Privacy policy of the Chat Episto.fr

What is the purpose of this policy?

We place great importance on the protection and confidentiality of your personal data, which to us represents a commitment to seriousness and trust.

The data privacy policy precisely reflects our willingness to comply with applicable data protection rules, particularly those of the General Data Protection Regulation ("GDPR").

In particular, the privacy policy aims to inform you about how and why we process your data as part of the services we provide.

Who is this policy for?

The policy applies to you, regardless of your place of residence, as long as you are of the legal digital age required in your country of residence (e.g., 15 years for France, 16 years for Germany, 13 years for Belgium, etc.) and you respond to a survey via the Episto Chat. If you are unsure about the applicable legal digital age in your country of residence, you can ask us at dpo@episto.fr.

If you are under the legal digital age required in your country of residence, you are not permitted to respond to a survey without the prior and explicit consent of one of your parents, which must be sent in writing to dpo@episto.fr. If you believe we may hold information about one of your children who is under the legal digital age in your country of residence without having consented, you can request that we delete it at dpo@episto.fr.

Why do we process your data?

As part of the services offered, we necessarily process your personal data for the following reasons and foundations:

• To respond to the surveys and polls we offer based on our terms of service.
• To ensure and enhance the security and quality of our services on a daily basis (e.g., statistics, data security, etc.) based on the legal obligations we are subject to, our terms of sale, and our legitimate interest in ensuring the proper functioning of our services.

Your data is collected directly from you when you use our platform, and we commit to only processing your data for the reasons described above. In particular, we commit to never sending commercial solicitations regarding our services to individuals responding to the surveys and campaigns.

Furthermore, we guarantee that none of your data will ever be sold to a partner or third party. However, as soon as you voluntarily publish content on the pages we maintain on social networks, you acknowledge that you are fully responsible for any personal information you may provide, regardless of the nature and source of the information provided.

What data do we process and for how long?

We have summarized the categories of personal data we collect as well as their respective retention periods.

• By default, your data is anonymized except in the express case where you choose to provide identifying information in the survey (e.g., name, first name, and email address). This choice, when available, is always optional. If you provide identifying data, your data will no longer be anonymized and will be retained only for the duration of the survey.

IMPORTANT: Surveys commissioned by our clients may involve the collection of varied data (e.g., personal life, hobbies, preferences, etc.) but also the collection of sensitive data (e.g., sexual orientation, political sensitivity, sexual preference, etc.). This data, like the previous data, remains anonymous unless you decide to provide identifying data in the chat. Your consent will always be requested before you answer these questions, and the data will only be retained for the duration of the survey.

• Connection data (e.g., logs, IP address, etc.) retained for a period of 1 year.

If you would like more details on the retention periods applicable to your data, you can contact us at: dpo@episto.fr. In any case, all your data will be deleted when you request the deletion of your account, with a maximum delay of 30 days.

The deletion of your personal data is irreversible, and we will no longer be able to communicate it to you after this delay. At most, we can only retain anonymous data for statistical purposes.

Please also note that in case of litigation, we are required to keep all data concerning you for the entire duration of the processing of the file, even after the expiration of their retention periods described above.

What rights do you have to control the use of your data?

The applicable data protection regulations grant you specific rights that you can exercise at any time and free of charge, in order to control how we use your data.

• Right of access and copy of your personal data as long as this request does not conflict with business secrecy, confidentiality, or the secrecy of correspondence.
• Right to rectify personal data that is inaccurate, outdated, or incomplete.
• Right to request the deletion (“right to be forgotten”) of your personal data that is not essential for the proper functioning of our services.
• Right to limit your personal data, which allows for the recording of the use of your data in case of a dispute regarding the legitimacy of a processing.
• Right to the portability of your data, which allows you to retrieve some of your personal data in order to easily store or transmit it from one information system to another.
• Right to give directives on the fate of your data in the event of death, either through your intermediary or through a trusted third party or a beneficiary.

For a request to be considered, it is imperative that it is made directly by you at the address dpo@episto.fr. Any request that is not made in this way cannot be processed.

Requests cannot come from anyone other than you. We may therefore ask you to provide proof of identity in case of doubt about the identity of the requester.

We will respond to your request as soon as possible, within a limit of three months from the date of receipt, in case the request is technically complex or if we receive numerous requests at the same time.

Please note that we may always refuse to respond to any excessive or unfounded requests, particularly with regard to their repetitive nature.

Who can access your data?

We only share your data with persons duly authorized to use it for the implementation of our surveys.

Please note that your personal data may only be shared, with your explicit consent, with business partners for them to offer you their offers and services.

How do we protect your data?

We implement all the technical and organizational measures required to ensure the security of your data on a daily basis and, in particular, to combat any risk of destruction, loss, alteration, or unauthorized disclosure of your data (e.g., training, access control, antivirus, etc.).

Can your data be transferred outside the European Union?

Unless strictly necessary and exceptionally, we never transfer your data outside the European Union, and your data is always hosted on European soil. Furthermore, we do our utmost to recruit only service providers that host your data within the European Union.

In the event that our service providers are nonetheless required to transfer personal data concerning you outside the European Union, we carefully ensure that they implement appropriate safeguards to ensure the confidentiality and protection of your data.

Who can you contact for more information?

Our Data Protection Officer (“DPO”) is always available to explain in more detail how we process your data and to answer any questions you may have on the subject at the following address: dpo@episto.fr.

How can you contact the CNIL?

You can contact the French data protection authority (the “Commission nationale de l'informatique et des libertés” or “CNIL”) at any time at the following contact details: CNIL Complaints Service, 3 place de Fontenoy – TSA 80751, 75334 Paris Cedex 07 or by phone at 01.53.73.22.22.

Can the policy be changed?

We may modify our privacy policy at any time to adapt it to new legal requirements as well as to new processes we may implement in the future. You will obviously be informed of any changes to this policy.

Certified compliant by Dipeeo ®