Data Processing Agreement (DPA)
This translation is provided for information. The French version is the only binding one. Read the French version
Version dated November 4, 2026.
This agreement governs, within the meaning of Article 28 of the General Data Protection Regulation (GDPR), the processing by Mindsef of your prospects' personal data. It supplements the general terms of sale and applies for as long as your subscription runs.
1. The parties
You, the customer, are the controller of your prospects' data: you decide who you prospect and why.
Mindsef is the processor: it processes this data on your behalf, only to run your prospecting. Mindsef, sole proprietorship. Full identity in the legal notice. Contact: contact@mindsef.com.
2. Subject matter and nature of the processing
Reading your LinkedIn inbox, writing the messages, sending the ones you approve or your mode allows, tracking replies, transcribing voice notes, booking meetings in your calendar and producing your report. Nothing else.
3. Data and data subjects
The data subjects: your prospects and your LinkedIn contacts. The data: name, job title, company, LinkedIn profile link, messages exchanged (including transcribed voice notes), status in your prospecting, meetings, and the email address or phone number if the prospect provided them.
4. Duration
The term of your subscription, then until the deletion provided for in Article 10.
5. What Mindsef commits to
- Process the data only on your instructions: your settings in the app count as written instructions.
- Restrict access to the people who need it, who are bound by confidentiality.
- Protect the data with the measures of Article 32, described in Article 8.
- Help you respond to your prospects' requests (access, rectification, erasure, objection). A prospect who asks not to be contacted again never receives another message.
- Assist you, with the information available to Mindsef, with security, data breaches and impact assessments.
- Provide you with the information that demonstrates compliance with these obligations, and allow the audits provided for by Article 28, on written request.
- Never sell the data, never use it for advertising, and never show one customer's text to another customer.
6. Sub-processors
You authorize Mindsef to engage sub-processors, bound by the same obligations, in these categories:
- a LinkedIn connection partner;
- an artificial intelligence model provider, to write drafts and transcribe voice notes;
- a database host;
- a host for the app's server;
- Google, for your calendar, if you connect it.
The list of sub-processors by name is on the Sub-processors page. Mindsef notifies you by email before adding or replacing a sub-processor; you can object by canceling your subscription.
7. Where the data is
The database is hosted in the European Union, in Ireland. The app's server is in the United Kingdom, a country recognized as adequate by the European Commission. A transfer to another country outside the European Union only takes place with the safeguards provided for by the GDPR: an adequacy decision or the European Commission's standard contractual clauses.
8. Security
Encrypted connections, access tokens encrypted in the database, isolation between customers through a row-level policy in the database, a nightly backup that is checked, two-factor authentication, limited attempts.
9. Data breach
If a breach affects your data, Mindsef notifies you by email without undue delay after becoming aware of it, with what is known: its nature, the data and individuals concerned, its likely consequences and the measures taken. You remain free to notify the CNIL and the individuals concerned.
10. End of the subscription
When the subscription ends, your LinkedIn account is disconnected and your prospecting data is deleted 90 days later. Before then, you can export it from the settings. Invoices are kept for 10 years, as required by law.