Data Processing Agreement

Version 1.1 · Last updated 2026-07-27 · legal@sparred.ai

This Data Processing Agreement (this "DPA") governs Prestance Lab's processing of Personal Data carried out in the course of providing the Services under the Agreement. Capitalised terms not defined here have the meaning given to them in the General Terms and Conditions or, failing that, in the GDPR. It is incorporated by reference into the Agreement pursuant to GTC §14.3.

1. Roles and definitions

In order to provide the Services, Prestance Lab is required to process the Personal Data of Authorized Users. The Parties acknowledge that, with respect to the processing of such Personal Data carried out under the Agreement, the Customer acts as the data controller (the "Controller") and Prestance Lab acts as the data processor (the "Processor").

"Controller", "Data Subject", "Personal Data", "Process / Processing", "Processor", "Sub-processor", "Data Protection Impact Assessment", "Data Protection Officer" and "Personal Data Breach" have the same meaning as in the GDPR.

2. Applicable legislation

Each Party undertakes to comply with the provisions of any applicable legislation concerning the protection of Personal Data, in particular the French Data Protection Act No. 78-17 of 6 January 1978 in its latest version in force and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "GDPR"), together the "Applicable Data Protection Legislation".

3. Description of the processing

The Personal Data processing operations carried out by the Processor are described below.

Concerned service(s)

The Services as defined in the GTCs (Solution, Maintenance Services, and Professional Services where applicable).

Nature of the processing operations

Storage, consultation, organization, transmission, erasure, recording (voice), transcription (speech-to-text), automated analysis (LLM-as-judge), profiling within the meaning of Article 4(4) GDPR (skill mapping over time), and anonymization.

Purpose(s) of processing

Performance of the Agreement and provision of the Services, including: authentication of Authorized Users; delivery of voice-drill rehearsal sessions; generation of coaching letters; provision of the manager dashboard; technical support; and security monitoring.

Categories of Data Subjects

Authorized Users of the Customer (typically the Customer's employees acting in a sales-advisor, manager, or administrator role).

Categories of Personal Data

Identity data (first name, last name); professional contact data (professional email address); authentication metadata (hashed password, MFA token state, session identifiers); voice and session content (voice recordings of client-conversation simulations, advisor → persona transcripts, coaching letters and Solution-generated feedback, performance scores and skill ratings); drill metadata (drill identifiers, timestamps, scenarios); technical telemetry (IP address, browser user-agent, error logs).

Special categories of Personal Data

None processed by design. The Solution does not perform emotion recognition in the workplace within the meaning of Article 5(1)(f) of the EU AI Act.

Duration of the processing

Until deletion by the Authorized User or by the Customer administrator, and at the latest at the end of the Agreement followed by the deletion procedure described in Section 5 below and in the Security Policy (typically within 30 days; backups purged within 90 days).

4. Controller's undertakings

The Controller undertakes to:

• Ensure that the collection and transmission of Personal Data to the Processor comply with the Applicable Data Protection Legislation.
• Provide the Processor with any information necessary for the performance of this DPA.
• Document in writing all instructions concerning the processing carried out by the Processor.
• Ensure, beforehand and throughout the duration of the Agreement, that the Processor complies with the obligations of the Applicable Data Protection Legislation.

5. Processor's undertakings

The Processor undertakes to:

• Process Personal Data solely for the performance of the Agreement and, in general, only on the Controller's documented instructions. The Parties agree to negotiate in good faith if the Processor must use resources other than, or in addition to, those required to perform the Services, and thus incurs specific costs, owing to the Controller's instructions regarding the processing of Personal Data. The Processor will inform the Controller without undue delay if, in the Processor's opinion, an instruction given by the Controller constitutes an infringement of the Applicable Data Protection Legislation.
• Limit access to Personal Data to its staff members subject to an obligation of confidentiality.
• Implement appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, to ensure a level of security appropriate to the risk. These measures are described in our Security Policy; the Controller acknowledges and agrees that such measures are sufficient to protect the Personal Data and to ensure compliance with the Applicable Data Protection Legislation.
• Notify Personal Data Breaches to the Controller in writing without undue delay after becoming aware of such Breach, together with any useful information that would enable the Controller, where legally required, to notify the competent supervisory authority and the Data Subjects. Where it is not possible to provide all relevant information at the same time, the initial notification will contain the information then available and further information will, as it becomes available, be provided without undue delay. The initial breach contact is security@sparred.ai.
• Maintain a list of Sub-processors involved in the processing of Personal Data (Section 7 below). The Sub-processors listed in Section 7 are presumed to be authorized by the Controller. The Processor will inform the Controller of any change to this list before such change is made, in order to give the Controller the opportunity to object within ten (10) calendar days following receipt of such notification, it being understood that such objection will only be valid if the Controller provides objective written justification explaining its position and relating to the capacity of the subsequent Sub-processor to comply with the obligations of the Applicable Data Protection Legislation. The Processor remains fully liable to the Controller for the performance of the Sub-processors' obligations relating to the processing of Personal Data.
• Assist the Controller, to the extent possible, in meeting its obligations to respond to requests from Data Subjects to exercise their rights, taking into account the nature of the processing and the information available to the Processor.
• At the Controller's choice, delete or return all Personal Data to the Controller at the end of the Agreement and delete existing copies, unless otherwise required or permitted by applicable law. Returned data is provided in a structured, commonly used, and machine-readable format (CSV or JSON, depending on the data category).
• Make available to the Controller (or to another auditor appointed by the Controller), at the Controller's expense and request, all information necessary to demonstrate compliance with the obligations set forth in this DPA, and submit its Personal Data processing facilities, data files, and documentation needed for processing the Controller's Personal Data to audits, subject to compliance by the Controller with (i) one month's prior written notice and (ii) a limit of one audit per year. The audit will be conducted during the Processor's normal business hours and will not unreasonably disrupt the Processor's performance of its obligations under the Agreement or the Processor's business in general. The Controller will provide the Processor with a copy of the audit report at no additional cost to the Processor, within a reasonable time following receipt of the audit report.
• Cooperate and assist the Controller, to the extent possible and at the Controller's request, in the performance of a Data Protection Impact Assessment ("DPIA") where such DPIA is legally required.

6. International transfers

7. List of Sub-processors

As of the last-updated date at the top of this page, the following Sub-processors are engaged by the Processor for the provision of the Services.

8. Updates to this DPA

Pursuant to GTC §2.7, Prestance Lab may update this DPA. Material changes will be notified to active Customers at least thirty (30) days in advance, unless a shorter period is required by law or to address a security risk. Changes to the Sub-processor list follow the procedure set out in Section 5 above.

9. Contact

• Data Protection contact: privacy@sparred.ai
• Security incidents and Personal Data Breaches: security@sparred.ai