Data processing agreement

Last updated: October 29, 2026

This agreement forms part of the terms of use of FinOps Move2Cloud (the “Service”). It sets out how Move2Cloud, as processor, processes the personal data its client, as controller, entrusts to it through the Service, under section 28 of the General Data Protection Regulation (GDPR). Accepting the terms of use means accepting this agreement, with nothing else to sign; a copy signed by Move2Cloud is sent on request.

1. Roles of the parties

The client, the organisation that uses the Service, is the controller of the personal data contained in what the Service reads and keeps for it: the cost and inventory data of its cloud accounts, which may contain names of projects, resources or tags, its budgets, alerts, dashboards, reports and exports, and the activity log of its organisation. Move2Cloud processes them as processor, on the client's behalf.

For the data it needs for its own purposes (the accounts of the users and their sign-in, the security of the Service, invoicing, support and the relationship with the client), Move2Cloud is the controller; the privacy policy describes them.

2. Instructions

Move2Cloud processes the personal data only on the documented instructions of the client: the terms of use, this agreement, and the choices the client makes in the Service (the cloud accounts it connects, the artificial intelligence features it keeps or turns off, the retention periods it sets). It processes them for no other purpose, sells nothing of them and uses them to train no model. If an instruction seems to it to infringe the law on data protection, it tells the client.

3. Confidentiality

The people of Move2Cloud authorised to process the data are bound by confidentiality. The administration of the platform shows neither the costs nor the credentials of the clients.

4. Security

Move2Cloud implements the technical and organisational measures described in section 7 of the privacy policy, among which encrypted exchanges, the credentials of the providers encrypted in the database, two-factor authentication required for every user, the partitioning of the data by organisation, read-only access at the providers, and hosting in France.

5. Sub-processors

The client gives Move2Cloud a general authorisation to use the following sub-processors, described in section 5 of the privacy policy:

• Scalingo (France): hosting of the application, of its database and of its backups, and of the sign-in service of the Move2Cloud accounts.
• Scaleway (France): sending of the e-mails of the Service, storage of the reports and exports and of the files attached to support requests, and a backup copy of the database.
• A language-model provider (United States): artificial intelligence functions, with limited and pseudonymised data; its identity is given to the client on request, at contact@move2cloud.fr.

The payment provider named in the privacy policy (Mollie) is not a sub-processor under this agreement: it processes the invoicing data of Move2Cloud, of which Move2Cloud is the controller. Nor are Google and Microsoft, which only the people who choose to sign in with them use.

Move2Cloud binds each sub-processor by contract to obligations of data protection equivalent to those of this agreement, and remains liable to the client for them. Before adding or replacing a sub-processor, it informs the owner of the organisation at least 10 days in advance, by e-mail and in the notifications. Within that time, the client may object for a reason related to data protection; failing an agreement, it can cancel its subscription without the month's notice.

6. Transfers outside the European Union

The Service and its data are hosted in France. Only the artificial intelligence functions give rise to a transfer, to the language-model provider established in the United States, with limited and pseudonymised data as described in section 4 of the privacy policy; the owner of the organisation can turn them off. This transfer is governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the data processing agreement of that provider.

7. Rights of individuals

The Service lets the client answer most requests itself: each member changes or deletes their account, and the administrators manage the team and the cloud accounts. If Move2Cloud receives a request directly, it passes it on to the client without answering it, and helps the client answer it within the time the law allows.

8. Personal data breaches

Move2Cloud informs the owner of the organisation of any personal data breach concerning its data without undue delay, and within 48 hours of becoming aware of it, with what it knows of its nature, of the data and people concerned, of its likely consequences and of the measures taken. It then helps the client meet its own obligations of notification.

9. Assistance

On request, Move2Cloud gives the client the information it holds to carry out a data protection impact assessment, or a prior consultation of the supervisory authority.

10. Audits

On written request, once a year, Move2Cloud gives the client the documents needed to show that it complies with this agreement. If they are not enough, the client may have an audit carried out once a year, at its own cost, by an independent auditor bound by confidentiality and not a competitor of Move2Cloud, after at least 30 days' notice, during working hours and without disrupting the Service.

11. End of the processing

When the organisation is deleted, its access, its credentials, its cost history, its budgets, its alerts and its generated files are erased, under the conditions stated in section 6 of the privacy policy; deleted data may remain in the backups of the host until they expire. Before that, the client can export its analyses from the console (PDF reports and CSV exports). Invoices and the proof of SEPA direct debit mandates are kept for the time the law requires.

12. Duration and precedence

This agreement applies as long as Move2Cloud processes personal data for the client under the terms of use. In case of conflict with the terms of use, it prevails for what concerns the protection of personal data. The liability of each party is governed by the terms of use.

Annex: description of the processing

• Nature and purpose: providing the Service, that is reading the costs and the inventory of the client's cloud accounts, showing them, analysing them and alerting its team, and keeping its budgets, dashboards, reports and activity log.
• Data subjects: the members of the client's team, and any person whose personal data appears in the names of projects, resources or tags of the connected cloud accounts.
• Categories of data: the account data of the members (name, e-mail address, function); the cost and inventory data (amounts, services, regions, names of projects, accounts and resources, tags, usage metrics); the budgets, alerts, dashboards, reports and exports; the activity log.
• Sensitive data: none is expected; the client avoids entrusting any to the Service.
• Frequency and duration: continuous, for as long as the client uses the Service, then until the deletion described in section 11.