Privacy Policy

The Sogelink Group places great importance on protecting your personal data. This policy informs you, in a transparent manner, about how we collect, use, retain and protect your data, as well as about the rights available to you under the GDPR and the French Data Protection Act of 6 January 1978, as amended.

4.1 Performance of a contract (Art. 6.1.b)

Processing necessary for the provision of our services (licence management, customer accounts, support, training) is based on the performance of the contract concluded between Sogelink and the user or their employer.

Where the user of Sogelink’s solutions is an employee of the client company and is therefore not personally a party to the contract, the processing necessary to provide and properly operate the service is based on Sogelink’s legitimate interest (see 4.3) in performing the contract concluded with its client.

4.2 Legal obligation (Art. 6.1.c)

Certain processing is required by legal obligations: retention of accounting records (Art. L.123-22 of the French Commercial Code), obligations relating to regulated training (AIPR, electrical authorisations), and tax obligations.

4.3 Legitimate interest (Art. 6.1.f)

Sogelink processes certain data on the basis of its legitimate interest. In accordance with Article 13.1.d of the GDPR, the interests pursued are as follows:

• B2B commercial prospecting: developing and promoting Sogelink’s business among professionals whose role matches the solutions offered;
• Information system security: ensuring the integrity, availability and confidentiality of our services and detecting unauthorised access;
• Fraud prevention: protecting Sogelink and its clients against fraudulent use of accounts and licences;
• Software licence compliance: preserving Sogelink’s intellectual property rights over its solutions and ensuring equal treatment between clients;
• Managing contact and demo requests: responding to enquiries from professional prospects.

4.4 Consent (Art. 6.1.a)

For processing requiring your explicit agreement — newsletter, non-essential trackers, tracking of prospecting email opens, retention of your application in our CV database — Sogelink collects your free, informed, specific and unambiguous consent. You may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

4.5 Mandatory or optional nature of data provision

Providing certain data is a condition for accessing our services:

• Data necessary for the performance of the contract (identity, professional contact details, account data): providing this data is a condition for entering into and performing the contract. Without it, Sogelink cannot open or maintain your account, nor issue the licences subscribed to.
• Data required by a legal obligation (billing data, data required to issue regulated training certificates): providing this data is mandatory. Without it, Sogelink cannot produce accounting documents or issue the corresponding certificates.
• Optional data (communication preferences, data entered in a free-text form): providing this data is optional and its absence has no impact on access to our services.

Mandatory fields are indicated as such in our forms.

Your data is processed by authorised personnel within the Sogelink Group and may be shared with the following categories of recipients:

5.1 Technical processors

• Cloud hosting providers (servers located within the European Union)

• Customer relationship management (CRM) tools, emailing platforms, audience analysis tools

• Secure payment providers and ticketing solution publishers

All our processors are bound by a contract compliant with Article 28 of the GDPR.

5.2 Approved resellers and distributors

In connection with licence resales, approved distributors have access to the data strictly necessary for carrying out their mission.

• Where the distributor acts exclusively on Sogelink’s instructions, it acts as a processor within the meaning of Article 28 of the GDPR.

• Where the distributor jointly determines, with Sogelink, the purposes and means of processing, Sogelink and the distributor are joint controllers within the meaning of Article 26 of the GDPR. The main terms of the agreement between them are available on request from the DPO. You may exercise your rights with either joint controller.

5.3 Competent authorities

Sogelink may disclose data to the competent judicial, administrative or tax authorities where required to do so by a legal obligation.

Sogelink never sells your personal data to third parties for commercial purposes.

Sogelink favours hosting data within the European Union or the European Economic Area (EEA).

In the course of its activities, however, Sogelink may use providers established outside the European Union or the European Economic Area, or providers that may themselves use further processors located outside these areas: for example, audience measurement tools, advertising networks and marketing automation platforms. In such cases, Sogelink ensures that the transfer is governed by one of the following mechanisms:

• An adequacy decision of the European Commission, where the destination country benefits from one;
• Failing that, the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021), supplemented where necessary by additional technical and organisational measures (encryption, pseudonymisation, access restrictions) following an assessment of the legislation of the destination country.

On request sent to dpo@sogelink.com, you may obtain an up-to-date list of our processors, the countries concerned, and a copy of the safeguards put in place for each transfer.

Data is retained for the period strictly necessary to fulfil the stated purposes, in compliance with legal obligations. The table in Section 3 sets out the retention periods applicable to each processing activity.

Once the active retention period expires, data is either permanently deleted or archived in an intermediate database with restricted access for the period required by legal obligations, before being permanently deleted.

In accordance with the GDPR (Articles 15 to 22) and the French Data Protection Act, you have the following rights:

• Right of access — obtain confirmation that data concerning you is being processed and receive a copy of it (Art. 15).
• Right to rectification — have inaccurate or incomplete data concerning you corrected (Art. 16).
• Right to erasure — request the deletion of your data in the cases provided for by the GDPR, subject to legal obligations (Art. 17).
• Right to restriction — obtain the temporary suspension of processing in certain situations (Art. 18).
• Right to object — object, on grounds relating to your particular situation, to processing based on Sogelink’s legitimate interest; Sogelink will cease the processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims (Art. 21.1). With regard to commercial prospecting, you may object at any time without having to justify your request (Art. 21.2).
• Right to withdraw consent — withdraw any consent to processing you may have previously given to Sogelink. Withdrawal can be exercised via our preference manager for trackers placed while browsing, via the preference centre accessible in the footer of our emails for tracking of email opens, and by simply contacting our DPO for other processing.
• Right to data portability — receive your data in a structured, machine-readable format, or have it transmitted to another controller (Art. 20).
• Post-mortem directives — set directives regarding what happens to your data after your death (Art. 85 of the French Data Protection Act).

How to exercise your rights

Send your request by email to dpo@sogelink.com or by post to our registered office, specifying your identity and the nature of your request. Proof of identity may be requested. Sogelink undertakes to respond within one month (extendable by two months for complex requests).

If you believe your rights have not been respected, you may lodge a complaint with the CNIL: www.cnil.fr — 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Sogelink implements appropriate technical and organisational measures in accordance with Article 32 of the GDPR:

• Encryption of data in transit (TLS 1.2 minimum) and at rest for sensitive data
• Role-based access control (RBAC) and the principle of least privilege
• Strong authentication for access to internal systems
• Logging of access and critical operations
• Regular penetration testing and periodic security reviews
• Business continuity and disaster recovery plan
• Regular staff training on data security

In the event of a personal data breach likely to result in a high risk, Sogelink will notify you as soon as possible, in accordance with Article 34 of the GDPR.

The services offered by Sogelink are intended exclusively for professionals and businesses. Sogelink does not knowingly collect data concerning minors under the age of 15. Should such data be collected in error, it will be deleted immediately. Any such instance can be reported to dpo@sogelink.com.

Sogelink reserves the right to amend this policy at any time, in particular to comply with regulatory developments. In the event of a substantial change, a notification will be sent by email or displayed on the site at least 30 days before the changes take effect. The date of the last update appears at the top of this document.

Sogelink has appointed a Data Protection Officer (DPO) in accordance with Article 37 of the GDPR.

📬 Data Protection Officer — Sogelink Group

Email: dpo@sogelink.com

Post: Sogelink SAS — DPO, [Full address — to be completed]

Phone: 09 70 70 03 03 (ask for the DPO)