Data Processing Agreement
Version: 1.2 — Effective date: October 6, 2026
This Data Processing Agreement (the “DPA”) forms part of the agreement or order form that expressly incorporates it (the “Agreement”) between the customer identified there (the “Customer”) and TalentsLab.ai, a French simplified joint-stock company registered under SIREN 994 179 059, whose registered office is at 60 rue François 1er, 75008 Paris, France (“TalentsLab”).
This DPA applies where TalentsLab processes Personal Data on behalf of the Customer. For that processing, the Customer is the Controller and TalentsLab is the Processor.
1. Definitions and scope
Data Protection Law means Regulation (EU) 2016/679 (GDPR), the amended French Data Protection Act and other data-protection law applicable to the processing. GDPR terms have their GDPR meanings. Customer Personal Data means Personal Data processed by TalentsLab on behalf of the Customer under the Agreement.
This DPA does not cover processing for which TalentsLab determines its own purposes and essential means, including contract administration, billing, platform security, fraud prevention and legal compliance. That processing is described in the Privacy Policy. If this DPA conflicts with the Agreement concerning Customer Personal Data, this DPA prevails. Applicable European Commission Standard Contractual Clauses prevail over conflicting terms.
2. Processing and documented instructions
The subject matter, duration, nature, purpose, Personal Data and Data Subjects are described in Annex 1 and, where applicable, the Agreement or order form. The Agreement, this DPA, the Customer’s configuration and use of the services, and lawful written instructions accepted by TalentsLab constitute the Customer’s documented instructions.
TalentsLab shall process Customer Personal Data only on those instructions, including for transfers outside the European Economic Area, unless required by Union or Member State law. TalentsLab shall inform the Customer before legally required processing unless the law prohibits that information.
The Customer is responsible for its instructions, legal basis, notices to Data Subjects and compliance with Data Protection Law. TalentsLab shall immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
3. Processor obligations
TalentsLab shall:
- ensure that persons authorized to process Customer Personal Data are bound by confidentiality;
- implement the technical and organizational measures in Annex 2 as required by Article 32 GDPR;
- assist the Customer, taking account of the nature of processing and information available to TalentsLab, with obligations under Articles 32–36 GDPR;
- maintain the processor records required by Article 30(2) GDPR and cooperate with competent supervisory authorities as required by law; and
- process Customer Personal Data only as necessary to provide the services and comply with documented instructions.
4. Subprocessors and international transfers
The Customer gives general written authorization for TalentsLab to use the subprocessors in Annex 3. TalentsLab shall inform the Customer of an intended addition or replacement, giving the Customer an opportunity to object before the change. TalentsLab shall impose by contract the same applicable data-protection obligations on each subprocessor and remains liable to the Customer for the subprocessor’s performance as provided by Article 28 GDPR.
TalentsLab shall process or transfer Customer Personal Data outside the European Economic Area only on documented instructions and in compliance with Chapter V GDPR, using an applicable adequacy decision or appropriate safeguards such as the relevant European Commission Standard Contractual Clauses.
5. Data Subject requests, assistance and breaches
Taking account of the nature of processing, TalentsLab shall assist the Customer through appropriate technical and organizational measures, insofar as possible, to respond to requests under Chapter III GDPR. TalentsLab shall promptly forward any request concerning Customer Personal Data and shall not respond except on documented instruction or where required by law.
TalentsLab shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and shall provide information available to it that the Customer reasonably requires to meet Articles 33 and 34 GDPR.
6. End of processing, information and audits
At the Customer’s choice, TalentsLab shall delete or return Customer Personal Data after the end of the services and delete existing copies, unless Union or Member State law requires storage. Data remaining in protected backups shall not be used for another purpose and shall be deleted through the applicable backup cycle.
TalentsLab shall make available all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits and inspections conducted by the Customer or its mandated auditor. Audits shall be arranged reasonably to protect security, confidentiality and other customers’ Personal Data and to avoid unnecessary disruption.
This DPA remains effective while TalentsLab processes Customer Personal Data. Changes to the accepted DPA require direct notice to the Customer and contractual agreement where required by Data Protection Law.
Annex 1 — Processing details
| Subject matter and purpose | Provision, hosting, support and security of the TalentsLab learning, AI role-play, coaching, assessment, reporting and certification services selected by the Customer. |
|---|---|
| Duration | For the term of the services and until return or deletion under the Customer’s documented instructions and the Agreement. |
| Nature | Collection, recording, organization, storage, consultation, use, AI-assisted generation and analysis, disclosure to authorized recipients, export, restriction and deletion. |
| Data Subjects | Customer employees, workers, contractors, learners, invited guests, managers, trainers and authorized administrators. |
| Personal Data | Names, business contact details, company, job title, language, account, role and team data; assignments and guest invitations; invitation visits, IP address, user agent and referrer; activity attempts; prompts, conversations, transcripts and voice input when used; progress, results, evaluations, rankings, feedback, optional guest comments and certificates; support communications; pseudonymous identifiers; authentication, security, usage and audit logs. |
| Special-category data | Not required and not intentionally requested. The Customer shall not instruct users to submit it unless expressly agreed and lawfully supported. |
| Certificate instruction | Unless otherwise stated, the Customer instructs TalentsLab to retain issued certificates and the minimum verification record until the Customer instructs deletion or deactivation, subject to applicable law and Data Subject rights. |
Annex 2 — Technical and organizational measures
- role-based access and restricted production access for authorized personnel;
- password hashing, authenticated sessions and account-access revocation;
- TLS encryption for transmitted data;
- EU primary hosting, backups, monitoring and recovery procedures;
- restricted security, access and audit logging;
- data minimization, pseudonymous identifiers where practicable and temporary-file deletion;
- documented retention, export, restriction and deletion procedures;
- incident detection, escalation, containment, investigation and notification procedures; and
- confidentiality obligations and access limited according to assigned duties.
TalentsLab shall review these measures and may update them with Customer approval where required, provided they continue to meet Article 32 GDPR for the processing.
Annex 3 — Authorized subprocessors
| Provider | Service | Principal location |
|---|---|---|
| OVHcloud (applicable contracting entity) | Application, database, file, log and backup hosting | European Union |
| OpenAI Ireland Ltd. | AI dialogue, coaching, evaluation support, transcription and realtime voice | Ireland and disclosed processing locations |
| HeyGen Technology, Inc. | Live-avatar generation and streaming | United States |
| AssemblyAI, Inc. | Speech-to-text transcription | United States |
| Brevo (applicable contracting entity) | Transactional email and delivery metadata | European Union and disclosed processing locations |
Current feature-level information is in the Privacy Policy. Contact: admin@talentslab.ai.