StudevaStudeva
Back to the site
EN FR

Contractual document

Data processing agreement

Version of 29 October 2026. Annex to the terms of sale, article 28 GDPR.

This is a translation of the Accord de traitement des données. Only the French version is binding; it prevails over this translation in case of discrepancy.

1. Purpose and parties

This agreement (the “Agreement”) sets out the conditions under which Studeva, a société par actions simplifiée with a share capital of €1,000.00, 173 rue de Courcelles, 75017 Paris, RCS Paris 131 961 583, processes personal data on behalf of the Customer, pursuant to article 28 of Regulation (EU) 2016/679 (“GDPR”).

For that data, the Customer is the controller and Studeva is the processor. The Agreement forms part of the terms of sale (“Terms”) and is accepted with them; terms defined in the Terms have the same meaning here. In case of conflict, the Agreement prevails over the Terms as regards the protection of personal data.

2. Description of the processing

Subject matter
Provision of the Platform: hosting the Spaces, delivering training modules, organising sessions, tracking learners, certificates, quality monitoring.
Duration
The term of the contract, then the deletion period set out in article 11.
Nature
Collection, recording, hosting, organisation, consultation, computation of statistics, document generation, email delivery, export, erasure.
Purposes
Those determined by the Customer, in particular: managing training and enrolments, learning follow-up, evidence of completion and attendance (Qualiopi), satisfaction surveys, handling complaints, accommodations for people with disabilities.
Data subjects
The Users of the Customer's Space: learners, trainers, administrators.
Categories of data
Identification: last name, first name, email address or username, company, department, role.
Sign-in: sign-in dates, sign-in log.
Learning follow-up: enrolments, progress, time spent, attempts, scores, answers to questions and assessments, positioning, certificates, attendance records, document acknowledgements.
Quality: survey answers, complaints.
Content uploaded by the Customer and its Users.
Sensitive data
Accommodation needs declared by a learner may reveal health data (article 9 GDPR). The Platform only collects them with the learner's explicit, recorded and dated consent, and erases them when the learner withdraws the request or when the account is anonymised.

3. Customer obligations

The Customer:

  • has a lawful basis for each processing it carries out with the Platform and informs the data subjects;
  • only gives Studeva instructions that comply with the GDPR;
  • only uploads to the Platform the data necessary for its purposes;
  • is responsible for the data it chooses to send outside the Platform, in particular through the webhooks, exports or single sign-on (SSO) it configures.

4. Instructions

Studeva only processes the data on the Customer's documented instructions. These instructions consist of the Terms, this Agreement, and the choices the Customer makes in the settings and use of the Platform. Studeva immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

Where Union or Member State law requires Studeva to carry out processing not covered by these instructions, it informs the Customer before doing so, unless the law prohibits it.

5. Confidentiality

The persons authorised by Studeva to process the data are bound by confidentiality and only access it to the extent necessary to perform the contract.

6. Security

Studeva implements the technical and organisational measures described in annex 2, which ensure a level of security appropriate to the risk (article 32 GDPR). It may change them, provided the level of protection is not reduced.

7. Sub-processors

The Customer gives Studeva a general authorisation to engage the sub-processors listed in annex 1.

Studeva informs the Administrators by email of any addition or replacement at least thirty (30) days in advance. The Customer may object on reasonable data protection grounds, by email to contact@studeva.fr, before that period ends. Failing a solution, it may terminate its Subscription without penalty and be refunded the unused part paid in advance.

Studeva imposes on each sub-processor, by contract, data protection obligations at least equivalent to those of the Agreement, and remains liable to the Customer for their performance.

8. Location and transfers

The data is hosted in the European Union. Studeva does not transfer it outside the European Union. Any future transfer would be notified to the Customer under article 7 and covered by one of the safeguards set out in Chapter V of the GDPR.

9. Assistance to the Customer

  • Data subject rights: the Platform lets the Customer view, rectify, export and delete its Users' data. Studeva forwards to the Customer, without delay, any data subject request it receives directly, and does not answer it itself unless instructed by the Customer.
  • Security, impact assessment and prior consultation: Studeva provides the Customer, on request, with the information it holds to help it meet those obligations.

10. Personal data breaches

Studeva notifies the Customer of any personal data breach without undue delay, and no later than forty-eight (48) hours after becoming aware of it, by email to the Administrators. The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided as soon as it is.

The Customer, as controller, is responsible for notifying the breach to the supervisory authority and, where required, to the data subjects.

11. Retention and end of processing

During the contract

Data is kept according to the Customer's use. The Platform also applies the following automatic rules to every Space, which the Customer accepts as instructions:

  • an account with no sign-in for fifty-six (56) weeks is anonymised, after two email reminders at fifty-two (52) and fifty-five (55) weeks;
  • sign-in log entries are erased after twelve (12) months.

The Customer is responsible for exporting, before these deadlines, the records it must keep longer, in particular for the Qualiopi certification.

At the end of the contract

The end of a Subscription deletes nothing: the Space returns to demo mode (Terms, article 21). When the Space is closed, Studeva deletes the Customer's data within thirty (30) days; copies held in backups disappear at the end of their rotation, no later than six (6) weeks after deletion. Before closure, the Customer may export its data or obtain a copy in a standard format. Studeva confirms the deletion in writing on request.

12. Documentation and audit

Studeva makes available to the Customer the information needed to demonstrate compliance with the Agreement. The Customer may have an audit carried out, no more than once per twelve-month period except after a data breach, on thirty (30) days' notice, by an independent auditor bound by confidentiality who is not a competitor of Studeva. The audit is at the Customer's expense, takes place during business hours without disrupting the service or compromising other customers' data, and its report is shared with Studeva.

13. Records

Studeva keeps a record of the categories of processing activities carried out on behalf of its customers (article 30(2) GDPR).

14. Term and liability

The Agreement applies for as long as Studeva processes data on behalf of the Customer. The parties' liability is governed by article 18 of the Terms, without prejudice to article 82 GDPR.

Annex 1 — Sub-processors

Scaleway SAS
8 rue de la Ville-l'Évêque, 75008 Paris, France. Hosting of servers and database, file storage, backups, transactional email delivery. Location: European Union; backups in France (Paris region).

Website audience measurement and technical monitoring of the Platform are operated by Studeva itself, on its own servers. The payment provider (Stripe) receives no data of the Space's Users: it only processes the Customer's billing data, on behalf of Studeva.

Annex 2 — Security measures

  • Isolation: each Space's data is isolated from that of other customers; database reads and writes are automatically filtered on the signed-in user's organisation, at the data access layer.
  • Access control: roles and permissions per Space; access to servers and data restricted to authorised Studeva staff.
  • Authentication: passwords hashed with Argon2; single sign-on (SAML, OpenID Connect) at the Customer's choice; single-use, time-limited sign-in links; request rate limiting against brute-force attacks.
  • Encryption: encrypted communications (HTTPS); configuration secrets (including single sign-on secrets) encrypted at rest with AES-256-GCM.
  • Backups: database backed up every night (full every week, differential on other days), encrypted with AES-256 and kept for about five (5) weeks; files backed up every hour, kept for forty-eight (48) hours then one copy a day for thirty (30) days. Backups are stored off the production server, in dedicated object storage.
  • Logging and monitoring: technical logs kept for thirty (30) days, sign-in log for twelve (12) months, continuous monitoring and alerting.
  • Minimisation: automatic anonymisation of inactive accounts (article 11); no User data is used for any purpose other than providing the service.