Partner organizations

Data Processing Agreement

Version of 4 October 2026. Working document undergoing legal review. It supplements the general terms and conditions of partner organizations.

1. Roles

For the data of its learners and administrators, the organization is the data controller: it decides how the data is used. Conversa acts as the processor: it processes the data only to provide the service, on the organization's instructions. The data of independent trainers on the marketplace and of Conversa's individual customers is not covered by this agreement.

2. Purpose, nature and duration

The purpose of the processing is foreign-language speaking practice: conversations with an AI tutor, video sessions with trainers, assessment, progress tracking and delivery of results to the organization. It lasts as long as the contract.

3. Data and data subjects

• Learners: identity, email, external identifier provided by the organization, native language and language practiced, profile photo if they upload one, recordings of their voice during conversations with the AI tutor, transcripts, assessments, trainer reports, attendance at video sessions.
• Organization administrators: identity, position, email, phone number, login log.

The video and audio of video sessions are transmitted live between participants and are not recorded. No sensitive data within the meaning of Article 9 of the GDPR is requested; the organization must take care not to upload any.

4. Conversa's commitments

• Process data only on the organization's documented instructions, in order to provide the service, and inform it if an instruction appears to it to infringe regulations.
• Ensure confidentiality: only the people who need access to operate the service have it, and they are bound by a duty of secrecy.
• Ensure security: encrypted connections, passwords stored as hashes, each organization's data kept separate, single-use login tokens, restricted administrative access.
• Assist the organization in responding to requests from individuals (access, rectification, erasure, objection) and in meeting its own obligations (impact assessment, consultation of the supervisory authority).
• Notify the organization of any data breach affecting it without undue delay, and no later than 48 hours after becoming aware of it, with the information needed for its own notification.
• Make available to the organization the information necessary to demonstrate compliance with these obligations, and allow reasonable audits, upon written request and with thirty days' notice.

5. Sub-processors

Conversa uses service providers for: hosting of servers and data (in France), online payment, sending emails, voice transcription and synthesis, conversational and assessment artificial intelligence, the video avatar, and the routing of video sessions. Some of these providers process data outside the European Union; these transfers are governed by the European Commission's standard contractual clauses or an adequacy decision.

The named list of sub-processors is provided to the organization upon simple request. Conversa informs it of any addition or replacement, and the organization may object for a legitimate reason; failing agreement, it may terminate without charge.

6. Retention periods

• Voice recordings: 90 days, then automatic deletion.
• Transcripts, assessments and reports: for as long as the learner's account exists, for progress tracking.
• Accounts: until they are deleted by the organization or the contract ends.
• Invoices: ten years, in accordance with accounting obligations.

7. End of the contract

At the end of the contract, the organization can retrieve its learners' results from its space or via the API. Unless requested otherwise, Conversa will then delete its data, including backups, within three months, except for anything the law requires to be retained.

8. Obligations of the organization

The organization informs its learners about the processing (purposes, durations, rights), has a legal basis to carry it out, and sends Conversa only the data that is necessary. It is the point of contact for data subjects; Conversa forwards to it any request it receives directly.

See also the privacy policy and the legal notice.