Partner organizations

Data Processing Agreement

Version of 4 October 2026. Working document undergoing legal review. It supplements the general terms and conditions of partner organizations.

1. Roles

For the data of its participants and administrators, the organization is the data controller: it decides how the data is used. Conversa acts as the data processor: it processes the data solely to provide the service, on the organization's instructions. The data of the independent trainers on the marketplace and of Conversa's individual customers is not covered by this agreement.

2. Purpose, nature and duration

The purpose of the processing is foreign-language speaking practice: conversations with an AI tutor, video sessions with trainers, assessment, progress tracking and delivery of results to the organization. It lasts as long as the contract.

3. Data and data subjects

• Participants: identity, email, external identifier provided by the organization, native language and language practiced, profile photo if they upload one, recordings of their voice during conversations with the AI tutor, transcripts, assessments, trainers' reports, attendance at video sessions.
• Organization administrators: identity, position, email, phone number, login log.

The video and audio of video sessions are transmitted live between participants and are not recorded. No sensitive data within the meaning of Article 9 of the GDPR is requested; the organization must take care not to upload any.

4. Conversa's commitments

• Process data only on the organization's documented instructions, in order to provide the service, and inform it if an instruction appears to it to infringe regulations.
• Ensure confidentiality: only the people who need access to operate the service have it, and they are bound by a duty of secrecy.
• Ensure security: encrypted connections, passwords stored as hashes, each organization's data kept separate, single-use login tokens, restricted administrative access.
• Assist the organization in responding to requests from individuals (access, rectification, erasure, objection) and in meeting its own obligations (impact assessment, consultation of the supervisory authority).
• Notify the organization of any data breach affecting it without undue delay, and no later than 48 hours after becoming aware of it, with the information needed for its own notification.
• Make available to the organization the information necessary to demonstrate compliance with these obligations, and allow reasonable audits, upon written request and with thirty days' notice.

5. Sub-processors

Conversa uses service providers for: hosting of servers and data (in France), online payment, sending emails, voice transcription and synthesis, conversational and assessment artificial intelligence, the video avatar, and the routing of video sessions. Some of these providers process data outside the European Union; these transfers are governed by the European Commission's standard contractual clauses or an adequacy decision.

The named list of sub-processors is provided to the organization upon simple request. Conversa informs it of any addition or replacement, and the organization may object for a legitimate reason; failing agreement, it may terminate without charge.

6. Retention periods

• Voice recordings: 90 days, then automatic deletion.
• Transcripts, assessments and reports: kept for as long as the participant's account exists, to track their progress.
• Accounts: until they are deleted by the organization or the contract ends.
• Invoices: ten years, in accordance with accounting obligations.

7. End of the contract

At the end of the contract, the organization may retrieve its participants' results from its workspace or via the API. Unless requested otherwise, Conversa then deletes its data, backups included, within three months, except for what the law requires to be retained.

8. Obligations of the organization

The organization informs its participants about the processing (purposes, retention periods, rights), has a legal basis to carry it out, and sends Conversa only the data that is necessary. It is the point of contact for the individuals concerned; Conversa forwards to it any request it may receive directly.

See also the privacy policy and the legal notice.