Privacy policy

Data controller

KeeFinops, SARL with a share capital of €15,300, Versailles Trade and Companies Register 898 446 018, 25 allée des Chasseurs, 78230 Le Pecq, France, reachable at contact@keefinops.com.

Data collected

Forms and emails

The contact form and the request form for the sample audit deliverable send nothing to the site: each prepares, in your own email client, an email addressed to KeeFinops, which you review and send yourself. What you type in them is therefore neither sent to the site's server, nor written to its logs, nor kept by the site. This email leaves from your own email client, with the provider you chose, which acts for you and not on behalf of KeeFinops.

When you write to us, with the form or directly by email, KeeFinops receives your email address and the content of your email: for the contact form, name, company, business email address, role, subject and message; for the sample audit deliverable request, name, company, job title, business email address, optional message and the consent sentence you ticked.

Booking a call

Thirty-minute calls are booked on the KeeFinops page at Calendly: name, email address, chosen slot, time zone and, where applicable, answers to the questions on the page. KeeFinops is the controller of this processing; Calendly acts as its processor. The booking page is served by Calendly, which applies its own cookie policy there.

Client area

The client area (app.keefinops.com) is reserved for users designated by our clients. It processes account data: identifier, email address, password hash (never the password itself), authorized spaces and role; when you sign in through your organization's identity provider (SSO), the email address and name it sends. Each sign-in and each failed attempt is logged (identifier, IP address, date). The sign-in page sets a strictly necessary session cookie, which expires after twelve hours at most and is never used for tracking.

Technical logs

The server keeps technical logs (IP address, date, requested page, browser and referring page) for at most one month, for the security of the service. The public site sets no cookie and uses no audience measurement tool.

Purposes and legal basis

• Answering your request, organizing a call and, if you asked for it, sending you a document such as the sample audit deliverable (forms, emails, call booking): your consent and, where applicable, pre-contractual measures taken at your request.
• Giving access to the client area: performance of the contract with your organization.
• Technical logs and sign-in logs: the legitimate interest of KeeFinops in securing the service.

No automated prospecting is done from this data without your explicit agreement.

Recipients and processors

Data is accessible only to the members of the KeeFinops team who need it; it is never sold or shared with third parties for commercial purposes. The following providers act as processors of KeeFinops within the meaning of the GDPR:

• OVH SAS (OVHcloud, 2 rue Kellermann, 59100 Roubaix, France): hosting of the site, the client area, the technical logs and the backups, in France.
• Microsoft Ireland Operations Ltd (Dublin, Ireland), Microsoft 365 service: KeeFinops mailbox, which receives your emails, including those prepared with the site's forms; data hosted in the European Union.
• Calendly LLC (United States): booking page.

The site's forms use no sending service: no KeeFinops provider receives what you type in them, only its mailbox receives the email you send.

Client area accounts are backed up in encrypted form by KeeFinops at OVH SAS, in France, which cannot read these backups. An additional copy, encrypted in the same way, is planned at a second storage provider established in the European Union: it is not in service yet, and this provider will be named here before any copy is made.

Transfers outside the European Union

• Calendly LLC (United States): transfer covered by the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), under which Calendly is certified, and by the standard contractual clauses of the European Commission.
• Microsoft 365: data is hosted in the European Union; occasional access from a third country, for support or the security of the service, is covered by the Data Privacy Framework, under which Microsoft Corporation is certified, and by the standard contractual clauses.

A copy of these safeguards can be obtained by writing to contact@keefinops.com.

Retention period

• Contact requests, emails and bookings: three years after the last exchange, then deleted.
• Client area account: for the term of the contract with your organization, then deleted.
• Technical logs and sign-in logs: one month at most on the server.
• Encrypted account backups: seven months at most (six-month rotation, then 31 days of retention of deleted versions).
• Image of the production instance kept by the hosting provider for recovery after an incident: seven rolling days. It holds a copy of the server data, logs included, which may therefore remain there for up to seven days after they are deleted from the server.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time and the right to set instructions on what happens to your data after your death (article 85 of the French Data Protection Act). To exercise these rights, write to contact@keefinops.com: we reply within one month of receiving your request. This period may be extended by two months for a complex request; you are then informed within the first month.

You may also lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

Security

The site is served exclusively over HTTPS. Client data processed during engagements is covered by separate contractual commitments: read-only access, separation per client, European hosting or hosting in the client's environment.