Data Processing Agreement

Annex to the Mandava terms of use · version in force on 2 November 2026.

This Agreement is entered into between MAVOIX DIGITAL SASU, publisher of the Mandava service (hereinafter "the Processor"), and each customer social and economic committee (comité social et économique, "CSE", the elected employee representative body) of Mandava, a legal person distinct from the company in which it is established (hereinafter "the Controller" or "the CSE").

It sets out the undertakings of the parties pursuant to Article 28 of Regulation (EU) 2016/679 of 27 April 2016 (hereinafter "the GDPR").

General provisions

Article 1 – Subject matter and duration

The purpose of this Agreement is to define the conditions under which the Processor, MAVOIX DIGITAL SASU, a single-shareholder simplified joint-stock company (société par actions simplifiée unipersonnelle) with a share capital of €300, whose registered office is at 4 place Albert Uderzo, 78420 Carrières-sur-Seine, France, registered with the Versailles Trade and Companies Register (RCS) under number 131 836 173, undertakes to carry out, on behalf of the CSE, processing operations concerning the personal data (hereinafter "the Data") defined below in connection with the Mandava service (hereinafter "the Service").

It is entered into pursuant to Article 28 of the GDPR and forms an annex to, and an integral part of, the terms of use of Mandava (hereinafter "the Terms of Use"). In the event of any conflict between the Terms of Use and this Agreement as regards the protection of the Data, this Agreement shall prevail.

This Agreement takes effect on the creation of the CSE's space in the Service or, failing that, on the date on which the Terms of Use are accepted, and applies for as long as the Service is used, subject to the provisions of Articles 15 and 17.

The Processor remains solely responsible for the processing that it carries out on its own account: the access accounts of the elected representatives and the security of the Service, the invoicing of licences and the mandava.fr showcase site. That processing is described in the privacy policy.

Article 2 – Nature and purpose of the processing

The Processor is authorised to process the Data on behalf of the CSE solely to the extent necessary for the provision of the Service.

The processing operations carried out are as follows:

• hosting, storage and back-up of the Data;
• organisation, structuring, consultation and making available of the Data within the Service;
• sending of electronic messages on behalf of the CSE;
• analysis and drafting of texts by Vérity, Mandava's drafting service: draft minutes and reports, summaries of texts, replies providing general legal information, reading of expense supporting documents;
• transcription of meetings and remote meetings;
• the employees' telephone line, where the CSE has subscribed to it: automated voice greeting, general legal information and forwarding of questions to the elected representatives.

The sole purpose of the processing is the provision of the Service to the CSE for the performance of its duties, to the exclusion of any other purpose, in particular any commercial or statistical purpose of the Processor's own. The Data are never disclosed to the employer.

Article 3 – Types of data and categories of data subjects

The types of Data processed in connection with the Service are as follows, depending on the functions used by the CSE:

• identification and contact data of the elected representatives and representatives (surname, first name, email address, nature of the mandate, functions within the CSE, delegation-hours credit);
• employee defence files: identity, position, nature of and reason for the measure contemplated, the employee's version of events, interview notes, facts and outcome;
• data of employees benefiting from social and cultural activities: staff number, surname, first name, email address, start date, department, years of birth of children, leaving date;
• questions addressed to the CSE by employees, with their first name and email address if they choose to provide them, and a call-back number if they provide it voluntarily by telephone;
• meetings: transcript of statements, name and capacity of participants, named votes, attendance sheets, minutes; for a meeting recorded at the table, the sound of the meeting, kept for the duration of the meeting only (24 hours at most), and the voice matched to each participant by the secretary;
• contact details of management representatives and correspondence exchanged with them;
• data relating to sites, visits and inquiries, in particular following an accident at work;
• expense supporting documents, CSE accounts, collective agreements, job descriptions and other documents uploaded by the CSE.

The categories of data subjects are as follows: the elected representatives and representatives sitting on the CSE; the employees of the company, in particular those whom the CSE supports, those who benefit from its social and cultural activities and those who put a question to it, in writing or by telephone; meeting participants; management representatives.

The Service records the nature of each elected representative's mandate, which reveals the trade union membership of representatives and trade union delegates. That processing is necessary for the exercise of the rights of the CSE and of its members in the field of employment law (Article 9.2.b of the GDPR); the corresponding Data are never disclosed to the employer by the Service, except in the documents that the CSE itself chooses to send to the employer, such as delegation-hours slips.

The files, inquiries and employees' questions may contain data concerning health, or the facts alleged against an employee in the context of disciplinary proceedings or an employment dispute. The CSE records them only to the extent necessary for its duties. Before anything is sent to Vérity, the name of the employee in a defence file is replaced by "the employee".

Obligations of the Processor

Article 4 – Documented instructions

The Processor shall process the Data only on documented instructions from the CSE, including with regard to transfers of Data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor shall inform the CSE of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Terms of Use, this Agreement and the configuration of the Service carried out by the CSE constitute its documented instructions. Any additional instruction shall be given in writing.

The Processor shall immediately inform the CSE if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. It may then suspend the execution of the instruction concerned until it is confirmed or amended by the CSE.

Article 5 – Confidentiality

The Processor guarantees the confidentiality of the Data processed under this Agreement. The persons at Mavoix Digital responsible for operating the Service have technical access to the database. They do not consult the Data of a CSE, except at its written request in order to assist it, or strictly to the extent necessary to restore the Service or deal with a security incident; the CSE is then informed.

It shall ensure that the persons authorised to process the Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, that they have access only to the Data necessary for the performance of their tasks, and that they receive the necessary training in personal data protection.

The Processor shall not disclose the Data to any third party, and in particular never to the employer, except to Sub-processors authorised in accordance with Article 7, or in compliance with a legal obligation under the conditions provided for in Article 4.

Article 6 – Security of processing

In accordance with Article 32 of the GDPR, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of the data subjects.

The measures actually implemented in the Service are as follows:

• encryption of all exchanges between users' browsers and the Service (HTTPS); calls to the employees' line pass through the telephone network, which is not end-to-end encrypted; database and files hosted with Cloudflare, in the European Union;
• segregation of the Data: each item of Data is attached to a single CSE, and only the active elected representatives of that CSE have access to it; the employer has no access to the Service;
• access to defence files restricted to the elected representatives designated for each file;
• passwordless login, by a six-digit code sent by email, single-use and valid for fifteen minutes, stored in hashed form; the number of codes and attempts is limited;
• session protected by a signed cookie, inaccessible to scripts and restricted to encrypted connections, revocable at any time and limited to thirty days; an elected representative removed from the CSE loses access immediately;
• browser protections against the display of the Service within another page and against requests originating from another site;
• log of the actions carried out in the Service, which can be neither modified nor erased, except for the removal of the name and address of an elected representative who deletes their account, and upon erasure of the CSE's space;
• the ability to suspend the transcription of a meeting during confidential passages: neither the sound nor the text of them is kept, and this sound is never sent to a Sub-processor;
• sound of a meeting recorded at the table encrypted (AES-256) in the Service's storage, in the European Union, for the duration of the meeting; erased as soon as the full transcript is received, and at the latest 24 hours after capture, by an hourly automatic purge;
• erasure of the CSE's space subject to a recent login and to explicit confirmation;
• internal security checks of the Service's code, carried out regularly and upon each significant change.

The Processor may change these measures, provided that it never reduces the overall level of security of the Service.

Article 7 – Sub-processors

The CSE gives the Processor general written authorisation to engage the Sub-processors listed in the annex to this Agreement, in Articles 18 to 22, to carry out the processing activities described therein.

The Processor shall inform the CSE in advance and in writing of any intended changes concerning the addition or replacement of a Sub-processor, at least thirty days before that change, specifying the processing activities concerned, the identity and contact details of the Sub-processor and the applicable transfer safeguard.

The CSE has a period of fifteen days from the date of that notice in which to object in writing, stating its reasons. In the event of an objection, the parties shall seek a solution in good faith; failing agreement within fifteen days of the objection, the CSE may terminate the Service in writing, without penalty, with effect from the date of the change. The Processor shall then refund the portion of the price paid in advance for the remaining period.

The Processor shall impose on each Sub-processor, by contract, the same data protection obligations as those set out in this Agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures. It remains fully liable to the CSE for the performance of the Sub-processors' obligations.

Article 8 – Location and transfers outside the European Union

The database and files of the Service are hosted in the European Union. Certain functions nevertheless rely on Sub-processors established outside the European Union, listed in the annex. By accepting this Agreement, the CSE instructs the Processor to transfer the Data to those Sub-processors, solely for the services described in the annex. No other transfer takes place without documented instructions from the CSE, in accordance with Article 4.

Each transfer relies on one of the safeguards provided for in Articles 44 to 49 of the GDPR: the adequacy decision (EU) 2023/1795 of 10 July 2023, where the recipient appears on the list of the EU–US data protection framework ("Data Privacy Framework"); failing that, the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), module 3, entered into between the Processor and the Sub-processor, accompanied by a written assessment of the transfer and, where necessary, by additional measures.

The safeguard applicable to each Sub-processor is specified in the annex. Where a safeguard is merely declared by the Sub-processor, the annex says so expressly. At the written request of the CSE, the Processor shall provide it with a copy of the documents establishing the safeguard applicable to each transfer.

Article 9 – Assistance with the exercise of data subjects' rights

The Processor shall assist the CSE, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling the CSE's obligation to respond to requests from data subjects for exercising their rights laid down in Chapter III of the GDPR, in particular the rights of access, rectification, erasure, restriction, objection and data portability.

Where a data subject submits a request to exercise their rights directly to the Processor, the Processor shall forward it without delay to the CSE, by email, and shall not respond to it itself, unless instructed to do so in writing by the CSE.

The Processor makes available to the CSE, within the Service, the functions enabling it to consult, rectify, delete and download the Data, or carries out those operations on the CSE's documented instructions in accordance with Article 4.

Article 10 – Personal data breach

The Processor shall notify the CSE of any personal data breach, including one occurring at a Sub-processor, without undue delay after becoming aware of it, and no later than forty-eight hours thereafter. The notification shall be sent by email to the secretary of the CSE and to the administrator of its space in the Service, or to any other address designated by the CSE in writing.

The notification shall contain at least the following information, provided in phases where it cannot be provided at the same time:

• the nature of the breach, including, where possible, the categories and approximate number of data subjects and of Data records concerned;
• the name and contact details of the contact point where more information can be obtained: MAVOIX DIGITAL SASU, [email protected], +33 1 89 31 78 51;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and, where appropriate, to mitigate its possible adverse effects.

It is for the CSE to notify the breach to the supervisory authority and, where appropriate, to the data subjects, the Processor providing it with the necessary assistance.

Article 11 – Data protection impact assessments and prior consultation

Taking into account the nature of the processing and the information available to it, the Processor shall assist the CSE in carrying out the data protection impact assessments provided for in Article 35 of the GDPR, in particular by providing it with the description of the processing operations carried out in the Service and of the security measures implemented pursuant to Article 6.

The Processor shall also assist the CSE, where appropriate, in carrying out the prior consultation of the supervisory authority provided for in Article 36 of the GDPR, by providing it with the relevant information in its possession.

Article 12 – Documentation and audits

The Processor shall make available to the CSE all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and in this Agreement, in particular the description of the security measures and the up-to-date list of Sub-processors.

The Processor shall allow for and contribute to audits, including inspections, conducted by the CSE or by an auditor mandated by it. The mandated auditor shall be bound by a duty of confidentiality and may not be a competitor of the Processor.

The CSE shall inform the Processor of any audit in writing, giving thirty days' notice. Save in the event of a data breach, serious indications of a breach of obligations or a request from a supervisory authority, audits shall take place no more than once a year and shall be at the CSE's expense. The audit shall take place during business hours, without disrupting the operation of the Service or prejudicing the data of the Processor's other customers.

As regards Sub-processors, the Processor shall provide their available audit reports or certifications. It keeps the record of processing activities provided for in Article 30.2 of the GDPR and communicates it to the CSE on request. It shall cooperate with the supervisory authority at its request.

Obligations of the CSE and final provisions

Article 13 – Obligations of the CSE

The CSE undertakes to:

• provide the Processor with the Data and with lawful documented instructions that comply with the GDPR;
• inform data subjects of the processing of their Data, in accordance with Articles 13 and 14 of the GDPR, in particular the employees who put a question to it, the employee whose file it holds and the meeting participants whose statements are transcribed;
• where it has subscribed to the employees' line, display in the company the information poster for the line, supplied by the Processor;
• have a legal basis for each of the processing operations entrusted to the Processor, and record only the Data necessary for its duties;
• set the retention periods for its own Data, and erase those that are no longer useful;
• ensure, beforehand and throughout the duration of the processing, compliance with the obligations laid down in the GDPR for its own processing operations, and supervise the processing, including by means of audits.

Article 14 – The employees' line

Where the CSE has subscribed to the employees' line, each call is taken by an automated voice assistant. From the start of the call, in French, it states that it is an automated assistant and not a person, that the call is not recorded and that it gives general information; where the caller chooses another language, it repeats this in that language.

The caller's voice is not recorded. The text of the conversation is used only during the call, then deleted at the Sub-processor responsible for the voice (Article 20). The question asked is forwarded to Vérity (Article 19), without the caller's number or first name. For each call, the Service keeps only its start and end time, the number of questions asked and forwarded, and the number of questions by subject and by month. The caller's number is kept by the Service only in the form of a fingerprint encoded with a secret key, recorded only when an incorrect code is given, and erased no later than two days afterwards; it serves solely to limit attempts. The operator of the line (Article 21) retains the call routing data in accordance with its own obligations.

Where the caller asks for their question to be forwarded to the elected representatives, it is filed in the CSE's space together with, if they voluntarily provide them, their first name and a call-back number. The employer has access neither to the calls nor to the questions; however, a call made from a company telephone may appear on the company's bill.

Article 15 – Fate of the Data at the end of the Agreement

The CSE may, at any time, download its Data from the Service; files that cannot be downloaded directly from it are handed over on simple request. The Data are provided in a structured and commonly used format.

Upon the end of the provision of the Service, for whatever reason, the Service becomes read-only from the following day, and the CSE may still download all of its Data for thirty days. Thirty days after the end of the Service, the Processor shall delete the Data in the Service, unless Union or Member State law requires storage of the Data; in that case, the Data retained shall be limited to what that law requires and shall not be subject to any other processing. Back-up copies and those of the Sub-processors disappear at the end of their retention period, and no later than ninety days after the end of the Service; they are no longer used in the meantime.

In the event of the Processor ceasing its activity, the CSE may obtain the return of its Data under the conditions of this Article.

The Processor shall provide written confirmation of the deletion at the request of the CSE.

Article 16 – Liability

Each party shall be liable for damage resulting from its own breaches of the GDPR and of this Agreement, under the conditions laid down in Article 82 of the GDPR.

The Processor shall be liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the CSE. Each party shall bear the administrative fines imposed on it.

Article 17 – Term, acceptance and governing law

This Agreement is accepted by the CSE at the same time as the Terms of Use, and does not need to be signed separately. On request, the Processor shall provide the CSE with a signed copy.

It remains in force for as long as the Service is provided, and its provisions on the fate of the Data set out in Article 15 shall survive until they have been fully performed.

This Agreement is drafted in French; any translation is provided for information only and, in the event of discrepancy, the French version prevails. The Processor shall inform the CSE by email, at least thirty days in advance, of any amendment to this Agreement; an amendment that reduces the protection of the Data applies only with the written agreement of the CSE.

This Agreement is governed by French law. In the event of a dispute, the parties shall first seek an amicable solution; failing that, the competent French courts shall be seised.

Annex: list of Sub-processors

Article 18 – Cloudflare, Inc.

• Country of processing: European Union for the database and files; United States and the host's global network for routing and automated processing.
• Services entrusted: hosting of the application and of the showcase site, database, file storage, receipt of emails addressed to the CSE, live transcription of meetings, encrypted storage of the sound for the duration of the meeting, reading of uploaded documents, remote meetings.
• Data concerned: all the Data processed in connection with the Service.
• Transfer safeguard: participation of Cloudflare, Inc. in the EU–US Data Privacy Framework and, failing that, standard contractual clauses of the European Commission.

Article 19 – Anthropic, PBC

• Country of processing: United States.
• Services entrusted: drafting and analysis of texts performed by Vérity within the Service.
• Data concerned: the texts submitted to Vérity (questions, meeting transcripts, files without the employee's name, expense supporting documents, job descriptions, agreements), as well as employees' questions written in a language other than French and the replies of the elected representatives, for their translation.
• Transfer safeguard: standard contractual clauses of the European Commission, incorporated in Anthropic's data processing agreement.

Article 20 – ElevenLabs

• Two services: the full transcription of meetings recorded at the table; the employees' line, only where the CSE has subscribed to it.
• Country of processing: United States (Eleven Labs Inc.; ElevenLabs Poland sp. z o.o. for the European Economic Area).
• Meetings — service entrusted: at the end of the meeting, transcription of all the recorded sound, with separation of voices. Data concerned: the sound of the meeting (excluding confidential passages), and the names of the CSE members and management contacts recorded in the Service, sent so that they are spelled correctly. Retention: the Service erases the sound on its side as soon as the transcript is received; ElevenLabs may retain the sound and text under its own terms, the Processor not having subscribed, to date, to ElevenLabs' "zero retention" offer, reserved for its Enterprise customers.
• Employees' line — services entrusted: voice greeting and transcription of the conversation during the call.
• Employees' line — data concerned: the caller's voice during the call, the text of the conversation and the caller's number.
• Employees' line — use and retention: the voice is not recorded and the text of the conversation is deleted at the end of the call; the Processor has refused the use of the content to improve ElevenLabs' services. ElevenLabs itself uses, to understand and formulate sentences, providers listed in its data processing agreement.
• Transfer safeguard: standard contractual clauses of the European Commission, incorporated in ElevenLabs' data processing agreement; participation in the EU–US Data Privacy Framework declared by ElevenLabs.

Article 21 – Telnyx LLC

• Only where the CSE has subscribed to the employees' line.
• Country of processing: United States.
• Services entrusted: operator of the telephone line (number and routing of calls).
• Data concerned: the caller's number and the call routing data.
• Transfer safeguard: participation in the EU–US Data Privacy Framework declared by Telnyx LLC and, failing that, standard contractual clauses of the European Commission.

Article 22 – Brevo (Sendinblue SAS)

• Country of processing: France and the European Union.
• Services entrusted: sending of the emails issued by the Service (login codes, agendas, reminders, notices to employees, delegation-hours slips and requests addressed to management at the CSE's initiative).
• Data concerned: the recipients' email addresses and the content of the emails.
• Transfer safeguard: not applicable to processing carried out within the European Union; any transfers outside the Union are covered by standard contractual clauses of the European Commission.

For any question about this Agreement: [email protected].