Data Processing Agreement (DPA)

Translation notice

This document is an English translation of the French original, provided for convenience and information purposes only. Only the French version is legally binding and shall prevail in the event of any discrepancy or dispute.

Article 1. Purpose and scope

This Data Processing Agreement (the “Agreement” or the “DPA”) governs the processing of personal data carried out by CoachPartner on behalf of the Coach in connection with the use of the CoachPartner platform accessible at coachpartner.app (the “Platform”).

It is entered into pursuant to Article 28 of Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and forms an integral part of the Platform’s Terms of Use (the “Terms of Use”), to which it is appended. It also supplements the Terms of Sale. It can be consulted at any time at coachpartner.app/dpa.

The Coach accepts this Agreement electronically when creating their account, together with the Terms of Use of which it forms an integral part. Acceptance of the Terms of Use entails acceptance of this Agreement, without a separate signature. The wording of the checkbox expressly mentions the DPA and the Coach’s commitment: “I accept the Terms of Use (including the DPA) and the Terms of Sale, I have read the Privacy Policy, and I commit to obtaining my clients’ consent before any upload.” This acceptance constitutes a signature. The Agreement takes effect on the date of such acceptance and remains in force for as long as the Coach holds an active account on the Platform.

By accepting this Agreement, the Coach warrants, for each session file they upload, that the explicit consent of the recorded individuals has been obtained for the session concerned. This warranty is given within the meaning of Article 8.

In the event of any conflict between this Agreement and the other contractual documents, this Agreement shall prevail with respect to all matters relating to the processing of personal data.

Article 2. Identification of the parties

The processor

CoachPartner, a service published by SOVELL, a French simplified joint-stock company with a sole shareholder (société par actions simplifiée unipersonnelle, SASU), whose registered office is located at 58 rue de Monceau, CS 48756, 75380 Paris Cedex 08, France, registered with the Paris Trade and Companies Register (RCS) under number 104 653 639, represented by its founder and president, Sophie Vellutini.

Hereinafter “CoachPartner” or the “Processor”.

Contact for any question relating to this Agreement: contact@coachpartner.app

The controller

The Coach, a natural or legal person, a coaching professional in training or certified, identified by the information provided when creating their account on the Platform (surname, first name, email address and, where applicable, company name and professional identification number).

Hereinafter the “Coach” or the “Controller”.

Article 3. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach”, “supervisory authority” and “special categories of data” have the meanings given to them by Articles 4 and 9 of the GDPR.

In this Agreement:

• “Data” means the personal data processed by CoachPartner on behalf of the Coach, as described in Annex 1.
• “Data Subjects” means the natural persons whose Data are processed, that is, primarily the Coach’s coached clients, as well as any other person whose voice or information appears in the uploaded files.
• “Sub-processor” means any third party engaged by CoachPartner to process the Data, as listed in Annex 2.
• “Service” means the automated analysis of a coaching session against the core competencies of the ICF framework, together with the features for tracking the Coach’s progress over time, provided by the Platform.

Article 4. Role and qualification of the parties

In the context of the Service, the Coach acts as controller of the Data relating to their own coached clients. As such, the Coach determines the purposes and means of the processing and decides to upload session files to the Platform.

CoachPartner acts as processor. It processes the Data solely to provide the Service to the Coach, on the Coach’s documented instructions, and does not use the Data for any purpose of its own.

Coached clients are third parties who do not use the Platform and hold no account on it. The relationship with these individuals, including informing them and obtaining their consent, is the sole responsibility of the Coach (see Article 8).

CoachPartner does not process the Data to train or improve artificial intelligence models, and contractually imposes the same prohibition on its relevant Sub-processors.

Article 5. Description of the processing

The nature, purpose and duration of the processing, and the categories of Data and Data Subjects, are described in Annex 1, which forms an integral part of this Agreement.

The Coach acknowledges and accepts that the audio files of coaching sessions may contain special categories of data within the meaning of Article 9 of the GDPR, including data relating to the physical or mental health, private life, opinions or orientation of the Data Subjects. The Coach’s obligations in this respect are set out in Article 9.

Article 6. Documented instructions of the Controller

CoachPartner processes the Data solely on the basis of the Coach’s documented instructions. The Coach’s documented instructions consist of:

• this Agreement and its annexes;
• the Terms of Use and the Terms of Sale;
• the normal use of the Platform’s features, in particular uploading a session file and launching an analysis;
• any additional instruction sent in writing by the Coach and accepted by CoachPartner.

CoachPartner shall immediately inform the Coach if, in its opinion, an instruction infringes the GDPR or any other applicable Union or national data protection provision.

If CoachPartner is required, under Union or Member State law, to carry out processing not covered by the Coach’s instructions, it shall inform the Coach before processing, unless the applicable law prohibits such information on important grounds of public interest.

CoachPartner does not transfer the Data outside the European Economic Area, except to the Sub-processors listed in Annex 2 and under the conditions set out in Article 11.

Article 7. Obligations of CoachPartner (Processor)

7.1 Confidentiality

CoachPartner ensures that the persons authorised to process the Data, whether its officers, employees or service providers, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This commitment survives the end of their relationship with CoachPartner.

Access to the Data is strictly limited to the persons who need it to provide, maintain or secure the Service.

7.2 Security of processing

CoachPartner implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures, which take into account the potentially sensitive nature of the Data, are described in Annex 3.

CoachPartner regularly reviews these measures and may update them, provided that the level of security is not reduced.

7.3 Sub-processors

The Coach authorises CoachPartner to engage the Sub-processors listed in Annex 2 for the performance of the Service. This authorisation constitutes prior written authorisation within the meaning of Article 28 of the GDPR.

CoachPartner enters into a contract with each Sub-processor imposing on it data protection obligations substantially equivalent to those of this Agreement. CoachPartner remains fully liable to the Coach for the performance by its Sub-processors of their obligations.

Where a Sub-processor is added or replaced, CoachPartner shall inform the Coach in writing (in particular by email or via the Platform) at least fifteen (15) days before the change takes effect. During this period, the Coach may object to the change on legitimate grounds relating to data protection. In the event of an objection, the parties shall use good-faith efforts to find a solution. If no solution is found within a reasonable period, the Coach may close their account and stop using the Service, at no cost, for the part of the Service affected by the change.

7.4 Assistance with the rights of Data Subjects

CoachPartner puts in place appropriate technical and organisational measures to assist the Coach in responding to requests from Data Subjects exercising their rights (rights of access, rectification, erasure, restriction, objection and portability).

If a Data Subject sends a request directly to CoachPartner, CoachPartner shall forward the request to the Coach as soon as possible and shall not respond to it itself, unless instructed otherwise by the Coach.

At the Coach’s request, CoachPartner shall provide the Coach with the means to access, rectify or delete the Data, or shall carry out these operations itself within a reasonable period.

7.5 Assistance with security, breaches and impact assessments

CoachPartner assists the Coach in complying with the Coach’s obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to it, in particular with respect to:

• the security of the processing;
• the notification of data breaches to the supervisory authority and to Data Subjects;
• the carrying out of data protection impact assessments (DPIAs);
• prior consultation of the supervisory authority where applicable.

7.6 Notification of data breaches

CoachPartner shall notify the Coach of any personal data breach affecting the Data without undue delay and no later than forty-eight (48) hours after becoming aware of it.

The notification, sent to the email address of the Coach’s account, shall, to the extent possible, specify:

• the nature of the breach and, where possible, the categories and approximate number of Data Subjects and records concerned;
• the likely consequences of the breach;
• the measures taken or proposed to remedy the breach and mitigate its effects;
• the contact point from which further information can be obtained.

Where it is not possible to provide all the information at the same time, it shall be provided in phases without undue delay. It is for the Coach, in their capacity as controller, to decide on any notification to the supervisory authority and to the Data Subjects.

7.7 Deletion and return of the Data

Upon termination of this Agreement, for whatever reason, CoachPartner shall delete all Data and existing copies within thirty (30) days, unless retention is required by law.

Before the end of the Agreement, the Coach may download the analysis reports and transcripts they wish to keep. CoachPartner is not required to retain the Data beyond the periods set out in Annex 1, and it is the Coach’s responsibility to make the necessary downloads in good time.

Upon written request from the Coach made before the end of the Agreement, CoachPartner may, where technically possible, return the Data in a structured, commonly used format before deleting them.

7.8 Records, audits and provision of information

CoachPartner maintains a record of the categories of processing activities carried out on behalf of the Coach, in accordance with Article 30(2) of the GDPR.

CoachPartner makes available to the Coach all information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR.

CoachPartner allows for and contributes to audits, including inspections, conducted by the Coach or by an independent auditor mandated by the Coach. Audits are conducted as follows: the Coach sends a written request with reasonable notice of at least thirty (30) days; the audit takes place during business hours, under conditions that do not disrupt the operation of the Service, and no more than once a year, except in the event of a confirmed security incident or a requirement of a supervisory authority. CoachPartner may satisfy this obligation by providing the relevant security documentation, attestations or audit reports of its Sub-processors. The costs of an on-site audit are borne by the Coach, unless the audit reveals a material breach by CoachPartner.

Article 8. Obligations of the Coach (Controller)

The Coach warrants that they have, for all Data they upload to the Platform, a valid legal basis within the meaning of Article 6 of the GDPR.

As session files may contain special categories of data, the Coach also warrants that they have a valid legal basis within the meaning of Article 9 of the GDPR, which in practice means obtaining the explicit consent of each coached client.

The Coach warrants that, before any upload, they have informed each coached client, clearly and completely, of the following:

• the recording of the coaching session;
• the upload of that recording to the CoachPartner Platform for the purpose of an automated analysis of the Coach’s competencies;
• the use of Sub-processors, some of which are established outside the European Economic Area, and the existence of transfers governed by appropriate safeguards (see Article 11 and Annex 2);
• the applicable retention periods;
• the rights of the coached client and how to exercise them with the Coach.

The Coach gives CoachPartner lawful instructions. The Coach shall refrain from uploading data that is not necessary for the purpose of the Service, or for which they do not hold the required authorisations.

The Coach shall handle with diligence any requests to exercise rights that CoachPartner may forward to them, and any data breach notification.

The Coach is solely responsible for the accuracy, quality and lawfulness of the Data and for the means by which they obtained them. CoachPartner shall not be held liable for any failure by the Coach to comply with their obligations as controller, in particular any failure to inform coached clients or to obtain their consent.

Article 9. Special categories of data

Given the nature of coaching sessions, the Data may include sensitive information relating to the health, private life, opinions, beliefs or orientation of the Data Subjects.

The processing of such data by CoachPartner is based exclusively on the Coach’s instructions and on the explicit consent that the Coach warrants having obtained from each coached client.

CoachPartner applies to the Data a level of protection appropriate to their potentially sensitive nature, as described in Annex 3, and limits their retention to what is strictly necessary, in accordance with the periods set out in Annex 1.

Article 10. Indicative nature of the analysis

It is recalled that the analysis provided by the Platform is generated automatically and is strictly indicative in nature. It does not constitute an official evaluation by the International Coaching Federation (ICF) and cannot replace any ICF certification or accreditation process.

This clarification has no bearing on the qualification of the parties within the meaning of the GDPR, but is stated here to avoid any ambiguity as to the scope of the Service.

Article 11. Transfers of data outside the European Economic Area

The Data are hosted and stored at rest in data centres located in the European Union.

However, the performance of the Service involves the use of Sub-processors established in the United States, in particular for transcription and analysis (see Annex 2). This involves a transfer of personal data outside the European Economic Area.

These transfers are governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission by Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented where appropriate by additional technical and organisational measures. Each relevant Sub-processor has entered into a data processing agreement (DPA) with CoachPartner incorporating these safeguards.

By accepting this Agreement, the Coach authorises these transfers and acknowledges having informed coached clients of their existence, in accordance with Article 8.

Article 12. Term and termination of the Agreement

This Agreement takes effect on the date of its acceptance and remains in force for as long as CoachPartner processes Data on behalf of the Coach, that is, for as long as the Coach’s account is active.

It terminates automatically upon closure of the Coach’s account, for whatever reason. Termination of the Agreement triggers the deletion obligations set out in Article 7.7.

The provisions which, by their nature, are intended to survive the termination of the Agreement (confidentiality, deletion of the Data, liability) shall remain in force after its term.

Article 13. Liability

Each party is liable for the damage caused by processing that breaches its obligations, under the conditions set out in Article 82 of the GDPR.

CoachPartner is liable only for the damage caused by processing where it has not complied with the obligations of the GDPR specifically directed at processors, or where it has acted outside or contrary to the Coach’s lawful instructions.

The Coach shall indemnify CoachPartner against any claim by a Data Subject or a third party arising from the Coach’s failure to comply with their own obligations as controller, in particular regarding the information and consent of coached clients.

Any limitation of liability provided for in the Terms of Use or the Terms of Sale applies to this Agreement, without prejudice to the mandatory provisions of the GDPR.

Article 14. General provisions

This Agreement is governed by French law and by the GDPR.

Any dispute relating to its interpretation or performance shall, failing amicable resolution, fall within the jurisdiction of the competent French courts.

If any provision of this Agreement is held to be void or unenforceable, the remaining provisions shall remain in force.

CoachPartner may amend this Agreement to reflect legal, regulatory or technical developments. Any substantial change shall be notified to the Coach in writing (in particular by email or via the Platform) at least fifteen (15) days before it takes effect.

Annex 1. Description of the processing

Purpose of the processing

To provide the Coach with an automated analysis of a coaching session, against the core competencies of the International Coaching Federation framework, in the form of a downloadable report, together with features for tracking the Coach’s progress over time (session history, observations, trends, practice goals and summaries).

Nature of the processing operations

Receipt and collection of uploaded files, storage, transcription of the audio to text, automated analysis of the transcript, generation of a report, production of derived tracking data (observations, trends, summaries), provision of the results in the Coach’s workspace, then deletion of the Data in accordance with the periods below.

Categories of Data processed

• Audio content of the coaching sessions (voice of the Coach and of the coached client(s));
• Text transcript of the session, including its segmentation by speaker;
• Any personal data contained in the audio or the transcript: identifying details, personal or professional circumstances, emotional state and, where applicable, special categories of data within the meaning of Article 9 of the GDPR (physical or mental health, private life, opinions, beliefs, orientation);
• Analysis result in structured format (JSON) and generated report, including session excerpts quoted in the report;
• Derived tracking data produced by the Service: observations and associated session excerpts, competency assessments, aggregated trends and progress summaries;
• Data entered by the Coach in their workspace which may mention coached clients: the client identifier chosen by the Coach (pseudonym recommended), free-text notes, practice goals and reflection notes attached to sessions.

Categories of Data Subjects

The Coach’s coached clients, as well as any other person whose voice or information appears in the uploaded files. Coached clients are third parties who do not use the Platform.

Retention periods

Duration of the processing

The processing continues for as long as the Coach’s account is active, and at the latest until all Data have been deleted in accordance with the periods above.

Annex 2. List of authorised Sub-processors

The payment provider Stripe processes the Coach’s payment data in the context of a separate relationship. It is not involved in the processing of coached clients’ data and is therefore not a Sub-processor under this Agreement. The processing of payment data is described in the Platform’s Privacy Policy.

Annex 3. Technical and organisational security measures

CoachPartner implements, at a minimum, the following measures, taking into account the potentially sensitive nature of the Data.

Encryption

Encryption of the Data in transit (TLS protocol) between the Coach’s browser, the Platform and the Sub-processors. Encryption of the Data at rest in the storage spaces and the database.

Access control

Access to the Data restricted to authorised persons only, on a need-to-know basis. Authentication of coach accounts. Segregation of data between accounts, so that a Coach can only access their own Data.

Minimisation and storage limitation

Deletion of the audio as soon as transcription has succeeded. Automatic purge in the event of failure. Retention of analysis results and derived data in accordance with the periods set out in Annex 1, with deletion available to the Coach at any time. No use of the Data for model training.

Hosting

Hosting and storage at rest in data centres located in the European Union. Use of Sub-processors providing appropriate contractual safeguards.

Operational security

Keeping software components up to date. Logging of access and significant events. Measures to protect against unauthorised access.

Breach management

Procedure for detecting, assessing and notifying data breaches, in accordance with Article 7.6 of this Agreement.

Continuity

Backup measures to restore the availability of the Data and access to the Service in the event of an incident.