Privacy policy

Only the French version of this document is legally binding. Translations are provided for information purposes only; in the event of any discrepancy, the French version shall prevail.

Version 1.2 – In force as of 10/01/2026

Preamble

This privacy policy describes how UN SITE À VOUS, sole proprietorship (EI), SIRET 904 378 866 00027, whose registered office is located at 60 rue François 1er, 75008 Paris, France, EU VAT number FR 50904378866 (hereinafter the “Publisher”), processes the personal data of users of the EPI Manager service (hereinafter the “Service”) and of visitors to its showcase website.

This policy complements the General Terms of Sale and the General Terms of Use of the Service, which respectively govern the commercial aspects and the terms of use of the platform.

Scope: this policy exclusively covers the data processing carried out in connection with the EPI Manager Service (accounts, organizations, content, billing, emails) and the audience measurement of the showcase website, as well as the data provided by the user when getting in touch. It does not cover the B2B commercial prospecting activities carried out by the Publisher with professional prospects who do not have an account on the Service (for example via the Brevo tool): this prospecting is based on the Publisher’s legitimate interest within the meaning of article 6.1.f of the GDPR, is subject to dedicated information at the first contact and to a simple right to object with each message, independently of this document.

1. Data controller

The controller of the personal data described in this policy is the Publisher, as identified above.

For any question relating to this policy or to the exercise of your rights, you can contact the Publisher at: contact@epi-manager.fr.

As a sole proprietorship, the Publisher is not required to appoint a data protection officer (DPO), since the processing carried out does not involve large-scale processing of sensitive data within the meaning of article 37 of the GDPR. The address above serves as the single point of contact for any privacy-related question.

2. Data collected

In connection with the use of the Service, the following categories of data are collected:

• Account data: last name, first name, email address, password (stored in encrypted form), language and display preferences, notification preferences, choice whether or not to receive commercial emails;
• Organization data: name of the organization (company, association, club or personal use), the user’s role within the organization(s) to which they belong (manager, member), official identifier of the organization (SIRET, RNA, VAT number or foreign equivalent) and, where applicable, proof of existence uploaded for its verification;
• Terms acceptance data: date and version of the Terms of Use accepted at registration and of the Terms of Sale accepted at the first paid subscription;
• Billing data: managed directly by Stripe on behalf of the Publisher (see section 5); the Publisher does not store users’ bank details;
• Referral data: referral codes and club codes used, and the link between the code holder and the referred person;
• Business data: equipment inventory, assemblies, inspection histories, equipment outings, associated documents (invoices, certificates, photos), uploaded by the user or the members of their organization;
• Electronic signature data: validation code sent by email when signing an inspection record, digital fingerprint (hash) of the signed document, timestamp of the signature;
• Technical data: event log (logins, emails sent), including the IP address and the email address concerned; data required for offline mode and synchronization;
• Audience measurement data of the showcase website: see section 6 (Matomo).

3. Purposes and legal bases

3 bis. Emails

The emails sent by the Service relate to its operation: email verification, validation codes, alerts and notifications (adjustable in the notification preferences), trial period onboarding.

The only commercial email is a follow-up sent once, fifteen (15) days after the end of the trial period, to accounts managing an organization without a paid subscription. The user can object to it at any time, free of charge, via the unsubscribe link in that email or from the notification preferences of their account.

4. Who has access to your data within the Service

In accordance with the Terms of Use, the data and content entered by a user in an organization (inventory, documents, histories) are only accessible to the authorized members of that organization, according to the roles defined by the organization manager. The Service offers no feature for publicly sharing data. The manager of an organization may have access to the data entered by the members they have invited, to the extent necessary for managing the organization.

The proofs of existence uploaded for the verification of an organization are only accessible to the Publisher.

5. Recipients and processors

Data is processed by the Publisher and may be transmitted to the following processors, strictly to the extent necessary for the provision of the Service:

No other processor is currently involved in the operation of the Service. The Brevo tool, otherwise used by the Publisher for its B2B commercial prospecting, is not integrated into the Service and does not process any data of the Service’s users in this context.

Public registers consulted: to verify the existence of an organization, its official identifier is sent to the public register of its country: the French State business directory (Annuaire des entreprises, France), the European Commission’s VIES system (European Union VAT numbers), Companies House (United Kingdom) or Zefix (Switzerland). Only the identifier of the organization is transmitted.

6. Audience measurement of the showcase website (Matomo)

The EPI Manager showcase website uses Matomo, an audience measurement tool self-hosted by the Publisher, to the exclusion of any third-party tool such as Google Analytics.

Matomo is only activated, and its trackers only set, after the visitor’s consent, obtained through the cookie management banner of the showcase website. This consent is requested from all visitors, including those from Germany, Austria, Belgium and Spain, whose regulations require it even for anonymized statistics. Refusing has no impact on access to the website.

This Matomo installation is also configured to limit collection to what is strictly necessary: purpose limited to producing statistics, anonymization of the IP address, no cross-referencing with other processing or databases, no transmission to third parties, data retention limited to a maximum of 25 months and trackers to a maximum of 13 months.

The statistics produced by Matomo remain strictly internal to the Publisher and are neither cross-referenced with the Service’s account data nor transmitted to third parties. Any visitor can withdraw their consent at any time via the “Manage consent” link on the showcase website.

The Publisher reserves the right to analyze, under the same confidentiality conditions and without using external third-party tools, how users use the application in order to improve the Service; such analysis, if implemented, will remain strictly internal and will be specified in a later version of this policy where applicable.

7. Retention period

Data is retained according to the following rules:

• for the entire lifetime of the account, whether on a free or paid tier;
• an account whose email address has never been verified receives a reminder after seven (7) days, and is then deleted thirty (30) days after its creation;
• an organization’s proof of existence is kept until it is replaced by a new proof or until the organization is deleted;
• the event log (including IP addresses) is kept for ninety (90) days;
• if the account is deleted at the request of a user who has made no payment, all data is deleted without delay;
• if the account is deleted at the request of a user who has made at least one payment, all data linked to the account is deleted, with the exception of transaction supporting documents (invoices, billing information), kept for ten (10) years from their issue, in accordance with legal accounting and tax obligations;
• Matomo audience measurement data is kept for a maximum of 25 months, in accordance with the CNIL’s recommendations.

8. Security

The Publisher implements technical and organizational measures to protect data, in particular:

• data hosting in France (o2switch);
• password encryption;
• encryption of electronically signed documents and generation of a digital fingerprint to verify their integrity;
• enhanced identity verification (code by email) for sensitive actions such as signing inspection records;
• storage of proofs of existence out of any public access;
• access control by user account and by role within each organization.

9. Rights of individuals

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), everyone has the following rights over their personal data:

• right of access and rectification;
• right to erasure, within the limits described in section 7 (legal retention of billing documents);
• right to restriction of processing;
• right to object, in particular to the commercial email (section 3 bis), and right to withdraw consent to Matomo audience measurement at any time (section 6);
• right to data portability, under the conditions and within the limits described in the Terms of Sale regarding the export of the Service’s data;
• right to lodge a complaint with the CNIL (www.cnil.fr).

These rights can be exercised by writing to contact@epi-manager.fr.

10. Transfers outside the European Union

Data is hosted in France (o2switch) and the Publisher does not organize any transfer of data outside the European Union for the purposes of the Service, with the exception of:

• payment flows processed by Stripe, which may transfer certain data in connection with its own processing, governed by standard contractual clauses compliant with the GDPR;
• the identifier of a British or Swiss organization, transmitted to the public register of its country for verification (section 5), the United Kingdom and Switzerland benefiting from an adequacy decision of the European Commission.

11. Changes to this policy

The Publisher may change this policy at any time, in particular to take account of legal, regulatory or technical changes to the Service. Any substantial change will be brought to the attention of users under the same conditions as those provided for the Terms of Sale and Terms of Use.