1. Purpose of this policy
The purpose of this policy is to inform you about the methods we employ to collect your personal data, in strict compliance with your rights.
All information received and/or collected is processed in accordance with applicable laws and regulations.
Revoptim, in its collection and management of your personal data, complies with Law No. 78-17 of January 6, 1978, concerning data processing, files, and freedoms, in its current version, known as “Informatique et Libertés,” and Regulation (EU) 2016/679 of April 27, 2016, as soon as it becomes applicable (hereinafter: the “GDPR”).
2. Identity of the data controller
The data controller for the collection of your personal data is the company REVOPTIM, a simplified joint-stock company (SASU) registered with the Paris Trade and Companies Register under number 945 007 458, with its registered office at 10 RUE DE PENTHIÈVRE 75008 PARIS France (referred to herein as: “We”).
3. Data protection officer
We have appointed a Data Protection Officer (DPO). To contact them, please complete our contact form.
4. Our collection methods
The personal data we collect and process depends on how you interact with us, including:
- As a “Visitor” when you visit the website revoptim.com, participate in our webinars and other digital events, contact us directly (via our website forms, by email, or during physical events, for example), download a white paper, or interact with us in any way without being a Client or a Debtor;
- As a “Client” when you are the contact person of a company to which Revoptim provides invoicing follow-up and collection services, under the contract concluded with that company;
- As a “Debtor” when your data is shared with us by one of our Clients, in connection with the follow-up or amicable or judicial recovery of a debt for which that Client considers you liable.
5. What we collect
Depending on how you interact with us, the data we may collect is as follows.
When you are a Visitor, the following categories of personal data may be collected:
- Identification data, for example, your first name, last name, email address;
- Device data, for example, the model of the device used, the browser version, screen resolution;
- Browsing data, for example, the pages you visit on the website revoptim.com;
- Your IP address;
- Approximate location data (city, country).
When you are a Client, the following categories of personal data may be collected: your first name, last name, job title, professional email address and professional phone number, as well as data relating to the contractual relationship and exchanges with your dedicated account manager.
When you are a Debtor, Revoptim helps its Clients manage and recover their invoices. In this context, certain information about you may be shared with us by our Clients, such as your first name, last name, postal address, email address, and phone number, as well as information relating to the debt concerned (amount, due date, invoicing history). The contract between us and our Clients authorizes us to use this data to carry out this mission, in compliance with Decree No. 96-1112 on amicable debt collection activities.
When collecting your personal data, we inform you whether certain data must be provided mandatorily or if it is optional. Mandatory data is necessary for the operation of our services. Regarding optional data, you are entirely free to provide it or not. We also inform you of the potential consequences of a failure to respond.
6. Source of collection
We may collect personal data in two different ways:
- Directly from you:
- voluntarily, when you fill out data collection fields (contact form);
- automatically, when you browse the website (via Google Analytics);
- Indirectly:
- from our commercial partners.
In the event that partners or third parties collect other personal data, they shall be solely responsible for complying with their legal and regulatory obligations regarding such collection and processing, which they perform independently, using their own means, and for their sole purposes.
7. For what purposes do we collect your data?
Depending on how you interact with us, our processing activities pursue the following purposes, each associated with its legal basis.
| Purpose | Legal basis |
|---|---|
| Respond to a request from contact forms, an email you send us, or a contact during a digital or physical event or any other channel | Performance of a contract to which you are a party, or pre-contractual measures taken at your request |
| Aggregation and analysis of browsing data on revoptim.com to establish website statistics | Legitimate interests pursued by the data controller or a third party |
| Establishment and management of a prospect database | Consent |
| Management of marketing communication and business development | Consent |
| Sending communications related to our offers, services, new content, and event organization | Consent |
| Invoicing follow-up and amicable or judicial recovery of our Clients’ debts | Legitimate interests of Revoptim or its Client (recovery of a due debt) |
| Management and processing of requests to exercise the rights of natural persons | Compliance with a legal obligation |
| Processing necessary to ensure compliance with applicable laws and regulations | Compliance with a legal obligation |
8. Recipients of collected data
Your personal data will be accessible to authorized and qualified personnel of our company, the control departments (including auditors), and our sub-processors.
Public bodies may also be recipients of personal data, exclusively to meet our legal obligations, as well as judicial auxiliaries and ministerial officers.
Organizations responsible for debt collection may be recipients of buyer payment data only.
9. Transfer of personal data
Your personal data will not be subject to sales, rentals, or exchanges for the benefit of third parties.
10. Personal data retention period
Your data is retained for the following periods, depending on its nature:
| Data concerned | Retention period |
|---|---|
| Client and prospect management | Period strictly necessary to manage our commercial relationship. Data needed to establish proof of a right or a contract is kept for the duration provided by applicable law. |
| Marketing aimed at clients | 3 years from the end of the commercial relationship |
| Marketing aimed at a non-client prospect | 3 years from collection or from the prospect’s last contact |
| Identification documents — right of access or rectification | 1 year (Article 9 of the Code of Criminal Procedure) |
| Identification documents — right to object | 3 years (Article 8 of the Code of Criminal Procedure) |
| Opt-out lists for marketing | 3 years minimum from the exercise of the right to object |
| Debtor data processed on behalf of our Clients | Duration of the recovery mission entrusted by our Client, within the limit of the applicable limitation period (5 years for a commercial debt) |
| Cookies | 13 months |
At the end of the three-year period applicable to marketing, we may contact you again to ascertain whether you wish to continue receiving commercial solicitations.
11. Security
We inform you that we take all useful precautions and implement appropriate organizational and technical measures to preserve the security, integrity, and confidentiality of your personal data and, in particular, to prevent them from being altered, damaged, or accessed by unauthorized third parties.
12. Hosting
We inform you that your data is kept and stored, for the entire duration of its retention, on Amazon Web Services (AWS) servers via the AWS Amplify service. These servers are located in Ireland (eu-west-1 region), within the European Union.
Transfers outside the European Union
Some of our technical processors (in particular Google Analytics) may process data from servers located outside the European Union, including in the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission, or by any other recognized mechanism offering equivalent guarantees for the protection of your data.
13. Cookies
Cookies are text files, often encrypted, stored in your browser. They are created when a user’s browser loads a given website: the site sends information to the browser, which then creates a text file. Each time the user returns to the same site, the browser retrieves this file and sends it to the website’s server.
The website uses the following types of cookies:
Technical cookies: These cookies are used throughout your browsing to facilitate it and perform certain functions. A technical cookie can, for example, be used to remember the user’s preferences regarding language or website presentation. These cookies are essential for the proper functioning of the service.
Audience analytics cookies (Google Analytics): These cookies allow us to measure the number of visits to the site, the number of page views, and visitor activity for statistical purposes. This information allows us to improve the site and your user experience by better understanding our visitors’ expectations.
Google Analytics collects the following data:
- Pages visited and navigation paths;
- Time spent on the site;
- Traffic source (search engine, direct link, etc.);
- Technical information (browser type, screen resolution, operating system);
- Approximate location (city, country) based on anonymized IP address.
We remind you that you can object to the placement of cookies by configuring your browser. Such a refusal could, however, prevent the proper functioning of certain features of the site.
14. Access to your personal data
In accordance with the “Informatique et Libertés” law and the GDPR, you have the right to obtain communication of, and, where applicable, the rectification or erasure of, data concerning you. You may contact us at:
- Online contact form: our contact form;
- Postal address: 10 RUE DE PENTHIÈVRE 75008 PARIS France.
It is reminded to individuals whose data is collected based on our legitimate interest that they may object to the processing of their data at any time. However, we may be required to continue processing if there are legitimate grounds for the processing that override your rights and freedoms or if the processing is necessary for the establishment, exercise, or defense of legal claims.
15. Right to define post-mortem data directives
You have the right to define directives regarding the retention, erasure, and communication of your personal data after your death.
These directives can be general, meaning they apply to all personal data concerning you. In this case, they must be registered with a certified digital trusted third party recognized by the CNIL.
The directives can also be specific to the data processed by our company. In that case, you should send them to us at the following contact details:
- Online contact form: our contact form;
- Postal address: 10 RUE DE PENTHIÈVRE 75008 PARIS France.
By sending us such directives, you expressly give your consent for these directives to be retained, transmitted, and executed according to the terms provided herein.
You may designate a person in your directives responsible for their execution. This person will then be authorized, upon your death, to review said directives and request their implementation. Failing such designation, your heirs will be authorized to review your directives upon your death and request their implementation.
You may modify or revoke your directives at any time by writing to us at the above contact details.
16. Portability of your personal data
You have a right to data portability for the personal data you have provided to us, understood as the data you have actively and consciously declared as part of accessing and using the services, as well as data generated by your activity when using the services. We remind you that this right does not apply to data collected and processed on a legal basis other than consent or the performance of our contract with you.
This right can be exercised free of charge, at any time, in order to retrieve and retain your personal data.
In this context, we will send you your personal data, by any means deemed appropriate, in a commonly used and machine-readable open standard format, in accordance with industry best practices.
17. Lodging a complaint with a supervisory authority
You are also informed that you have the right to lodge a complaint with a competent supervisory authority (the French National Commission for Information Technology and Civil Liberties (CNIL) for France), in the Member State of your habitual residence, place of work, or the place where the alleged infringement of your rights occurred, if you consider that the processing of your personal data subject to this Policy constitutes a violation of applicable texts.
This recourse may be exercised without prejudice to any other recourse before an administrative or judicial court. Indeed, you also have a right to an effective administrative or judicial remedy if you consider that the processing of your personal data subject to this Policy constitutes a violation of applicable texts.
18. Restriction of processing
You have the right to obtain restriction of the processing of your personal data in the following cases:
- during the verification period that we implement when you contest the accuracy of your personal data;
- when the processing of such data is unlawful, and you wish to restrict this processing rather than delete your data;
- when we no longer need your personal data, but you wish for its retention to exercise your rights;
- during the period of verification of legitimate grounds, when you have objected to the processing of your personal data.
19. Modifications
We reserve the right, at our sole discretion, to modify this policy, in whole or in part, at any time. Such modifications will become effective upon the publication of the new policy.