Your data in Mandava

Who is responsible

What the elected representatives put in their CSE's space (meetings, files of the employees they assist, accounts, questions received) is under the responsibility of the CSE. Mandava processes it on behalf of the CSE, only to make the service work: this is the processor role provided for by Article 28 of the General Data Protection Regulation (GDPR).

Mavoix Digital's commitments for this CSE data are set out in the data processing agreement, annexed to the terms of use.

Mavoix Digital, the publisher of Mandava, is the controller of its own processing: the elected representatives' e-mail addresses and sign-ins, the security of the service, the invoicing of licences and this website. Its contact details are in the legal notice. Each elected representative's mandate and functions are part of the CSE's data.

On what legal basis

For the CSE's data, the CSE sets the legal basis of each processing operation, according to its duties under the French Labour Code.

For its own processing, Mavoix Digital relies on:

• the contract with the CSE: elected representatives' accounts and sign-ins, sending of codes;
• its legitimate interest in protecting the service: log, limits on attempts, keyed hashes against mass submissions;
• its legal obligations: invoices kept for ten years.

What Mandava keeps

The elected representatives

First name, last name, e-mail address, mandate (full member, alternate, union representative…) and functions in the CSE (secretary, treasurer…).

The CSE's work

Meetings and their agendas, the text of recorded meetings, the minutes, the files of the employees being assisted, expenses and photos of receipts, the calendar, visits and inspections, and the management's promises, followed from one meeting to the next. A receipt uploaded but never saved with an expense is erased after 24 hours.

Reports published for employees

After each meeting, the CSE secretary may publish the report, stripped of names and confidential information, or, after explicit confirmation, the full minutes (Article L2315-35 of the French Labour Code). Only what the secretary publishes becomes readable, without an account, by the employees who open the question box link. Nothing is visible before this action, and the secretary can withdraw it at any time.

Employees' questions

The text of the question and, only if the employee wishes: their name, their department, an e-mail address to be notified of the answer. This address is used only to notify them: the elected representatives do not see it. When a question is asked from a site's poster, it is filed under that site (the employee can remove it if it is not theirs). To prevent mass submissions, Mandava keeps for two days a keyed hash of the connection, which does not contain the internet address.

Questions left in French in the question box are never passed to Vérity. A question written in another language is passed to it to be translated into French, without its author's name, department or address; the translation is kept with the CSE's data and erased with it. Likewise, for an employee who reads the page in another language, what the CSE publishes and the elected representatives' replies are translated by Vérity; these translations are kept with the CSE's data and erased with it.

The employee line (option)

If the CSE has chosen this option, employees call a phone number and give the CSE's code. You are speaking to an automated assistant, not a person. The voice is never recorded: it is understood during the call, then forgotten, and the text of the conversation is erased at the end of the call. The question asked is passed to Vérity to find the rule that answers it. For each call, Mandava keeps only the start and end time and the number of questions, to count the minutes of the month.

Mandava does not keep the caller's number. To block anyone trying codes at random, Mandava keeps for two days at most a keyed hash of the number, only when a wrong code is given; it is used only to count attempts. The telephone operator (Telnyx), like any operator, keeps the technical record of the call (number, time, duration) to route and bill it. A call made from a company phone may appear on the employer's phone bill.

If the caller asks, their question is passed on to the elected representatives: it arrives in the question box, with, only if they give them, their first name and a number to call them back. A question that speaks of harassment, violence, distress or danger is reported immediately to the CSE secretary by e-mail, without copying the question. The elected representatives also see, month by month, the number of questions asked on each subject (overtime, leave…): a simple count, without the question or the caller.

Company agreements

The agreements that the elected representatives upload are kept with the CSE's data and filed article by article, so that Vérity can cite them when an elected representative or an employee asks a question. The text of an agreement in PDF is read by Cloudflare; that of a scanned or photographed agreement is read by Vérity, and marked "to be checked".

Employee surveys

When the CSE asks a question in an anonymous survey, Mandava keeps only the totals of each answer (by site, if the CSE chose so): never a single answer, never its time, never free text. So that a given phone answers only once, the phone keeps a randomly generated token, and Mandava keeps only a keyed hash of it, without the answer, with the day only; to prevent mass submissions, it also keeps a keyed hash of the connection, which does not contain the internet address. These keyed hashes are erased when the survey closes. This is reasonable protection, not a certified vote: a person with two phones can answer twice. On a site with fewer than five answers, the results are not broken down. Employees see the results only if the elected representatives publish them.

Employees, for gift vouchers

If the CSE distributes gift vouchers with Mandava, it uploads the employee file sent by the management. Mandava keeps only what is necessary: last name, first name, employee number, e-mail address, start date, department, and, only if the file provides them, the children's years of birth (for the children's Christmas or the back-to-school allowance). For each gift: the amount and the date on which the employee confirmed having received it. Only the treasurer, the secretary and the CSE administrator see this list; the other elected representatives and the management do not see it. The personal link sent to the employee is kept nowhere: only its keyed hash. This data is never passed to Vérity.

The sound of meetings

When the CSE records a meeting at the table, each minute of sound is turned into text by Cloudflare, for the text shown live. The sound is also kept for the duration of the meeting, encrypted, in the CSE's space (in the European Union): at the end of the meeting, it is sent in one piece to ElevenLabs, which transcribes the whole meeting and separates the voices ("Voice 1, Voice 2…"), so that the minutes say who spoke and who voted. To spell names correctly, ElevenLabs also receives the names of the CSE members and of the management contacts recorded in Mandava.

The sound is erased as soon as this transcript is received, and at the latest 24 hours after it was captured, even if the transcription fails (the minutes are then drafted from the live text, and the screen says so). Mandava then suggests a name for each voice, based on the introductions at the start of the meeting; the CSE secretary confirms or changes it, and this choice is kept with the transcript. Passages declared confidential are never recorded, kept or sent.

Under its own terms, ElevenLabs may retain the sound and text it receives. Mavoix Digital has not, to date, subscribed to ElevenLabs' "zero retention" offer, which is reserved for its Enterprise customers; this page will say so on the day it does.

Remote meetings

Sound and image pass from one participant to another through Cloudflare's relay, for the duration of the meeting: they are never recorded. Mandava keeps only the day the room was opened, the time of the start-of-meeting check, and the guest links (in encrypted form). The name and capacity that a guest enters on joining are shown to the other participants during the meeting, without being kept by Mandava; their browser remembers them for next time.

If the secretary records the remote meeting for the minutes (the CSE having decided so, Article D2315-27 of the French Labour Code), a banner announces it to all participants, guests included. Each device then sends only what the person using it says, at the moment they speak: nothing during silence, nothing when their microphone is muted, nothing during a confidential passage or a suspension of the session. This sound is turned into text, then forgotten: the sound is never kept. The text is filed in the meeting's transcript with the name and capacity of the person who spoke, as they were displayed under their image (a guest, who is not a CSE member, is always marked "guest" there); it is erased thirty days after the minutes are validated, like any transcript. Once the minutes are validated, nothing more is added to their transcript.

To control the cost of transcription, Mandava counts the minutes of sound transcribed for each CSE (with the meeting, the time, and the device or participant that sent them, without the sound or the text), and the minutes sent to ElevenLabs each month: beyond the monthly ceiling, recording stops and the screen says so.

Votes during a remote meeting. By show of hands, each elected representative's choice is recorded and appears in the minutes. By secret ballot (Article D2315-1 of the French Labour Code), Mandava records only who voted, never how they voted: the ballots are counted separately, without a name, and only the total (for, against, abstentions) is kept at the close. No one, neither the elected representatives, nor the management, nor Mandava's publisher, can link a vote to the person who cast it.

Security

To sign in, the elected representative receives a code by e-mail; Mandava keeps only a keyed hash of it, valid for fifteen minutes. The session lasts thirty days on the same device, then a new code is needed.

Where the data is

The database and the files (photos of receipts) are hosted by Cloudflare and stored in the European Union. Each CSE has its own space: a CSE never sees another's data.

Some automated processing by Cloudflare (turning sound into text, reading agreements in PDF, relaying remote meetings, delivering pages) may take place outside the European Union, notably in the United States; Cloudflare participates in the EU–U.S. Data Privacy Framework.

Who else sees data

Your company's management has no account in Mandava: it sees only what the CSE publishes for all employees, the e-mails the CSE sends it and, if invited, the remote meeting. Inside the CSE, an employee's file is seen only by the elected representatives who assist them.

To work, Mandava relies on these providers, which act only on its instructions:

• Cloudflare hosts the service, turns the sound of meetings into text for the live view, keeps this sound encrypted for the duration of the meeting, relays the sound and image of remote meetings, and reads the text of company agreements uploaded as PDF.
• Brevo (France) sends the e-mails: sign-in codes, agendas, notices of reply to employees, gift voucher confirmation links, and the message that tells us about a trial request.
• Stripe (Ireland) processes card payments for the licence and line top-ups: the card number is entered at Stripe, and Mandava never sees or stores it. Mandava only keeps the payment reference, amount and date, for the invoice.
• Vérity, Mandava's drafting service, drafts the draft minutes and reports, reads receipts and answers questions about the law. To do so, it passes the necessary text to a technical provider established in the United States. This transfer is governed by the European Commission's standard contractual clauses. This provider keeps these texts only for the time needed for the security of its service and does not use them for its own purposes.
• ElevenLabs (Eleven Labs Inc., United States) transcribes the whole of a meeting recorded at the table, separating the voices, from the sound sent at the end of the meeting (see "The sound of meetings"). This transfer to the United States is governed by the European Commission's standard contractual clauses, provided for in its data processing terms.
• For the employee line only: Telnyx carries the call, and ElevenLabs understands the caller's speech and answers them with a synthetic voice, without recording the voice and erasing the text of the conversation at the end of the call. Both providers are established in the United States; this transfer is governed by the European Commission's standard contractual clauses, provided for in their data processing terms.

Questions left in French in the question box are never passed to Vérity; a question written in another language is passed to it only to be translated, without its author's name, department or address. The name of an employee being defended is never passed to Vérity. On the employee line, only the question asked by phone is passed to it, without the caller's number or first name. To draft the report of an interview, and only at the request of an elected representative who assists the employee, Vérity receives the interview notes, the facts and the outcome, the employee's first and last name being replaced by "the employee" before sending.

Reminders sent by e-mail on a file (date of the interview, last day of the decision) go only to the elected representatives who assist the employee, and never contain their name.

Mandava's publisher does not read a CSE's data, except at that CSE's request, to help it.

If you ask for a trial

The form on the page Demander un essai (in French) collects your name, the name of your works council or company, your e-mail address, your phone number (optional) and your message. We use them only to reply to you. The legal basis is your consent: the tick box.

The request reaches Mavoix Digital's mailbox by e-mail, sent through Brevo; the site does not keep it. If you do not follow up, it is deleted three years after our last exchange. You can ask for it to be erased at any time at [email protected].

For how long

• The sound of meetings recorded at the table: kept, encrypted, for the duration of the meeting; erased as soon as the full transcript is received, and at the latest 24 hours after it was captured. The sound of remote meetings: never kept.
• Sign-in codes: fifteen minutes.
• Sessions: thirty days. Sign-ups started but never completed (address and data entered): thirty days.
• The keyed hash of the connection of employees who ask a question: two days.
• The employee line: the voice, never kept; the text of the conversation, erased at the end of the call; the keyed hash of the number, only after a wrong code, two days at most; the time and duration of calls, with the CSE's data.
• The keyed hash that limits the acknowledgement of receipt to one per address per day (never the address itself): two days.
• An employee's personal link to confirm receipt of a gift voucher: until the end of the year following the handover. The list of employees and their confirmations stay with the CSE's data, as proof in case of inspection; an employee who has left is marked as such, and the CSE may ask for them to be erased.
• The CSE's data: as long as the CSE's space exists. The last elected representative of a space can erase it themselves, at any time (account settings in the application, or the Delete my account page, in French), after a strong confirmation: everything is erased at once, stored files included. The CSE may also request the end of the service in writing at the address below. After twelve months without a licence, the publisher notifies the CSE at least two months in advance, then sets the last day of service. In both cases, the space becomes read-only the day after that last day: the secretary or the administrator can then download all of the CSE's data. Thirty days after that last day, the space is entirely erased, stored files included. The hosting provider's backups are erased no later than ninety days after the end of the service.
• An elected representative's account: kept as long as the representative keeps it. On their request, it is deleted at once (see "Delete your account" below).
• Licence invoices (reference, amount, dates, name and address of the client CSE, its SIRET number if it has one, name and SIREN number of the company in which it is set up, without any elected representative's name): ten years, even after the space is erased, because the law requires us to keep accounting documents (Commercial Code, Article L123-22).
• The raw text of a recorded meeting (with the full transcript and the name chosen for each voice): erased thirty days after the minutes are validated.

Cookies

The application uses only two cookies, both essential: one keeps the elected representative signed in, the other follows the current meeting live. No audience-measurement or advertising cookies.

This website uses no cookies, and it calls on no outside site: its fonts and its background are hosted with it.

Delete your account

An elected representative can delete their account at any time, without writing to us: in the application (account settings, "Delete my account"), or on the page app.mandava.fr/supprimer-mon-compte (in French), with the code received by e-mail.

• Erased at once: your e-mail address, your last name and first name, your sign-ins and your codes, your access to employee files, the opinions you gave to the team, and your address noted in the space's log.
• Kept: the CSE data you contributed to (minutes, expenses, files) belongs to the CSE and stays for the other elected representatives, with the mention "Former member" in place of your name.
• If you are the last elected representative of the space, you can have the entire space erased (meetings, minutes, treasury, files, stored documents), after typing the company's name. This is final.
• Legal obligation: licence invoices are kept for ten years, without any elected representative's name.

Your rights

You can ask to access, correct or erase your data, to restrict its use, to object to it, or to receive it in a readable format.

• You are an elected representative: delete your account yourself (above) or write to [email protected].
• You are an employee and a file or a question concerns you: contact the elected representatives of your CSE, who are responsible for it. Mandava helps them answer you.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

Page updated on 2 November 2026.