Data processing agreement (DPA)
Last updated: 5 November 2026 · Version française
This English version is provided for convenience. The French version is the legally binding one.
This agreement, made under Article 28 of the GDPR, binds the researcher ("controller") and YXLO DESIGN, SIREN 999 055 031 ("processor"), for testers' data processed in Okkly. It is accepted when the account is created.
1. Subject and duration
The processor hosts tests, collects testers' answers, computes statistics, generates analyses on request and enables their sharing. The agreement lasts as long as the account exists.
2. Data and data subjects
- Data subjects: volunteer testers invited by the researcher.
- Data: answers to questions, task measurements (pages visited, duration, number of clicks, success), device type, browser, rounded screen size, language, participation code. No directly identifying data or sensitive data may be requested.
3. Processor's obligations
- Process data only on the researcher's instructions, that is to run the tests they configure.
- Ensure the confidentiality of data and train the people authorised to access it.
- Implement the following security measures: hosting in the EU, encryption in transit and at rest, per-researcher isolation (tested Row Level Security), hashed tokens, server keys never exposed, masking of emails and phone numbers before AI analysis, security headers, anti-bot protection.
- Help the researcher answer testers' requests: "My data" page (access and erasure with the participation code).
- Notify the researcher of any data breach within 48 hours of becoming aware of it.
- Make available the information needed to demonstrate compliance with this agreement.
4. Sub-processors
The researcher authorises the use of the sub-processors listed on the Subprocessors page, including Anthropic (United States) for AI analysis, governed by standard contractual clauses. Any addition is announced 30 days in advance; the researcher can object by deleting their account.
5. Retention and end of processing
| Data | Retention |
|---|---|
| Complete responses and analyses (including answers cited in an analysis) | 12 months after the test closes, then automatic deletion |
| Incomplete responses | 30 days |
| Inactive researcher account | Deleted after 24 months without sign-in |
| Share links | Until they expire (90 days max) or are revoked |
| Security logs | 6 months |
| Backups | Rolling 30 days |
When the account is deleted, all data is erased immediately, and from backups within 30 days. The researcher can export their results as CSV beforehand.
6. Researcher's obligations
- Have a legal basis and inform testers (Okkly collects their consent before each test).
- Not request sensitive or identifying data, and not target children under 15.
- Only install the script on websites they control.
Contact: [e-mail de contact RGPD à compléter].