Privacy policy

Who is responsible?

Controller for the website and the accounts of subscribing companies:

• ANY SOFTWARE, SAS au capital de 1 000 €
• Registered office: 2 impasse Clément Marot, 95820 Bruyères-sur-Oise, France
• Registration: RCS Pontoise 107 848 400 (SIRET 107 848 400 00019)
• VAT number: FR63107848400
• Contact: contact@diaspokolis.com

For the data each company enters about its own customers and recipients (names, phone numbers, addresses, parcels, invoices), that company is the controller; DiaspoKolis only acts as a processor on its behalf (see the terms of service, section 9). Data subjects should contact that company first.

What data, and why?

• Signup and accounts: company name, phone number, business, users' names and emails, password (stored only as a hash). To create and manage the subscription and access — performance of the contract.
• Payment: handled by Stripe; DiaspoKolis never sees the card number or the full IBAN, only the payment status. To collect the subscription — performance of the contract and accounting obligations.
• Use of the space: log of actions (who did what, when) visible to the company's administrator. For traceability and security — legitimate interest.
• Security: IP address and technical logs, to limit abusive sign-in and signup attempts and to investigate incidents — legitimate interest.
• Public tracking and invoices: a parcel's tracking page and an invoice link only show what the company recorded, to whoever holds the number or the link.

No data is sold or used for advertising.

Cookies

Only technical cookies are set: the sign-in session and the form security token. They are essential to the service and require no consent. No advertising or analytics cookies.

Service providers

• OVH SAS (France): hosting of the website and data, in the European Union.
• Cloudflare, Inc. (USA): traffic protection and delivery.
• Stripe (Ireland and USA): subscription payments.
• Google Fonts (Google, USA): typefaces, loaded by the browser.
• cdnjs (Cloudflare) and jsDelivr: QR code and PDF libraries, on invoice pages.

Transfers outside the European Union rely on the safeguards provided by the GDPR (EU-US Data Privacy Framework adequacy decision or standard contractual clauses).

Retention

• Data in a company's space: for the duration of the subscription, then three months after cancellation.
• Subscription invoices and accounting records: ten years, as required by law.
• Technical logs: twelve months at most.
• Signup request not followed up: one year.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, by writing to contact@diaspokolis.com. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or your local authority.