Data processing agreement

Subject matter and capacity of the parties

This agreement governs the processing of personal data that Condorcet.Vote carries out on behalf of the organizer of an election, in accordance with article 28 GDPR. The organizer is the data controller; Condorcet.Vote is the processor. It supplements the terms of use and prevails over them on everything concerning the processing of personal data. It is entered into by the mere act of using the service to run an election; a signed copy can be requested at contact@condorcet.vote.

Subject matter, nature and duration of the processing

The processing serves the running of an election: taking in the electoral roll supplied by the organizer, distributing vote links, collecting ballots, publishing the register and the result. Its nature is hosting, message delivery, storage and publication as the service defines them. It lasts for the duration of the election and then, for the nominative data, for as long as the period during which the result can be challenged requires; the organizer may ask for its deletion at any time.

Data and data subjects

The processing covers the categories below. The service asks for no special-category data within the meaning of article 9 GDPR, and the organizer undertakes not to enter any in the free-text fields.

Voters

E-mail address, name if the organizer provides one, voting weight, participation in the election, voting public key and the digest of the vote link.

Ballots

The ballot content and its cryptographic signature, with no link to the voter’s identity, unless the organizer enables non-anonymous voting, in which case the identity is published with the ballot.

Election content

Title, description, candidates and messages entered by the organizer, which may contain personal data such as candidate names and photos.

Data subjects

The voters registered by the organizer and, where applicable, the candidates they designate.

Processing on documented instructions

We process this data only for the purpose above and on the organizer’s instructions: the election configuration they define in the interface constitutes the documented instruction. We do not use it on our own account, for prospecting, or to train a model, and we disclose it to nobody outside the sub-processors listed below. If an instruction appears to us to infringe the GDPR, we inform the organizer.

Confidentiality

The persons authorized to access this data are bound by a duty of confidentiality and access it only as far as operating the service or answering a support request requires. The voting protocol is designed so that the content of a ballot is accessible to nobody, us included.

Security measures

Having regard to the state of the art and to the risks, the following measures are implemented under article 32 GDPR.

Encryption in transit

All exchanges with the service are encrypted (TLS).

Secrets at rest

Hashed passwords, encrypted two-factor secrets, vote links kept as digests (the permanent group link, which must remain re-displayable, is encrypted).

Ballot secrecy

The ballot is signed in the voter’s browser by a ring-signature scheme: server-side, the link between a ballot and an identity does not exist.

Integrity

Every register block is hashed, chained to the previous one and signed with a platform key that is published and verifiable by anyone.

Browser isolation

Voting pages are served under a strict content security policy, with no third-party script whatsoever.

Stronger authentication

Two-factor authentication and passkeys are available on organizer accounts.

Hosting

Servers, database and register hosted in France.

Sub-processors

The organizer authorizes the use of the following sub-processors, which are bound by obligations equivalent to those of this agreement. We inform them of any addition or replacement; they may object on legitimate grounds, an objection then amounting to termination of the service for the future.

OVH (France)

Hosting of the entire service: servers, database and public register, in France.

Resend

Delivery of transactional e-mails: vote links, confirmations and notifications. Recipient addresses pass through this service, whose infrastructure may sit outside the European Union; that transfer is covered by the European Commission’s standard contractual clauses.

Data subject rights

Requests for access, rectification, erasure, restriction, objection or portability are the organizer’s responsibility as controller. We assist them through the means of the service (viewing and editing the roll, deletion on request) and pass on without delay any request that reaches us directly. A register that is already published cannot be altered: an erasure request covers the data held outside it.

Personal data breaches

In the event of a data breach affecting an election, we inform the organizer without undue delay after becoming aware of it, with the information available to us: the nature of the breach, the categories of data and of data subjects concerned, the likely consequences and the measures taken. Notifying the supervisory authority and, where applicable, the data subjects is the organizer’s responsibility.

Assistance with compliance

We give the organizer the information needed to demonstrate compliance with their obligations and to carry out an impact assessment where one is required: a description of the protocol, public technical documentation, the source code of the libraries and the verifiable register.

Fate of the data at the end of the service

At the end of the service, nominative data is deleted at the organizer’s request, or returned to them in a usable format if they prefer. One exception, inherent to the service and accepted by using it: a public register already published is not deleted, because erasing it would destroy the integrity proof of the election. It contains no identity in clear, unless the organizer enabled non-anonymous voting.

Audit and verification

The organizer may verify compliance with this agreement: we make the relevant documentation available and answer their written questions. A documentary or on-site audit can be arranged subject to reasonable notice, at their expense, and under conditions that preserve the security and confidentiality of other customers.

Liability and governing law

The liability of the parties is governed by the terms of use. This agreement is subject to French law; the courts of Paris have jurisdiction, subject to the mandatory rules of jurisdiction applicable to consumers.