This Privacy Policy explains how VSORA SAS (“VSORA”, “we”, “us”) processes personal data when you visit https://vsora.com (the “Website”), contact us, receive our communications or apply for a job with us, and what rights you have. It applies whatever your country of residence. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act (Law No. 78-17 of 6 January 1978).
In short:
- we only collect the data we need for the purposes described below;
- we ask for your consent where the law requires it, for example for statistics cookies;
- we never sell your personal data;
- we protect your data and require our service providers to do the same;
- you can access, correct or delete your data, and object to our commercial communications at any time.
1. Who is responsible for your data
The controller of your personal data is VSORA SAS, 13-15 Rue Jeanne Braconnier, 92360 Meudon, France. For any question about this policy or your data, write to [email protected]. VSORA has not appointed a data protection officer.
2. What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Responding to your enquiry (contact form, e-mail, telephone) | First and last name, e-mail address, telephone number, company name, region, type of enquiry (sales, press and media, general, technical support), your message and any information you give about your use case | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) | Time needed to handle your request, then 3 years from your last contact with us. If you become a customer: duration of the business relationship plus applicable limitation periods (generally 5 years); accounting records 10 years |
| Managing our business relationships (customer relationship management) | Data above, plus history of our exchanges, meetings and events attended | Legitimate interest in organising and following up our business relationships (Art. 6(1)(f) GDPR) | As above |
| Commercial communications to professionals (information on our products, news and events) | Name, business e-mail address, company, position, communication preferences | Legitimate interest in promoting our products to professionals, where the message relates to your professional activity (Art. 6(1)(f) GDPR). Your consent where required, e.g. for a non-professional address. You can object at any time. | 3 years from your last contact with us. If you object, we keep your e-mail address on an opt-out list for 3 years so that we respect your choice |
| Newsletter | E-mail address, name, company | Your consent (Art. 6(1)(a) GDPR) | Until you unsubscribe |
| Job applications | CV, cover letter, contact details, qualifications and experience, interview notes | Steps taken at your request before entering into an employment contract (Art. 6(1)(b) GDPR) | If you are hired: transferred to your personnel file. If not: 2 years from our last contact, unless you ask us to delete it earlier |
| Website security and operation | Technical logs: IP address, date and time, page requested, browser, referring page | Legitimate interest in securing and operating the Website (Art. 6(1)(f) GDPR) | 12 months |
| Audience measurement | Data collected by statistics cookies (see our Cookie Policy) | Your consent (Art. 82 French Data Protection Act; Art. 6(1)(a) GDPR) | Cookies: 13 months. Event data: 14 months |
| Compliance with legal obligations and defence of our rights, including export-control and sanctions rules applicable to our products | Data necessary for the obligation or the claim concerned | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR) | Duration of the obligation or the applicable limitation period |
Required fields. Fields marked with an asterisk (*) in our forms are required to handle your request. If you do not fill them in, we will not be able to respond. Other fields are optional.
Where the data comes from. We mostly collect data directly from you. We may also receive business contact details from event organisers, partners or public professional sources such as company websites and professional networks. In that case, we inform you when we first contact you.
No automated decisions. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Children. The Website is intended for professionals. It is not directed at children and we do not knowingly collect data about children under 15.
3. Cookies
The Website uses cookies and similar technologies. For details, and to change your choices, please read our Cookie Policy or click “Cookie settings” at the bottom of any page.
4. Who receives your data
Your personal data is only accessible to the VSORA teams that need it (sales, marketing, management and, for applications, human resources) and to the following recipients:
- service providers acting on our behalf, bound by a data processing agreement and by confidentiality and security obligations: HubSpot (customer relationship management, forms and e-mailing), OVH SAS (website hosting), CookieYes (consent management), Google (audience measurement, only if you consent), OVH (e-mail hosting) and Linagora (Twake Workplace collaboration suite), Ashby (recruitment) and JixArt (website maintenance);
- our professional advisers and auditors, who are bound by professional secrecy;
- public authorities and courts, where we are required to do so by law or by a court order;
- if VSORA or its business is involved in a merger, acquisition or sale, our advisers and any prospective purchaser, and the new owner.
5. Transfers outside the European Economic Area
Some recipients are located outside the European Economic Area, in particular in the United States (Google LLC, HubSpot, Inc. (European data centre), Ashby, Inc.) and in the United Kingdom (CookieYes Limited). These transfers are based on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework, for certified companies, and the decision on the United Kingdom) and/or on the Standard Contractual Clauses adopted by the European Commission. You can obtain a copy of these safeguards by contacting us.
6. Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, in particular access restricted to authorised persons, encrypted connections (HTTPS), and regular review of our security measures. We require the same from our service providers.
7. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- Access: to obtain confirmation that we process your data and a copy of it.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to have your data deleted in the cases provided for by law.
- Restriction: to ask us to restrict the processing of your data, for example while we check its accuracy.
- Portability: to receive the data you provided to us in a structured, commonly used format, or to have it transmitted to another controller, where the processing is based on your consent or a contract.
- Objection: to object to processing based on our legitimate interest, for reasons relating to your situation. We then stop unless we have compelling legitimate grounds or need the data for legal claims.
- Objection to commercial communications: at any time, without giving reasons, by clicking the unsubscribe link in each e-mail or by contacting us.
- Withdrawal of consent: at any time, where processing is based on your consent. This does not affect the lawfulness of processing carried out before the withdrawal.
- Instructions after death: to give instructions on what happens to your personal data after your death.
To exercise your rights, write to [email protected] or to VSORA SAS, 13-15 Rue Jeanne Braconnier, 92360 Meudon, France. We respond within one month, which may be extended by two months for complex requests; we will tell you if so. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it.
8. Complaints
If you believe that we do not handle your data in accordance with the law, you can lodge a complaint with the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of the country where you live or work. We would appreciate the chance to address your concern first, so please contact us.
9. Third-party websites
This policy does not apply to third-party websites linked from our Website. We recommend that you read their privacy policies.
10. Changes to this policy
We may update this policy, for example when we change our Website or our service providers. The date at the top shows when it was last updated. If we make significant changes, we will inform you by appropriate means, such as a notice on the Website.
11. Contact
VSORA SAS, 13-15 Rue Jeanne Braconnier, 92360 Meudon, France
E-mail: [email protected] — Website: https://vsora.com