Protecting your personal data is a priority for OflowD. This Privacy Policy describes how data is collected, processed and protected in connection with the use of our platform.
Article 1 — Data controller
The controller of personal data is:
- OflowD — Nicolas LECLERC (sole trader)
- SIREN: 528 457 021
- Registered office: 36 rue Professeur Moreau, 33200 Bordeaux, France
- Email: contact@oflowd.fr
Article 2 — Data collected
OflowD collects and processes only the data necessary for the provision, improvement and security of its services.
2.1 Account data
Identification information (last name, first name, business email), information relating to the client organisation, login credentials.
2.2 Usage data
Platform settings and preferences, interactions with the features of the Service, performance data and indicators generated by the Service.
2.3 Sales performance data
In the course of performing the Service, OflowD collects interaction and performance data relating to the commercial activities carried out through the Platform. This data is used to measure the effectiveness of actions and to feed the performance indicators (KPIs) available to the Customer.
2.4 Payment data
Data relating to subscription payments (card number, bank details) is collected and processed exclusively by OflowD's payment services provider, acting as an independent controller for the processing related to fraud prevention and compliance with its own regulatory obligations. OflowD neither collects nor stores any bank card data.
2.5 Technical data
Logs and connection information, IP address, timestamps, technical metadata necessary for the security of the Service.
OflowD does not deliberately collect sensitive data within the meaning of the GDPR.
Article 3 — Purposes of processing
Data is processed for the following purposes:
- Providing the contractual Service and ensuring its proper functioning
- Generating the performance indicators and analyses available to the Customer
- Managing the customer relationship (support, account follow-up)
- Improving the platform, its performance and its usability
- Ensuring account security and preventing fraudulent use
- Handling objections to outreach (article 21 of the GDPR)
- Complying with applicable legal and regulatory obligations
Waiting list management. When you enter your email address in the early access form on the oflowd.fr website, it is collected for the sole purpose of informing you of the opening of the Service. The legal basis for this processing is your consent (article 6(1)(a) of the GDPR), obtained through the voluntary entry of your address. This data is retained for three years from the last active contact, then deleted. You may request its deletion at any time at contact@oflowd.fr.
Article 4 — Legal bases
The processing carried out by OflowD is based, depending on the case, on:
- Performance of the contract between OflowD and its customers
- Compliance with legal or regulatory obligations
- OflowD's legitimate interest in improving its services, ensuring their security and developing its business
Article 5 — Processors
To guarantee the quality, security and availability of the Service, OflowD uses technology providers that comply with market standards and data protection requirements.
These providers act as processors within the meaning of the GDPR and process data only on OflowD's instructions and solely for the purposes described in this policy. OflowD takes care to select partners offering sufficient guarantees in terms of security, confidentiality and regulatory compliance.
The list of processors is available on request at contact@oflowd.fr.
Article 6 — Data security
OflowD implements appropriate technical and organisational measures to protect data against destruction, loss, alteration, disclosure or unauthorised access. These measures include in particular:
- Secure authentication mechanisms and access control
- Encrypted communication protocols (HTTPS/TLS)
- Data isolation per customer
- Internal procedures restricting access to authorised personnel
- Monitoring and detection of abnormal behaviour
In the event of a confirmed security incident affecting personal data, OflowD undertakes to react diligently and to notify the persons concerned in accordance with its legal obligations.
Article 7 — Retention periods
Data is retained for the period necessary for the purposes for which it is processed:
- Account data: duration of the contractual relationship + 3 years (civil limitation period)
- Billing data: 10 years (accounting obligations)
- Performance data: duration of the contractual relationship
- Technical data: 12 months
- Outreach objection data: for as long as necessary to honour the objection
Beyond these periods, data is deleted or anonymised.
Article 8 — Rights of data subjects
In accordance with the GDPR, every data subject has the following rights:
- Right of access to their personal data
- Right to rectification of inaccurate or incomplete data
- Right to erasure in the cases provided for by law
- Right to restriction of processing
- Right to object, in particular to commercial outreach (article 21 of the GDPR)
- Right to data portability, where applicable
These rights may be exercised by sending a request to: contact@oflowd.fr. OflowD may request additional information in order to verify the identity of the applicant. A response will be provided within one month.
Article 9 — Complaints
If you consider that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.
Article 10 — Transfers outside the European Union
Where technology providers located outside the European Union are used, data transfers may occur. OflowD ensures that such transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission or by any other adequate protection mechanism provided for by the regulations.
Article 11 — Cookies and similar technologies
The Site and the Platform use cookies and similar technologies:
- Essential cookies: necessary for the operation of the Service (authentication, session, preferences). These cookies cannot be disabled.
- Visitor identifier (oflowd_vid): an anonymous UUID identifier, stored in a first-party cookie lasting 12 months, used to improve the Service. This cookie contains no identifying personal data.
Cookies and audience measurement. The oflowd.fr website sets a technical anonymous audience measurement cookie (oflowd_vid, twelve months) which does not allow you to be identified and falls under the exemption provided for by the CNIL. With your consent, a second cookie (oflowd_uid, thirteen months) makes it possible to link your visit to the campaigns you have received. You may accept or decline this second cookie at any time via the banner displayed on your first visit, and change your choice by clearing your browser's cookies.
You can configure your preferences through your browser settings. Declining essential cookies may affect the operation of the Service.
Article 12 — Changes to this policy
This policy may change to reflect developments in the Service and legislative changes. Any significant update will be notified to users. Use of the Service after such an update constitutes acceptance of the new version.