Personal data processing agreement
DASHUND is published by a French business. This page is a translation provided for convenience: French law applies, and if the English and French versions differ, the French version prevails.
This agreement (the “Agreement”) is entered into between the customer using DASHUND (the “Controller”) and Thomas Cescousse EI, a sole proprietorship registered in France, 60 avenue Jean Jaurès, 75019 Paris, France, SIREN 131 009 003 (“DASHUND”, the “Processor”). It is part of the terms of service and applies as soon as the customer publishes a prototype and shares a test link. The terms used have the meaning given to them by Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”).
1. Purpose
The Agreement sets out the conditions under which DASHUND processes, on the customer’s behalf, the personal data of the people who use the customer’s prototypes through a test link (the “Testers”), in accordance with article 28 of the GDPR.
2. Term
The Agreement applies for as long as the customer uses the service, and then until the data processed on the customer’s behalf is deleted, under the conditions set out in article 17.
3. Nature of the processing
Collection of usage events in the Tester’s browser, transmission to the service, storage, calculation of metrics (sessions, paths, screens, clicks, comparisons, A/B tests), making them available to the customer and the members of their workspace, retention and deletion.
4. Purpose of the processing
To allow the customer to measure how their prototypes are used and to analyze the results. DASHUND does not process this data for its own purposes or for any other purpose: no profiling, no tracking from one prototype or customer to another, no advertising, no resale.
5. Data subjects
The Testers, that is, the people who open a test link published by the customer. They have no DASHUND account.
6. Categories of data
- Screens displayed, time spent on each one and the order in which they were viewed, clicks and their position in the prototype, screen changes, date and time.
- Device type, browser, operating system, language, screen size; approximate country of connection.
- Random visitor identifier unique to each prototype (13 months at most), session identifier, A/B test version; audience (test link) through which the prototype was opened.
- The IP address is only processed transiently, in memory, to determine the country of connection and to limit abuse; it is never recorded in analytics data or in logs.
The service collects no name, no email address and no typed text. No special categories of data (article 9 of the GDPR) are intended to be processed: the customer agrees not to ask Testers to enter personal data in their prototypes.
7. Controller’s instructions
DASHUND processes the data only on the customer’s documented instructions. Such instructions consist of the terms of service, the Agreement and the settings the customer makes in the service (publishing, test links, audiences, A/B tests, deletion of prototypes or workspaces, choice of plan, which determines the retention period). If an instruction appears to infringe the GDPR or applicable law, DASHUND informs the customer immediately. DASHUND only processes data outside these instructions where required by Union or Member State law; it then informs the customer, unless prohibited by law.
8. Controller’s obligations
The customer determines the legal basis of the processing, informs the Testers (for example by referring to the privacy policy), obtains their consent where required, and answers their requests to exercise their rights. The customer ensures that their prototypes do not ask for personal data to be entered.
9. Confidentiality
DASHUND ensures that the people authorized to process the data have committed to keeping it confidential. DASHUND’s access to Testers’ data is limited to what is strictly necessary for the operation, maintenance and security of the service and for support.
10. Security
DASHUND implements the technical and organizational measures described on the Security page, in particular: hosting in France, encrypted connections (HTTPS), strict isolation of workspaces verified by automated tests, role-based access control, no retention of IP addresses, passwords and tokens stored only in hashed form, encrypted nightly backups, automated checks of third-party software components. DASHUND may change these measures without lowering the overall level of protection.
11. Data breaches
DASHUND notifies the customer of any personal data breach affecting them without undue delay, and no later than 48 hours after becoming aware of it. The notification states, insofar as this information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or planned, and a contact. DASHUND supplements this information as it obtains it and cooperates with the customer so that the customer can, where applicable, notify the CNIL (the French data protection authority) or their own supervisory authority and inform the data subjects.
12. Assistance with data subjects’ rights
DASHUND helps the customer, through appropriate measures, to respond to requests for access, rectification, erasure, restriction, objection and, where applicable, portability. The service makes it possible to delete the data of a prototype or a workspace. Since Testers’ data is pseudonymous, a request can generally only be handled if the Tester provides the identifier stored in their browser. DASHUND forwards to the customer without delay any request it receives directly and does not handle it alone, unless required by law or instructed by the customer.
13. Assistance with impact assessments
On request, DASHUND provides the customer with the information it has, taking into account the nature of the processing, to enable the customer to carry out a data protection impact assessment or to consult the CNIL or their own supervisory authority.
14. Sub-processors
The customer authorizes DASHUND to use the following sub-processor for Testers’ data: OVHcloud (OVH SAS, Roubaix, France), hosting of the service and data, in France. DASHUND informs the customer of any planned addition or replacement at least 30 days in advance, by email or in the service; the customer may object on data protection grounds and, failing agreement, cancel their subscription with no penalty for the remaining period. DASHUND imposes equivalent data protection obligations on its sub-processors and remains liable to the customer for their performance.
Figma is not a sub-processor of DASHUND: the customer’s prototype is displayed by Figma, in the Tester’s browser, under the terms agreed between the customer and Figma. The data that the Tester’s browser exchanges directly with Figma is not processed by DASHUND.
15. Transfers outside the European Union
Testers’ data is hosted and processed in France. DASHUND does not transfer it outside the European Union. Any future transfer would be subject to article 14 and governed in accordance with Chapter V of the GDPR.
16. Audits
DASHUND makes available to the customer the information needed to demonstrate compliance with article 28 of the GDPR. Once a year and with 30 days’ written notice, the customer may have an audit carried out at their own expense by an independent auditor bound by professional secrecy, without access to other customers’ data or disruption of the service; an additional audit is possible following a data breach.
17. Data at the end of the contract
During the contract, data is kept according to the customer’s plan (30 days on Free, 3 months on Solo, 6 months on Pro, with no time limit as long as the workspace exists on Business), then deleted automatically. The customer can delete a prototype or a workspace at any time, which deletes the corresponding data. At the end of the contract (deletion of the workspace or the account), DASHUND deletes the data processed on the customer’s behalf. On written request made before that date, DASHUND sends the customer a copy of the raw data in a common format (CSV). DASHUND keeps no copy, unless required by law; deleted data may however remain in the encrypted backups until their retention period expires, that is, 6 months at most.
18. Records
DASHUND keeps a record of the categories of processing activities carried out on behalf of its customers (article 30(2) of the GDPR).
19. Liability
Each party is liable for breaches of its own obligations under the GDPR. Between the parties, DASHUND’s liability under the Agreement is governed by article 14 of the terms of service, without prejudice to the rights that data subjects derive from article 82 of the GDPR.
20. Order of precedence
In the event of a conflict between the Agreement and the terms of service or any other document, the Agreement prevails for everything relating to personal data processed on the customer’s behalf.
Last updated: October 31, 2026.