Agora

Data processing agreement

This agreement, required by article 28 of the GDPR, governs the personal data the publisher processes on behalf of the customer company in its Agora spaces. It forms part of the contract, together with the terms of sale.

Version of 1 November 2026

This is a translation provided for convenience. The French version is the one that applies.

Draft under legal review: this document does not yet bind the publisher and may change before it is published.

The customer, which subscribed to Agora, is the controller. The publisher, , SIREN , , , is its processor.

Processing for which the publisher is itself the controller (website, accounts, sign-up, invoicing) is covered by the privacy policy, not by this agreement.

  • subject matter: providing the customer with Agora spaces and their features;
  • nature: hosting, storage, display to authorised people, audio and video transmission, meeting recording and transcription, writing meeting notes, sending service e-mails;
  • duration: that of the contract, then the time needed for the deletion set out in article 10;
  • data subjects: members, administrators and guests of the customer's spaces, and people mentioned in their content;
  • data: identity and business contact details, presence and position in the virtual office, messages, files and reactions, sound and picture of meetings, transcripts, meeting notes, connected calendar events, recording consents, log of administration actions.

The customer ensures it does not have Agora process sensitive data (health, opinions, convictions…) beyond what its activity and its assessment allow.

The publisher processes the data only on the customer's documented instructions: this contract, and the settings its administrators make in Agora (features turned on, retention periods, access, integrations). It uses the data for no other purpose, does not sell it and does not use it to train artificial intelligence models.

If an instruction seems to it to infringe the GDPR, the publisher informs the customer at once. If Union or Member State law requires it to process the data, it tells the customer beforehand, unless the law forbids it.

The publisher's staff who may access the data are bound by confidentiality and access it only for their duties. Support enters a space only with the customer's consent, and that access is logged.

The publisher implements the measures required by article 32 of the GDPR, in particular:

  • encrypted communications (HTTPS, TLS);
  • encryption of files and recordings before they are stored (AES-GCM, one key per file);
  • secrets (integration, language model and calendar keys) encrypted and never shown again;
  • role-based access control in each space, two-factor authentication for the platform's administration console;
  • a tamper-proof log of administration actions, which the customer can export;
  • no meeting capture without every participant's consent, enforced by the video server;
  • transcription on Agora's servers; masking of names, e-mail addresses and phone numbers before anything is sent to a language model;
  • hosting in the European Union, resource limits per service, security updates followed.

[To be confirmed: backups (frequency, encryption, rotation, restore tests) and continuity plan.]

The customer authorises the publisher to use the following sub-processors:

  • Hostinger: server hosting, in the European Union [To be confirmed: data centre country];
  • Resend, or the mail server chosen: sending service e-mails (invitations, sign-in codes, meeting notes);
  • the language model provider chosen by the platform: writing meeting notes and the assistant's answers, from masked texts.

When the customer itself connects its own language model provider, its calendar or an integration, that provider works for the customer, not for the publisher.

The publisher imposes on each sub-processor the same obligations as this agreement and remains liable for it to the customer. It informs the customer of any addition or replacement at least 30 days in advance; the customer may object on legitimate grounds and, failing agreement, terminate at no cost.

The data is hosted in the European Union. A transfer outside the Union by a sub-processor takes place only under a European Commission adequacy decision or its standard contractual clauses, supplemented by additional measures where needed. [To be confirmed: sub-processor by sub-processor.]

Agora gives the customer the means to answer people's requests itself: changing or removing a member, deleting a message, a file or a meeting, exporting meeting notes or a conversation. If someone contacts the publisher directly, it forwards the request to the customer without delay and helps it answer.

The publisher also helps the customer, with the information it has, with its impact assessment and, where applicable, the consultation of the supervisory authority.

The publisher notifies the customer of any personal data breach without undue delay and at the latest 48 hours after becoming aware of it [To be confirmed: time limit], with what it knows: nature, categories and approximate number of people and records, likely consequences, measures taken or planned. It completes this information as it goes.

During the contract, the customer can export its content: transcripts and meeting notes in Markdown, conversations in Markdown or JSON, the administration log. [To be confirmed: export of files and recordings.]

At the end of the contract, the space is locked, then deleted with its content at the end of the offer's retention period (90 days by default), after a warning. On the customer's written request, deletion can take place earlier. Backup copies are erased as they rotate [To be confirmed: period]. The publisher keeps only what the law requires it to keep.

The publisher makes available to the customer the information needed to demonstrate compliance with this agreement. The customer may have an audit carried out, by itself or by an independent auditor bound by confidentiality, once a year, with 30 days' notice, without disrupting the service or accessing other customers' data. [To be confirmed: who bears the costs.]

This agreement lasts as long as the contract and until the data is deleted. Each party's liability follows the terms of sale, without excluding what the GDPR places on each of them.