Data processing agreement

This agreement is between the notary office subscribed to the Service (the controller) and NotaDraft (the processor). It forms part of the terms of use and sale and applies from the start of the subscription. A signed copy is available on request at contact@notadraft.com.

It governs the processing of personal data that NotaDraft carries out on the office's behalf to provide the Service.

• Purpose: preparing draft notarial acts for the office from the documents in its files, and creating its act templates.
• Operations: hosting the documents, reading their content automatically, consistency checks, drafting the act, turning uploaded acts into templates, deletion.
• Data subjects: the office's clients and the parties to its acts (sellers, buyers, lessors, tenants, principals and attorneys, company managers and partners), other people named in the documents, and the office's Users.
• Data: identity (surname, given names, sex, date and place of birth, nationality, photo on ID documents), identification numbers (NIN, ID card, passport and birth certificate numbers), addresses, civil status, property data (title deeds, livret foncier, description), powers of attorney, company data (commercial register, statutes, NIF, NIS, partners), insurance, tax situation, amounts (prices, rents).
• Duration: scans are deleted as soon as the act is generated; the draft act when the file is closed, and at the latest 24 hours later; an act uploaded to create a template as soon as the template is confirmed or discarded; templates and settings at the office's request or when the subscription ends.

The Service does not seek to process sensitive data within the meaning of article 18 of law 18-07. The office uploads only the documents the file needs.

NotaDraft processes the data only on the office's instructions: its Users' use of the Service and the office's written requests are those instructions. NotaDraft uses the data for no other purpose: not to train an artificial intelligence, not for advertising, and never to pass it on to anyone. If an instruction seems unlawful to it, NotaDraft informs the office.

People at NotaDraft who can access the data are authorised to do so only as their work requires, and are bound by professional secrecy, including after they leave their role (law 18-07, art. 40).

NotaDraft applies technical and organisational measures suited to the risks and the nature of the data (law 18-07, art. 38), including: encrypted communications (HTTPS), passwords stored in irreversibly encrypted form, separation of each office's data, deletion of scans as soon as the act is generated, restricted access to the servers, and a log of account access.

NotaDraft uses the sub-processors listed at the end of this agreement, and binds them by contract to the same obligations. NotaDraft notifies the office by email at least 30 days before adding or replacing one; the office may object and, if no agreement is reached, cancel its subscription at no cost.

The data is hosted and processed exclusively in Algeria, including the automatic reading of documents. NotaDraft does not transfer any data abroad.

• NotaDraft helps the office respond to people exercising their rights, in particular within the 10-day period for rectification (law 18-07, art. 35), and forwards without delay any request it receives directly.
• NotaDraft provides the office with the information it needs for its own formalities with the ANPDP, and keeps a register of the processing carried out on its behalf.

If a breach affects the office's data (loss, unauthorised access, disclosure), NotaDraft notifies the office within 48 hours of becoming aware of it, with the information available: the nature of the breach, the data and people concerned, its likely consequences and the measures taken. NotaDraft adds to this information as its investigation progresses and helps the office with its own steps.

Before the subscription ends, the administrator can download the office's act templates. NotaDraft then deletes all the office's data within 30 days, and from its backups within 60 days, and confirms this in writing on request. Confidentiality obligations continue after the contract ends.

NotaDraft makes available to the office the information needed to show compliance with this agreement. The office may have an audit carried out once a year, by itself or by an auditor bound by confidentiality, giving NotaDraft at least 30 days' notice; the audit's costs are its own. NotaDraft submits to the ANPDP's inspections.

As controller, the office ensures that processing its clients' data is lawful, completes its own formalities with the ANPDP, informs its clients, uploads only the documents that are needed, and makes sure that only authorised people use its accounts.

• Server and data hosting: a hosting provider based in Algeria, whose name is given to the office on request.

Documents are read by an artificial intelligence model hosted on our own servers: no artificial intelligence provider receives the data.