Digital law, IT contracts and GDPR

ARST Avocats assists companies in digital law and GDPR, with a particularly developed practice in IT contracts, SaaS contracts, website and application creation, personal data protection and GDPR compliance.

Our intervention combines contract law, new technologies and data protection to legally secure the company's digital projects, from their conception to their operation.

We work with companies that develop or market digital solutions as well as those that buy, use or deploy these tools as part of their business.

Lawyer specializing in digital law and IT contracts

Developing, acquiring or using a digital solution requires precisely defining the obligations and responsibilities of each party.

ARST Avocats assists its clients in drafting, analyzing and negotiating IT contracts tailored to the characteristics of each project.

Our intervention focuses in particular on:

• SaaS contracts and online software provision contracts;
• software license and usage agreements;
• application development contracts ;
• software design and development contracts;
• contracts for the creation of websites and digital platforms;
• IT integration and deployment contracts;
• hosting contracts;
• maintenance and support contracts;
• IT service contracts;
• contracts relating to the use of APIs and the interconnection of solutions;
• the general terms and conditions of use (GTC);
• the general terms and conditions of sale or services applicable to digital activities;
• More generally, contracts relating to the design, development, supply or use of digital tools and services.

Our objective is to anticipate difficulties that may arise during the project and tocontractually organize the obligations of the parties, service levels, financial conditions, responsibilities, intellectual property, confidentiality, maintenance, reversibility and conditions for ending the relationship.

SaaS contracts and software solutions

The use of SaaS – Software as a Service – is playing an increasingly important role in the organization of companies and requires appropriate contractual arrangements.

ARST Avocats assists publishers, service providers, suppliers and user companies in drafting and negotiating SaaS contracts.

Depending on the project, the contract may include the following provisions:

• the conditions of access and use of the solution;
• the functional scope of the service;
• the subscription and billing conditions;
• service levels and availability commitments;
• maintenance and updates;
• assistance and support;
• data hosting and storage;
• security and confidentiality;
• intellectual property;
• the terms of use of the data;
• subcontracting;
• the respective responsibilities of the parties;
• the duration and conditions of termination;
• data and service recovery and reversibility.

When the solution involves the processing of personal data, the contractual dimension must also be articulated with the requirements of the GDPR.

Contracts for the creation of websites, applications and digital platforms

ARST Avocats also intervenes to secure the relationships between companies and their developers, agencies, publishers or other service providers during the creation of a digital tool.

In particular, we support our clients with contracts for the creation of websites, contracts for the development of mobile applications, software, digital platforms and more generally technological solutions adapted to the needs of the company.

Particular attention is paid to the definition of the project and deliverables, deadlines, acceptance procedures, maintenance, solution evolutions, responsibilities, and the fate of intellectual property rights.

The question of ownership and exploitation of rights relating to software, developments, content, graphic creations and other elements of the project must in particular be organized from the conclusion of the contract.

GDPR and personal data protection lawyer

ARST Avocats also assists companies in their GDPR compliance and, more generally, in the legal organization of their personal data processing.

Compliance with the General Data Protection Regulation (GDPR) is not a one-off intervention. It requires identifying the data processing activities carried out by the company, organizing responsibilities, and maintaining documentation over time that is adapted to the evolution of its activities.

Our services asGDPR lawyers can include, in particular:

• the analysis of the processing of personal data carried out by the company;
• the identification of the roles of data controller, joint controller or processor;
• support for GDPR compliance ;
• the creation, review and updating of the register of processing activities;
• analysis of the legal bases for processing;
• the definition of storage periods;
• the organization of information for the people concerned;
• the organisation of procedures for exercising rights;
• analysis of relationships with service providers and subcontractors;
• support in setting up and monitoring GDPR documentation;
• the analysis of certain issues relating to data transfers;
• support on issues related to cookies and other trackers;
• the analysis of needs in terms of data protection impact assessment (DPIA);
• monitoring and updating the company's GDPR compliance.

The GDPR notably provides for the maintenance of a record of processing activities and, for processing likely to generate a high risk, the carrying out of an impact assessment under the conditions provided for by the regulation.

GDPR contracts and subcontracting of personal data

GDPR compliance has an important contractual dimension, particularly when the company entrusts all or part of the processing of personal data to a service provider.

ARST Avocats assists its clients in drafting and negotiating GDPR contracts, including clauses and agreements relating to the processing of personal data.

Our services include, in particular:

• drafting and negotiating personal data protection clauses;
• establish or analyze data processing agreements (DPAs) ;
• determine the quality of the different parts with regard to the GDPR;
• organize the obligations of the data controller and the subcontractor;
• to regulate the use of subsequent subcontractors;
• organize confidentiality and security obligations;
• specify the procedures for returning or deleting the data;
• integrate personal data requirements into SaaS, IT, commercial and service contracts.

Article 28 of the GDPR stipulates in particular that processing carried out by a subcontractor on behalf of a data controller must be governed by a contract containing certain mandatory provisions.

A VERY RELEVANT EXTERNAL LINK TO CREATE:
“contractual obligations between data controller and data processor” → standard contractual clauses presented by the CNIL

GDPR, websites, applications and cookies

Websites, applications and digital platforms may also involve the processing of personal data and the use of cookies or other trackers.

ARST Avocats assists companies with the legal analysis of their digital systems, particularly in drafting or reviewing:

• privacy policies;
• information notices relating to data processing;
• clauses relating to data protection;
• contractual arrangements related to service providers operating on the site or application;
• rules applicable to cookies and other trackers.

Some tracking technologies require prior user consent, while others may be exempt under certain conditions. The CNIL (French Data Protection Authority) publishes specific recommendations on ensuring the compliance of websites and applications.

GDPR and IT contracts: a comprehensive approach to digital projects

Issues of digital law, intellectual property, contract law and data protection are closely linked.

A SaaS contract may therefore require simultaneous handling of the terms of use of the software, service levels, intellectual property, hosting, confidentiality, security and the processing of personal data.

Similarly, the creation of a website or application frequently involves organizing relations with the developer, ownership of rights to the creations, processing of personal data, relations with subcontractors, and the terms of use of the service.

Our practice allows us to address these issues holistically by combining our expertise in digital law, contract law, intellectual property and GDPR.

ARST Avocats thus supports its clients from the design of the project and the negotiation of contracts to its implementation and the monitoring of its compliance.