 48 hours after becoming aware of it.
- At the end of the contract, return the data by export and then delete it, unless the law requires it to be kept.
- Make available the information needed to demonstrate compliance with this agreement.
4. Sub-processors
The customer authorizes the use of the following service providers. The publisher informs it of any addition or replacement, and the customer may object by canceling.
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting of the application and website | United States (global network) |
| Supabase | Database, files and authentication | European Union (Ireland) |
| Anthropic | Vonix assistant: analysis of submitted requests, documents and emails | United States |
| Resend | Sending of transactional emails (invitations, documents) | United States |
| Gmail inbox, if the user connects it; mobile notifications (Firebase) | United States / European Union | |
| Microsoft | Outlook inbox, if the user connects it | United States / European Union |
| Meta | WhatsApp messaging, if the company connects it | United States / European Union |
| Stripe | Subscription payment by card or ACH (payment details are entered at Stripe) | European Union (Ireland) |
Where data is processed outside the European Union, this transfer relies on the safeguards provided for by the GDPR, in particular the European Commission’s standard contractual clauses offered by these providers.
5. The customer’s obligations
The customer ensures that the processing it carries out with C2O ONE is lawful, informs the people concerned, gives its staff appropriate roles and revokes access that is no longer needed.
Contact
Any question or request about data: contact@c2o-one.com.