Privacy policy
This policy explains which personal data Robin Bonnin ("we") processes on its own behalf, as data controller, when you visit our website or subscribe to Pomelow. The content our customers and their members put into Pomelow (emails, messages, documents, files) is processed on the customer's behalf: see the data processing agreement.
Data controller
Robin Bonnin, 9 rue des champsaurins 05000 Gap. Contact: contact@pomelow.eu.
What we process, why, and on what basis
- Visiting the website: IP address, date, page requested and browser, in our servers' technical logs, to keep the website secure and working (legitimate interest). Kept for at most 12 months.
- Signup and customer account: name, work email, organization name, workspace address and, if given, domain; date and version of the terms accepted. To create and manage your organization (performance of the contract). Kept for the whole subscription, then deleted when the organization is closed, except the record of your acceptance of the terms.
- Billing: billing details, subscription history and invoices, handled with Stripe; we never see the card number. To bill the service (performance of the contract) and meet our accounting obligations (legal obligation): invoices are kept for 10 years.
- Contacting us: the emails you send us, to answer them (legitimate interest). Kept for 3 years after the last exchange.
- Service emails: we send the emails the service needs (address verification, invitations, closure reminders, invoices). No marketing without your consent.
Cookies
The public website sets only one preference cookie, lang, which remembers the language you picked for a year. The apps set the session cookies needed to stay signed in. We use no analytics, advertising or tracking tools, so no consent is required. The website's fonts and scripts are served from our own servers.
Recipients
Only the people who operate Pomelow have access to this data, and only for the purposes above. Our subprocessors are listed on the Subprocessors page. We never sell or rent any data.
Where data is processed
Data is hosted with Scaleway, in France (Paris region). Stripe may transfer payment data to Stripe, Inc. in the United States, under the European Commission's Standard Contractual Clauses.
Security
Encrypted connections (HTTPS/TLS) on all our addresses, single sign-on with two-factor authentication available, databases on a private network, daily database and nightly mail backups, administrative access restricted to the operator.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, which you can exercise by writing to contact@pomelow.eu. We answer within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
If you are a member of a customer organization, first send requests about your emails, messages and files to your organization's administrator; we help them answer.