Data processing agreement (DPA) — UltiSuite

Purpose

This Data Processing Agreement (DPA) template governs the processing of personal data when a client organization deploys UltiSuite for its users.

UltiSuite is self-hostable software. Depending on deployment model, the client organization may be data controller and the host or integrator may act as processor.

This document is a technical template to be validated legally before contractual use.

Roles

Data controller: the organization that determines the purposes and means of processing (employer, institution, client entity).

Processor: the entity that operates UltiSuite infrastructure on behalf of the controller, where applicable.

UltiSuite as software product is not the recipient of user content hosted on the client's infrastructure.

Technical and organizational measures

Encryption of mail credentials and sensitive secrets, OIDC access control, audit logs, configurable retention policies, zero-trust option for end-to-end mail encryption.

Detailed measures are described in the privacy policy and administration documentation.

The data controller configures external integrations (AI, OAuth, payments) and must inform its users via the subprocessors page.

Sub-processors

The list of external subprocessors enabled on an instance is published dynamically on the dedicated page.

UltiSuite components running on the client's own infrastructure are not sub-processors.

Assistance with individual rights

UltiSuite provides export, erasure and consent management mechanisms for relevant processing.

The data controller remains the primary contact for data subjects, with assistance from its UltiSuite administrator.

Contact

Contact your organization administrator for any DPA-related question.

Suite apps

Each app has its own section via URL anchor, for example #ultidocs.

Ultimail

mail, composition, attachments, linked contacts and mail search.

Ultimail processes emails, headers, recipients, drafts, attachments and preferences necessary for the service.
Message content is not used for advertising or sold to third parties.
Mail data is hosted on OVH infrastructure used by UltiSuite.

UltiDrive

storage, organization, sharing and file preview.

UltiDrive processes files, file names, metadata, sharing rights and technical histories useful to the service.
Files are retained as long as the account, workspace or organization maintains them, unless law requires otherwise.
Access and sensitive operations may be logged for security and audit.

UltiDocs

collaborative documents, rich editing, comments and writing aids.

UltiDocs processes document content, technical collaboration history, selections, comments and editing preferences.
Personal dictionaries and editing settings remain linked to the account or browser depending on user configuration.
Writing-aid processing runs in the UltiSuite environment hosted at OVH, without a third-party service provider.

UltiCal

calendar, invitations, availability and shared events.

UltiCal processes titles, locations, times, participants, responses, event notes and reminders.
Availability may be visible according to account or organization settings.
Calendar data is hosted at OVH with the rest of the suite.

UltiMeet

meetings, rooms, invitation links and video conferencing.

UltiMeet processes meeting information, participants, room settings and connection technical data.
Audio/video streams are used to provide communication and are not exploited for advertising.
Technical logs may be retained for security, diagnosis and service quality.

UltiCards

contacts, address books, records and correspondent discovery.

UltiCards processes names, email addresses, phones, organizations, notes and relationship metadata.
Contacts support addressing, search, suggestions and address book management.
Contact data is not resold or used for advertising targeting.

UltiAI

assistant, completion, writing aid and intelligent automations.

UltiAI processes prompts, provided contexts and results necessary for the user's request.
UltiSuite does not use an external service provider for UltiAI; declared infrastructure is OVH.
Data is not used to train an advertising or third-party model.

Administration

organization console, accounts, policies, security and global settings.

The console processes identities, roles, organization settings, security policies and administration logs.
Audit logs help protect accounts, prove certain actions and diagnose incidents.
Administrators may access certain metadata according to their rights and organization settings.

UltiSuite account

profile, authentication, preferences, sessions and personal settings.

The account processes identity, email, preferences, sessions, security settings and sign-in logs.
This data is used to authenticate the user, maintain security and personalize the experience.
The user may request access, rectification, deletion or export under applicable conditions.