01
Subject and Parties
This Data Processing Agreement (the "DPA") forms an integral part of the General Terms and Conditions of Sale entered into between the Client and EAGR, a SAS with a share capital of €14,329.90, registered with the Nanterre Trade and Companies Register under number 938 024 841, having its registered office at 3 rue Donatello, 92400 Courbevoie, France ("Eagr"). It applies as soon as the Client subscribes to the Platform, including a free trial, without separate signature.
For personal data processed within the Platform, the Client acts as data controller and Eagr as data processor, within the meaning of Article 28 of Regulation (EU) 2016/679 (the "GDPR").
In the event of a conflict between the DPA and the T&Cs regarding data protection, the DPA shall prevail.
02
Treatment description
The table below describes the processing implemented on the Platform.
Purpose
Nature of transactions
Providing the Platform: call recording, transcription, and analysis, real-time and post-call coaching, dashboards, CRM synchronization, role-play training
Collection, recording, transcription, automated analysis, storage, consultation, synchronization, deletion
Data subjects
Customer Users (sales reps, managers) and call participants (prospects, Customer's clients)
Data Categories
Identity and professional contact details, voice and image (recordings), conversation content (transcripts), call metadata, scores and analytics, data imported from the CRM
Sensitive data
No sensitive data is intentionally processed. The Client agrees not to import any.
Duration
Subscription period, followed by return period (Article 11)
03
Client Instructions
Eagr processes data solely on documented instructions from the Client. The T&Cs, the DPA, and the Client's Platform settings constitute these instructions.
If Eagr believes that an instruction violates regulations, it shall immediately inform the Client.
Eagr does not use Customer data for its own purposes, and does not use it to train AI models to be confirmed. Eagr may produce aggregated and anonymized statistics, which do not identify either the Customer or any person.
04
Customer Obligations
The Client, as data controller, undertakes to:
•
have a legal basis for recording and analyzing calls;
•
inform its Users and their contacts about the recording and analysis, and manage any objections they may have;
•
conduct, if necessary, the data protection impact assessment (DPIA) relating to these processing operations, with the assistance of Eagr;
•
only transmit relevant data limited to what is necessary.
05
Privacy
Eagr ensures that individuals authorized to process data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to data is restricted to individuals who need it to provide service or support.
06
Security
Eagr implements the appropriate technical and organizational measures provided for in Article 32 of the GDPR, as described in Appendix 1. These measures may change, provided that the overall level of security is never reduced.
07
Sub-processors
The Client authorizes Eagr to engage the sub-processors listed in Appendix 2.
Eagr informs the Customer of any addition or replacement at least 30 days in advance, by email / via the Platform. The Customer may object for a reasonable reason related to data protection. In the absence of a solution, they may terminate the affected part of the service free of charge.
Eagr imposes data protection obligations on each subsequent subcontractor that are equivalent to those of the DPA, and remains liable to the Customer for their compliance.
08
Transfers outside the European Union
Platform data is hosted within the European Union. Any transfer outside the European Economic Area only takes place to a country covered by an adequacy decision (including the Data Privacy Framework for the United States) or with appropriate safeguards, in particular the European Commission's standard contractual clauses.
[Indicate existing transfers, see Appendix 2]
09
Rights of Data Subjects
Eagr assists the Client, to the extent possible, in responding to requests to exercise data rights (access, rectification, erasure, objection, restriction, portability). If Eagr receives such a request directly, it will forward it to the Client without delay and will not respond to it without instructions from the Client.
10
Data breach
Eagr notifies the Client of any personal data breach within a maximum period of 48 hours to be validated after becoming aware of it, by email to the contact designated by the Client. The notification contains the available information provided for in Article 33 of the GDPR: nature of the breach, categories and approximate number of data subjects and data concerned, likely consequences, measures taken or planned.
Eagr assists the Client in fulfilling their notification obligations to the CNIL and, where applicable, to the data subjects.
11
End of contract
At the end of the contract, the Client may export their data from the Platform for 30 days. After this period, Eagr deletes the data and its copies, including from backups within 90 days, unless there is a legal obligation to retain them. Eagr confirms the deletion upon request.
12
Audit
Eagr makes available to the Client the necessary information to demonstrate compliance with this DPA. The Client may conduct an audit, at its own expense, once a year, subject to 30 days' prior notice, by an auditor bound by confidentiality and not a competitor of Eagr. The audit must not disrupt the operation of the service or compromise the confidentiality of other clients.
13
Support
Eagr provides the Client with reasonable assistance necessary to carry out impact assessments and prior consultation with the CNIL, taking into account the nature of the processing and the information available to it.
14
Appendix 1: Security Measures
•
Hosting in the European Union at [Host], certified [ISO 27001 / SOC 2 / HDS…]
•
Data encryption in transit (TLS) and at rest
•
Role-based access control and principle of least privilege
•
Secure authentication [SSO, two-factor authentication]
•
Logging of access and sensitive actions
•
Regular, encrypted backups with restoration testing
•
Logical partitioning of each client's data
•
Team security awareness and confidentiality commitment
•
Incident and Data Breach Management Procedure
15
Annex 2: Sub-processors
Subcontractor
Service
Data location
Warranty outside the EU
[Host]
Platform Hosting
European Union
Not applicable
[Supplier]
Call Transcription
[to be completed]
[to be completed]
[Supplier]
AI models (analytics, Live coach, role-play)
[to be completed]
[to be completed]
[Tool]
Customer Support
[to be completed]
[to be completed]
List last updated: October 7, 2026.