Data Processing Agreement

Version 1.5 · Last updated 2026-09-04 · legal@prestancelab.com

This Data Processing Agreement (this "DPA") governs Prestance Lab's processing of Personal Data carried out in the course of providing the Services under the Agreement. Capitalised terms not defined here have the meaning given to them in the General Terms and Conditions or, failing that, in the GDPR. It is incorporated by reference into the Agreement pursuant to GTC §14.3.

1. Roles and definitions

In order to provide the Services, Prestance Lab is required to process the Personal Data of Authorized Users and of the Customer's clients whose data Authorized Users record in client files or that the Customer shares from its own systems. The Parties acknowledge that, with respect to the processing of such Personal Data carried out under the Agreement, the Customer acts as the data controller (the "Controller") and Prestance Lab acts as the data processor (the "Processor").

"Controller", "Data Subject", "Personal Data", "Process / Processing", "Processor", "Sub-processor", "Data Protection Impact Assessment", "Data Protection Officer" and "Personal Data Breach" have the same meaning as in the GDPR.

2. Applicable legislation

Each Party undertakes to comply with the provisions of any applicable legislation concerning the protection of Personal Data, in particular the French Data Protection Act No. 78-17 of 6 January 1978 in its latest version in force and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "GDPR"), together the "Applicable Data Protection Legislation".

3. Description of the processing

The Personal Data processing operations carried out by the Processor are described below.

Concerned service(s)

The Services as defined in the GTCs (Solution, Maintenance Services, and Professional Services where applicable).

Nature of the processing operations

Storage, consultation, organization, structuring, transmission, erasure, recording (voice — the advisor's calls with the assistant and practice sessions only), transcription (speech-to-text), automated text generation (client briefs, debrief summaries, message drafts), automated analysis (coaching feedback in practice sessions; pattern extraction across debriefs), profiling within the meaning of Article 4(4) GDPR limited to (a) an advisor's own practice-score progression over time, visible to that advisor only, and (b) activity counts and conversation patterns per team and per advisor for the Customer's management, and aggregation and anonymization.

Purpose(s) of processing

Performance of the Agreement and provision of the Services, including: enrolment and authentication of Authorized Users; delivery of the assistant over the channels activated in the Order Form (telephone, WhatsApp, SMS, email, and the optional mobile application); maintenance of the client files an advisor builds through their own debriefs, and of the briefs prepared from them; drafting of follow-up and outreach messages that the advisor sends from their own tools; practice sessions in which the Solution plays a client and gives the advisor private coaching feedback; aggregated team signals for the Customer's management; technical support; and security monitoring.

Categories of Data Subjects

(a) Authorized Users of the Customer (typically the Customer's employees acting in a sales-advisor, manager, or administrator role); and (b) clients of the Customer whose Personal Data an Authorized User records in a client file, or that the Customer shares from its CRM.

Categories of Personal Data — Authorized Users

Identity data (first name, last name); professional contact data (professional email address, professional mobile number); authentication metadata (hashed password, MFA token state, session identifiers, enrolled channel identifiers); advisor exchanges with the assistant (call audio and transcripts; WhatsApp, SMS and email message content); practice sessions (voice recordings of simulated client conversations, advisor → persona transcripts, coaching feedback, performance scores — visible to the advisor only); manager signals (activity counts and conversation patterns per team and per advisor); technical telemetry (IP address, device and browser user-agent, connection quality, crash and error logs, pseudonymous usage events). Account administration, authentication and security logs, billing records, and aggregated product analytics that Prestance Lab holds as controller are described in the Privacy Policy (GTC §6.2); they are listed here only where the same records also serve the Customer's processing.

Categories of Personal Data — clients of the Customer

The content of client files as recorded by the advisor: name or initials, contact preferences, purchase and visit history, stated preferences and sizes, occasions and dates, and free-text notes. Where the Customer agrees in the Order Form, a bounded set of data read from the Customer's systems: product and stock information, calendars, and CRM data. Access to Customer systems is read-only; the Customer's CRM remains the master record.

Special categories of Personal Data

None processed by design. Authorized Users are instructed not to record special-category data about clients (Acceptable Use Policy §3). The Solution does not perform emotion recognition in the workplace within the meaning of Article 5(1)(f) of the EU AI Act, and it never records, listens to, or contacts the Customer's clients.

Duration of the processing

Until deletion by the Authorized User or by the Customer administrator, and at the latest at the end of the Agreement followed by the deletion procedure described in Section 5 below and in the Security Policy (typically within 30 days; backups purged within 90 days).

4. Controller's undertakings

The Controller undertakes to:

• Ensure that the collection and transmission of Personal Data to the Processor comply with the Applicable Data Protection Legislation.
• Provide the Processor with any information necessary for the performance of this DPA.
• Document in writing all instructions concerning the processing carried out by the Processor.
• Ensure, beforehand and throughout the duration of the Agreement, that the Processor complies with the obligations of the Applicable Data Protection Legislation.

5. Processor's undertakings

The Processor undertakes to:

• Process Personal Data solely for the performance of the Agreement and, in general, only on the Controller's documented instructions. The Parties agree to negotiate in good faith if the Processor must use resources other than, or in addition to, those required to perform the Services, and thus incurs specific costs, owing to the Controller's instructions regarding the processing of Personal Data. The Processor will inform the Controller without undue delay if, in the Processor's opinion, an instruction given by the Controller constitutes an infringement of the Applicable Data Protection Legislation.
• Limit access to Personal Data to its staff members subject to an obligation of confidentiality.
• Implement appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, to ensure a level of security appropriate to the risk. These measures are described in our Security Policy; the Controller acknowledges and agrees that such measures are sufficient to protect the Personal Data and to ensure compliance with the Applicable Data Protection Legislation.
• Notify Personal Data Breaches to the Controller in writing without undue delay after becoming aware of such Breach, together with any useful information that would enable the Controller, where legally required, to notify the competent supervisory authority and the Data Subjects. Where it is not possible to provide all relevant information at the same time, the initial notification will contain the information then available and further information will, as it becomes available, be provided without undue delay. The initial breach contact is security@prestancelab.com.
• Maintain a list of Sub-processors involved in the processing of Personal Data (Section 7 below). The Sub-processors listed in Section 7 are presumed to be authorized by the Controller. The Processor will inform the Controller of any change to this list before such change is made, in order to give the Controller the opportunity to object within ten (10) calendar days following receipt of such notification, it being understood that such objection will only be valid if the Controller provides objective written justification explaining its position and relating to the capacity of the subsequent Sub-processor to comply with the obligations of the Applicable Data Protection Legislation. The Processor remains fully liable to the Controller for the performance of the Sub-processors' obligations relating to the processing of Personal Data.
• Assist the Controller, to the extent possible, in meeting its obligations to respond to requests from Data Subjects to exercise their rights, taking into account the nature of the processing and the information available to the Processor.
• At the Controller's choice, delete or return all Personal Data to the Controller at the end of the Agreement and delete existing copies, unless otherwise required or permitted by applicable law. Returned data is provided in a structured, commonly used, and machine-readable format (CSV or JSON, depending on the data category).
• Make available to the Controller (or to another auditor appointed by the Controller), at the Controller's expense and request, all information necessary to demonstrate compliance with the obligations set forth in this DPA, and submit its Personal Data processing facilities, data files, and documentation needed for processing the Controller's Personal Data to audits, subject to compliance by the Controller with (i) one month's prior written notice and (ii) a limit of one audit per year. The audit will be conducted during the Processor's normal business hours and will not unreasonably disrupt the Processor's performance of its obligations under the Agreement or the Processor's business in general. The Controller will provide the Processor with a copy of the audit report at no additional cost to the Processor, within a reasonable time following receipt of the audit report.
• Cooperate and assist the Controller, to the extent possible and at the Controller's request, in the performance of a Data Protection Impact Assessment ("DPIA") where such DPIA is legally required.

6. International transfers

7. List of Sub-processors

As of the last-updated date at the top of this page, the following Sub-processors are engaged by the Processor for the provision of the Services. The channel providers (Twilio, Meta Platforms, Resend) are engaged only for the channels activated in the Customer's Order Form.

Telephone calls additionally transit the public telephone network of the advisor's mobile carrier, and WhatsApp messages the WhatsApp service on the advisor's handset; neither is a Sub-processor of Prestance Lab. Prestance Lab's own persistent copy of every exchange, client file, recording and practice session is held in Europe by the hosting Sub-processors above: in the European Union (Germany) for the application and advisor-memory tiers, and in the United Kingdom, under the European Commission's adequacy decision, for the database, authentication and object-storage tier. Transit, observability and abuse-monitoring data retained by a Sub-processor itself is held for the period and in the country stated in that Sub-processor's row and DPA.

8. Updates to this DPA

Pursuant to GTC §2.7, Prestance Lab may update this DPA. Material changes will be notified to active Customers at least thirty (30) days in advance, unless a shorter period is required by law or to address a security risk. Changes to the Sub-processor list follow the procedure set out in Section 5 above.

9. Contact

• Data Protection contact: privacy@prestancelab.com
• Security incidents and Personal Data Breaches: security@prestancelab.com