Last updated: September 2026
Personal Data Processing Agreement (DPA)
This agreement applies between React Consulting SARL AU, publisher of React Box (the “processor”), and each customer organization — business or accounting firm — using the service (the “customer”, controller). It supplements the terms of use; accepting them means accepting this agreement.
1. Purpose
This agreement sets out the conditions under which React Box processes, on the customer's behalf, the personal data contained in the documents and management data the customer processes in the service, in accordance with Law No. 09-08.
2. Term
The agreement applies throughout the customer's use of the service, then until the data is erased or returned under the conditions of section 14.
3. Nature and purposes of processing
Hosting, storage, organization, consultation, sharing and transmission of documents and management data; issuing and sending the customer's invoices and reminders; receiving emails addressed to the customer's drop-off address; digitization (OCR), sorting of received emails and assistance by the Atlas assistant when the customer triggers them; export and deletion of data. This processing has no purpose other than providing the service to the customer.
4. Categories of data subjects and data
Data subjects: the customer's customers, suppliers and other third parties and their contacts; the customer's employees and users; people appearing in documents and received emails. Data: documents and metadata; identity, ICE, IF, RC, TP, CNSS, bank details (IBAN/RIB), contacts and addresses of third parties; national identity card number (CIN) of third parties who are natural persons, when the customer chooses to fill it in; bank accounts, statements and cash receipts; invoices, credit notes, reminders and purchase invoices; chart of accounts and postings; received emails (sender, recipients, subject, body, attachments); conversations, messages and document requests; conversations with the Atlas assistant; share link access logs. Data for which React Consulting SARL AU is itself the controller (user accounts, subscriptions, security, audience measurement, support) is governed by the privacy policy, not by this agreement.
5. Customer instructions and no use for our own purposes
React Box processes the customer's data only on its documented instructions, which result from the terms of use, this agreement and the actions taken by the customer's users in the service. React Box never uses this data for its own purposes: no analysis for its own ends, no training of artificial intelligence models, no sale, rental or commercial disclosure to a third party. If an instruction appears to infringe the regulations, React Box informs the customer.
6. Confidentiality
Persons authorized to process the customer's data are bound by a confidentiality obligation. Our teams do not access the content of the customer's documents, except for a documented technical necessity or a legal obligation.
7. Security measures
React Box implements appropriate technical and organizational measures: TLS encryption of exchanges, encryption at rest (AES-256) of files, access control through roles and permissions defined by the customer, available two-factor authentication, password checks against known breaches, short-lived signed URLs, logging of actions on documents and of consultations of sensitive data, masking of CIN numbers with consultation restricted to the roles authorized by the customer, least-privilege principle.
8. Sub-processors
The customer authorizes the use of the sub-processors listed in the privacy policy, with their country and the nature of the data they receive. React Box imposes on them data protection obligations equivalent to those of this agreement. Any addition or replacement is announced to the customer at least 30 days in advance; the customer may object on legitimate grounds and, failing agreement, cancel its subscription.
9. Transfers outside Morocco
The customer's data is stored in the European Union. Some operations involve a transfer to the United States: artificial intelligence processing by Together AI, Inc. (zero data retention), Cloudflare's global cache for session-validity information and, for at most 10 minutes, dashboard and analytics aggregates (amounts, customer and supplier names), relaying of push notifications (generic text, no identifying data). React Box provides the customer with the information needed for its own formalities with the CNDP — sub-processors, countries, data and safeguards — in a dedicated sheet provided on request.
10. Assistance to the customer
React Box helps the customer, as far as possible, to answer data subjects' requests (access, rectification, objection), in particular through the service's export, editing and deletion features, and forwards without delay any request it receives directly. React Box also assists the customer with its CNDP formalities and its risk assessments.
11. Personal data breach notification
React Box notifies the customer of any personal data breach affecting it within [TO BE DEFINED — 72 hours by default] of becoming aware of it, with the available information on its nature, the data and data subjects concerned, its likely consequences and the measures taken or planned.
12. Customer's responsibility for sensitive data
The customer remains solely responsible for the data it chooses to process. In particular, a third party's CIN number is data processed on its behalf, whose collection requires prior authorization from the CNDP that the customer must obtain before filling in this field; the same applies to any sensitive data within the meaning of Law 09-08 contained in the documents it uploads.
13. Audit
React Box makes available to the customer the information needed to demonstrate compliance with this agreement. The customer may, at its own expense and with 30 days' notice, have an audit carried out by an independent auditor bound by secrecy, limited to one audit per year, except in the event of a proven breach.
14. Return and deletion of data at the end of the contract
The customer can export its documents and data at any time, including during a suspension. When its organization is suspended or the contract ends, the data is kept for at least 30 days; its administrators are informed by email on the same day, then 7 days and 1 day before the deadline. Settling the situation before the deadline cancels the deletion. From the deadline, the data may be permanently deleted by React Box, including working copies. Only the subscription invoices issued by React Box are kept, under its own legal obligations. The customer remains solely responsible for keeping the documents the law requires it to keep, in particular for ten years under Law No. 9-88 and the General Tax Code, and must export them before the deadline.