1. Purpose and parties
This agreement governs the processing of personal data that SAS MINDLET (« Mindlet ») carries out on behalf of a client organisation (« the Client »): a school, training provider, company, association or support service that opens a space on Mindlet to follow its learners.
It meets Article 28 of Regulation (EU) 2016/679 (GDPR). It forms part of the terms of use and sale and applies as soon as an organisation creates its space or subscribes to the Cosmos offer. The person who creates the space accepts it on the Client’s behalf and declares that they have authority to bind it.
Mindlet’s identity: SAS MINDLET, SIREN 943 845 743, RCS Bastia, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France. Contact: support@mindlet.app.
2. Roles
- The Client is the controller for following its learners’ training in its space: it sets the purpose and chooses the legal basis.
- Mindlet is the processor for this follow-up: it only processes this data to provide the service to the Client, on its documented instructions.
- Mindlet remains the controller for what does not belong to the Client: each user’s account, their personal content, what they do outside the Client’s space, billing and the application’s usage analytics. This processing is described in the privacy policy.
3. Description of the processing
| Nature | Hosting, organisation, consultation, computing indicators, sending notifications, erasure |
| Purpose | Enabling the Client to train its learners and follow their training: groups, goals, progress, use of materials, surveys, reminders, support plans, live rooms, the trainer’s assistant |
| Data subjects | Learners, trainers, administrators and observers of the Client’s space; people followed by a support service |
| Categories of data | Identity and account (name, email address, role, groups); progress and activity on the space’s collections; reading actions and time spent on materials; survey answers; messages from trainers; accessibility settings; support plans (type of plan, needs described in teaching terms, adjustments, follow-up log); access log |
| Sensitive data | Mindlet provides no field for a diagnosis, a condition or a treatment. The type of a support plan (for example a PPS or a PAI, French school support schemes) may nonetheless, on its own, reveal something about a learner’s health: the Client must have a basis under Article 9(2) of the GDPR before opening one |
| Duration | For as long as the Client uses the service, then section 11 |
Each item of data, who sees it and how long it is kept is detailed in section 3.8 of the privacy policy.
4. The Client’s instructions
Mindlet processes the data on the Client’s documented instructions. These instructions are: this agreement, the terms of use and sale, and the settings the Client chooses in its space (members and roles, groups, trainers’ scope, goals, surveys, support plans).
Mindlet does not use this data for any other purpose, does not sell it and does not use it to train artificial intelligence models. If an instruction appears to infringe the GDPR or French law, Mindlet informs the Client.
If Union or French law requires Mindlet to process this data otherwise, Mindlet informs the Client before processing, unless that law prohibits it.
5. Confidentiality
The people Mindlet authorises to process this data are bound by a duty of confidentiality, and only access it to the extent needed to provide, maintain and secure the service.
6. Security
Mindlet implements the following measures (Article 32 of the GDPR):
- encryption of exchanges in transit;
- separation of data by organisation: a member only accesses the data of their space, according to their role;
- trainers’ scope, chosen by the Client: the learners in their own groups, or all of the organisation’s learners; an observer only sees averages, never computed over fewer than three people;
- access log: every named opening of a learner’s record by a trainer, on screen or through the assistant, is recorded and readable by the learner;
- surveys anonymous by default, with no result below three respondents; a named survey tells the learner so before they answer;
- reading time measured by the servers, not declared by the device;
- automatic purge: reading actions after 90 days, access log after 400 days;
- logged, time-limited consent for any follow-up by a support service.
7. Sub-processors
The Client authorises Mindlet to use the following sub-processors for this processing:
| Sub-processor | What it does | Location and safeguards |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, asynchronous processing | United States, global network; EU–US Data Privacy Framework and, failing that, standard contractual clauses |
| Mistral AI SAS | AI models: generating materials, the assistant (including the trainer’s assistant), voice transcription and synthesis | France |
| Qdrant Solutions GmbH | Semantic search index of content | European Union (Germany) |
| Plus Five Five, Inc. (Resend) | Sending emails | United States; standard contractual clauses and EU–US Data Privacy Framework |
| Apple and Google | Delivering notifications to devices | Under their own terms |
Mindlet imposes on each of them data protection obligations equivalent to those of this agreement, and remains liable to the Client for their compliance.
Mindlet informs the Client of any addition or replacement of a sub-processor by updating this page and notifying the owner of the space by email before the change takes effect. The Client may object on legitimate grounds by writing to support@mindlet.app; if no solution is found, it may cancel its subscription.
8. Transfers outside the European Union
Where data is transferred outside the European Economic Area, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework for certified sub-processors, or on the European Commission’s standard contractual clauses.
9. Data subjects’ rights
Mindlet helps the Client answer requests from its learners to exercise their rights (access, rectification, erasure, restriction, objection, portability). When a person contacts Mindlet directly about data in the Client’s space, Mindlet passes the request on to the Client without answering it itself, unless the Client instructs otherwise.
The Client has the following tools in its space: list and record of each member, removal of a member, export of members’ follow-up as a CSV file, deletion of the organisation.
10. Personal data breaches
Mindlet notifies the Client of any personal data breach affecting its space without undue delay after becoming aware of it, by email to the owner of the space. The notification describes, as far as they are known: the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences and the measures taken or proposed. It is for the Client to notify the CNIL (the French data protection authority) and, where appropriate, the people concerned.
11. End of processing
When the subscription ends, the Client’s space is locked and its data is kept, so that it can retrieve it or resume its subscription. The Client can at any time export its members’ follow-up and then delete the organisation from its space (« Réglages », « Zone danger », « Supprimer l’organisation »: Settings, Danger zone, Delete the organisation): its groups, goals, reading measurements, surveys, support plans and logs are then erased. It can also ask for this deletion at support@mindlet.app.
Data that belongs to each user’s personal account (section 2) is not erased with the organisation: it follows the privacy policy.
12. Impact assessment, audit and cooperation
Mindlet provides the Client with the information needed to demonstrate compliance with Article 28 and to carry out its own impact assessments. A template impact assessment for measuring how materials are listened to and read is available on request at support@mindlet.app.
Mindlet allows audits, including inspections, by the Client or an auditor it appoints who is bound by confidentiality, with reasonable notice and without disrupting the service. Mindlet cooperates with the CNIL on request.
13. The Client’s obligations
The Client undertakes to:
- have a legal basis for following its learners and, for a support plan that may reveal a learner’s health, a basis under Article 9(2) of the GDPR;
- inform its learners, and in a company its employees and the social and economic committee before implementation, of this follow-up and its purposes;
- record this processing in its register and carry out the necessary impact assessment, in particular when it follows minors or measures the use of materials;
- choose its trainers’ scope knowingly, and not use the reading measurement to grade or sanction a learner;
- only give a trainer or administrator role to authorised people.
14. Duration and changes
This agreement remains in force for as long as Mindlet processes data on the Client’s behalf. Mindlet may amend it to follow changes in the service or the law; the date of the last update appears at the top of this page. A change that reduces data protection only applies after the Client has been informed.