Data processing agreement (DPA)
This agreement, accepted upon sign-up together with the terms of service, governs the processing of personal data that Plugply carries out on behalf of its customers, in accordance with Article 28 GDPR.
This English version is provided for convenience. In case of discrepancy, the French version prevails: Contrat de sous-traitance (DPA).
1. Parties and roles
The Customer, which uses the Service for its recruitment, is the controller. Mickael Peyrot, publisher of Plugply (French sole trader (entrepreneur individuel), SIRET 522 441 211 00011), is the processor: it processes the data solely on behalf of the Customer and on its instructions. Capitalised terms have the meaning given to them in the terms of service.
2. Description of the processing
| Purpose | Management of the Customer's recruitment: receiving, storing, viewing and tracking applications. |
|---|---|
| Operations | Collection through the Form, storage, antivirus scanning of files, viewing, annotation, email notification, export and deletion. |
| Data subjects | Candidates; Users of the Organization. |
| Data | Candidates: last name, first name, email, phone number (optional), CV, cover letter and message (optional), Job applied for, submission page, date of consent, status and notes added by the Customer. Users: name, email, role, activity log. |
| Sensitive data | None is requested. A Candidate may include some in their documents; the Customer then processes it with the required care. |
| Duration | Retention period chosen by the Customer (6, 12, 18 or 24 months after submission), followed by automatic deletion; at the latest upon closure of the Organization. |
3. Customer instructions
The Customer's instructions result from the terms of service, this agreement and the settings it makes in the Service (retention period, information provided to Candidates, deletions). Plugply informs the Customer if it considers that an instruction infringes the GDPR.
4. Confidentiality
Plugply only accesses the Customer's data when necessary for the operation of the Service, at the Customer's request or to comply with a legal obligation. Every person authorised to access it is bound by confidentiality. Plugply's operating tools never display the content of an application.
5. Security
Plugply implements in particular the following measures:
- hosting of data and files in France, with OVHcloud;
- encryption of communications (HTTPS) and strict security headers;
- files sent directly from the Candidate's browser to private storage, through signed links valid for a few minutes; files do not pass through the builder of the Site;
- antivirus scanning of every file before it can be viewed;
- isolation of each Organization's data, verified by automated tests;
- User sign-in through a single-use link, without a password;
- audit log of file views and sensitive actions, visible to the Customer;
- encrypted backups every 6 hours, kept for 30 days, whose decryption key is not stored on the servers;
- servers accessible by SSH key only, firewall, automatic security updates.
6. Sub-processors
The Customer authorises Plugply to use the following sub-processors:
| Sub-processor | Role | Location |
|---|---|---|
| OVH SAS (OVHcloud) | Hosting, database, file storage, backups | France |
| Sendinblue SAS (Brevo) | Sending emails (notifications, sign-in links) | France / European Union |
| Stripe Payments Europe Ltd | Customer subscription and invoicing; no Candidate data | Ireland (transfers outside the EU governed by standard contractual clauses) |
Plugply informs the Customer by email at least 30 days before any addition or replacement; the Customer may object on legitimate grounds and, failing agreement, cancel. Plugply imposes equivalent data protection obligations on its sub-processors. The builder of the Customer's Site (for example Framer) is not a sub-processor of Plugply: it receives no application data.
7. Data subject rights
The Service allows the Customer to respond to Candidate requests itself: finding all the applications for an email address, exporting them or deleting them. If a Candidate contacts Plugply, their request is forwarded to the Customer without delay.
8. Personal data breach
Plugply notifies the Customer of any personal data breach as soon as possible, and no later than 48 hours after becoming aware of it, with the information needed for the Customer's own notification to the CNIL (French data protection authority) and, where applicable, to the data subjects.
9. Assistance and audit
Plugply assists the Customer, on request, with its data protection impact assessments and its dealings with the CNIL. It makes available the information necessary to demonstrate compliance with this agreement, and allows one audit per year, at the Customer's expense, with 30 days' notice, by an auditor bound by confidentiality.
10. End of processing
Upon closure of the Organization, at the Customer's initiative or automatically (see the terms of service), Plugply deletes all the data; any data still present in backups is erased no later than 30 days afterwards. Before closure, the Customer can retrieve its data from the Service.
11. Contact
For any question about data protection: contact@plugply.com.
Last updated: 16 October 2026.