Personal data protection and privacy policy related to business operations

As part of its marketing and sales operations, Sirdata collects the professional contact data and other Personal Data from its Customers, Partners and Prospects.

The gathering of the information by Sirdata can be carried out in a number of ways :

• The individual concerned registers on Sirdata’s website and provides his or her professional contact details
• Sirdata’s employee meets with the individual concerned and they exchange contact details
• Sirdata’s employee searches for the contact information of the individual concerned by means of professional contact databases
• The individual concerned browses and/or interacts with Sirdata’s website, newsletters and marketing emails
• The individual concerned visits Sirdata’s premises, whose entrance is fitted with a video-surveillance camera
• The individual concerned is a journalist whom Sirdata contacts, or replies to, as part of its press relations
• The individual concerned uses the generative artificial-intelligence assistant made available in Sirdata’s portals

Sirdata collects identifying data (name, first name, etc.), professional contact data (professional email address, professional phone number etc.) and professional status data (organisation, job title etc.)

Through the company’s website, newsletters and marketing emails, Sirdata uses cookies and other similar technologies to collect the browsing and interaction data of the individual concerned (pages viewed, emails openings, clicks etc.)

The entrance to Sirdata’s premises is fitted with a video-surveillance camera, installed for the sole purpose of securing the premises against break-ins. Sirdata therefore processes images of the individuals who pass through that entrance, together with the date and time of entry. The camera’s field of view is limited to the entrance: no workstation is filmed, and the system does not track movements inside the premises.

Where the individual concerned uses the generative artificial-intelligence assistant available in Sirdata’s portals, Sirdata processes the questions they enter and the history of their conversations. Because the input field is free-form, it can receive whatever information the individual chooses to put there: they are advised not to enter any personal data or confidential information.

It is important to note that Sirdata does not collect any Sensitive Data.

The Data is used solely for sharing information about the company’s services and latest news, within the context of business and/or contractual relationships, and to answer requests for information.

The Data collected using cookies and other similar technologies is used with the purposes of audience analyses and statistical measures, enabling the improvement of the performance and relevance of Sirdata’s communications with the individual concerned.

In accordance with applicable law, Sirdata relies on the following legal bases for the use of the Data:

• Performance of the contract, for managing customer and partner relationships, delivering the services subscribed to, and invoicing.
• Compliance with a legal obligation, for retaining accounting and contractual records.
• Sirdata’s legitimate interest in developing its business and protecting its premises, for business prospecting and marketing towards professionals, press relations, and video-surveillance of the entrance to the premises.
• Consent, for cookies and similar audience-measurement technologies that are not exempt, and for the session recording described below.

Audience measurement and session recording. Sirdata uses two tools on its institutional websites:

• Microsoft Clarity, which records browsing sessions in order to analyse page usability. The tool is activated only once consent has been obtained, both for setting cookies and for the resulting data processing. Strict masking is enabled: displayed and entered content is obscured before any recording takes place. Session recordings are retained for thirty days; favourited sessions, aggregated click data and heatmaps, for nine months. The Data is processed by Microsoft, in the United States.
• Google Analytics 4. Where the individual concerned has consented, measurement relies on stable user identifiers and on cookies. Without consent, only a limited measurement is performed, on the basis of Sirdata’s legitimate interest: it sets no cookie and involves no transfer of the IP address. Both event data and user data are retained for fourteen months in the provider’s systems.

IP addresses are filtered by Sirdata’s server-side proxy (server-side Google Tag Manager) before anything is sent to Google Analytics.

Generative artificial-intelligence assistant. Sirdata’s portals make a conversational assistant available to their users. That assistant is an integral part of the service provided: its use therefore rests on performance of the contract, and not on consent — the individual concerned does not have to accept it separately, nor can they object to it without giving up the service.

To produce an answer, Sirdata transmits to its inference provider the question asked, the history of the current conversation, and the taxonomy of segments and categories. That provider is Google Cloud, Vertex AI service. Sirdata uses the service’s European regional endpoint whenever the model employed is available there; failing that only, the global endpoint, for which the provider guarantees no region. The processing may therefore take place outside the European Union, and it currently does for the models employed, under the conditions described in the “Transfers” section.

Sirdata only retains information necessary to achieve the purposes aforementioned, within a limit of 3 years after the end of the relationship — account closure for Customers and Partners, last interaction for Prospects and journalists. On top of the conservation process, Sirdata implements technical and organisational measures to ensure the security of Personal Data.

Images recorded by the video-surveillance camera fitted at the entrance to the premises are stored on a hard drive located on the premises and deleted automatically after seven days. Passing in front of the camera triggers a notification to senior management, by email and mobile application; that notification carries no image.

Questions put to the generative artificial-intelligence assistant, and the history of the conversations, are retained for twelve months from the date of the message.

Sirdata is committed to ensure the confidentiality of the Data collected and to prevent unauthorised third parties from viewing, using, disclosing, modifying, damaging or destroying said Data.

Only Sirdata employees whose role requires them to view the Data are authorised to access them, in accordance with strict confidentiality obligations to which they are subject, on penalty of proportionate and appropriate disciplinary sanctions.

Technical logging. To secure its services, detect incidents and diagnose faults, Sirdata automatically logs the requests handled by its servers and by the portals made available to its Customers and Partners. These logs contain in particular the IP address, the timestamp, the address of the page called and the account or session identifier. They serve a security and proper-operation purpose, to the exclusion of any commercial purpose.

They are kept only briefly: seventy-two hours for the application logs, twenty-four hours for the logs aggregated by the monitoring platform. On expiry they are permanently deleted. Only extracts placed in an incident file may outlive these periods, and then only for as long as that file lasts.

Personal data breaches and reporting an incident. Sirdata maintains an internal procedure for responding to personal data breaches, together with the register of breaches required by Article 33(5) GDPR. Where a breach is likely to result in a risk to the rights and freedoms of individuals, Sirdata notifies the CNIL within seventy-two hours; where the risk is high, it informs the individuals concerned individually. Where Sirdata acts as a processor, it notifies the Customer acting as controller within the periods laid down in the contract.

Anyone who observes or suspects a security flaw or a data breach may report it to Sirdata — Customer, Partner, Prospect or security researcher — at dpo@sirdata.fr, or by post to 20 rue Saint-Fiacre, 75002 Paris, France. Every report is handled under that procedure.

In order to allow Sirdata to operate its website, business operations and marketing tactics, the Data collected may be transferred to its subcontractors. The categories of subcontractors and, where they are named, the providers concerned are as follows:

• CRM and integration tooling: Freshworks (Freshsales), HubSpot
• Business telephony: Aircall
• Electronic signature: Docage
• E-mail and office suite: Google Workspace
• Web analytics and audience measurement: Google Analytics, Microsoft Clarity
• Hosting and Cloud services: Hetzner, Scaleway
• Accounting and invoicing: Sinao, Axonaut, Stripe
• Business contact data sourcing: lemlist
• E-mail sending server: Amazon Web Services, Simple Email Service, eu-west-1 region (Ireland)
• Short-message delivery: OVH
• Customer support: Zammad
• Generative artificial-intelligence assistant: Google Cloud, Vertex AI service

In practice, Sirdata’s subcontractors are established in the European Union or in the United States. Where a transfer outside the European Union takes place, Sirdata relies, as the case may be, on an adequacy decision of the European Commission — in particular the EU-US Data Privacy Framework for United States recipients certified under it — on Binding Corporate Rules, or on the Standard Contractual Clauses, combined where applicable with supplementary measures.

The video-surveillance camera fitted at the entrance to the premises is operated by Sirdata alone: the images are not entrusted to any remote-surveillance provider or to any external monitoring centre.

Sirdata does not share the personal Data of its Customers, Partners, Prospects and journalists with any company, organisation, or outside party other than its subcontractors.

In accordance with the regulation, Sirdata allows the exercise of the rights to object, to access and to erasure.

Right to object

To unsubscribe from Sirdata’s newsletters and marketing emails, please click here. An unsubscribe button and a contact email address are also always included in the marketing emails and newsletters sent by Sirdata for the exercise of the right to object.

To deactivate the gathering of Data by Sirdata using cookies and other similar technologies, please click here.

Rights to access and to erasure

To fulfill requests for access and erasure, Sirdata asks the individual concerned to submit his or her request using the form available here.

Proof of identity is not required as a matter of course. It is asked for only where a reasonable doubt remains as to the requester’s identity, and that doubt is then substantiated and recorded in the file for the request. Where a document is provided, Sirdata keeps it only for as long as the verification takes, then deletes it.

For any question relating to the processing of their Data, or to exercise their rights, the individual concerned may also write to Sirdata’s Data Protection Officer at dpo@sirdata.fr, or by post to 20 rue Saint-Fiacre, 75002 Paris, France.

This Policy may be subject to change. Any change to the rules of the Policy will be accessible as soon as it comes into effect onthis page.