Personal data
Privacy policy
This document explains what data GreenScale processes when you visit the pilotscale.fr site or use the PilotScale application, why, for how long, who has access to it, and how to exercise your rights. It is written pursuant to Regulation (EU) 2016/679 (GDPR) and to French Act no. 78-17 of 6 January 1978 as amended.
Courtesy translation. Only the French version of this document is legally binding. In the event of any discrepancy, the French version prevails.
1. Who processes what
Two roles overlap, and the distinction governs everything else:
- GreenScale is the controller for data relating to the site, to user accounts, to invoicing and to support. GreenScale decides the purposes and the means, and it is against GreenScale that those rights are exercised.
- GreenScale is a processor for the data you submit to the application: indicators, imported documents, campaign answers, contributor contact details. The client organisation remains the controller of that data: GreenScale processes it only on the organisation's instructions, under the conditions of article 16 of the terms and conditions, which serve as the processing agreement within the meaning of article 28 of the GDPR.
In practice: if you are an employee of a client organisation and you want to know what PilotScale holds about you, address that organisation first. If your request concerns your account itself, write to us directly.
Full identity of the controller: GreenScale, SASU with share capital of €1,000, 39 rue de la Gare de Reuilly, 75012 Paris, Paris Trade and Companies Register 844 409 185 (see the legal notice). GreenScale is not required to appoint a data protection officer; requests are handled by Océane Puech, reachable at oceane@greenscale.fr.
2. Data processed
2.1 On the marketing site
The site has no form, no account and no analytics. The only data processed is the technical data needed to display the pages: IP address, date and time of the request, page requested, browser type, recorded in the server logs. To this is added the light or dark theme you choose, kept in your browser and never transmitted (see article 11).
2.2 When an account is created
The form is served by the application. The following are collected: first and last name, work email address, password (kept as a hash, never in clear text), organisation name and the profile chosen (company or consultant). The account is only created when the verification link sent to that address is opened.
2.3 During use
- Account and usage data: role and permissions, login dates, actions recorded in the change history (who validated which import, changed which value, shared which dashboard).
- Second authentication factor, if you switch it on: encrypted TOTP secret, hashes of the backup codes, devices marked as trusted.
- Data submitted to the application: imported files, indicator values, targets, action plans, issues, dashboards, answers to collection campaigns. This falls under the processor role described in article 1.
- Exchanges with the assistant: questions asked of Pousse and the answers produced, together with their sources.
2.4 Invoicing and support
The organisation's billing details, the tier subscribed to, the billing period, the history of invoices and payments, and where applicable the direct debit mandate and its unique mandate reference. Card data passes neither through the site nor through our servers: it is entered on a page hosted by Stripe. Exchanges with support and their attachments are kept under the conditions of article 4.
A request sent to support from the application comes with the screen it was sent from, the page address, the reading language and the declared browser, so that we do not have to ask you for them; this context is shown back to you in the request's thread.
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Visiting the site | Display the pages, safeguard the security and availability of the server | Legitimate interest (art. 6.1.f) |
| Account creation and management | Open the account, verify the address, authenticate, manage roles | Performance of the contract (art. 6.1.b) |
| Provision of the application | Import, structure, present and share the organisation's data | Performance of the contract (art. 6.1.b) |
| Second factor | Protect access to accounts | Legitimate interest, and security obligation (art. 32) |
| Invoicing and collection | Issue invoices, take payment, chase unpaid amounts | Performance of the contract, and accounting obligation |
| Support and assistance | Answer requests, diagnose an incident | Performance of the contract (art. 6.1.b) |
| Transactional messages | Address verification, password reset, trial expiry, direct debit pre-notification, incident notice | Performance of the contract, and legal obligation |
| Technical logs and history | Detect abuse, reconstruct an incident, prove who validated what | Legitimate interest (art. 6.1.f) |
| Service improvement | Measure usage in aggregate, without individual profiling | Legitimate interest (art. 6.1.f) |
No data is processed for advertising, third-party marketing, resale, profiling or automated decision-making producing legal effects within the meaning of article 22 of the GDPR. The AI's proposals are not decisions: every one of them waits for human validation.
4. Retention periods
| Data | Period | Starting point |
|---|---|---|
| Account and organisation data | Term of the contract | Then read-only for 30 days, erased at the latest 90 days after the end of the contract |
| Unconverted trial account | 2 years | From the end of the trial (one month read-only), unless deletion is explicitly requested; prior notice before erasure |
| Encrypted backups | 30 days | Rolling rotation: erased data disappears from backups within 30 days |
| Invoices and accounting records | 10 years | Close of the financial year (article L. 123-22 of the French Commercial Code) |
| Direct debit mandate | 13 months after the last instalment | Period for contesting an authorised direct debit |
| Connection logs | 12 months | Date of the event |
| Technical application logs | 6 months | Date of the event |
| Change history | Term of the contract | Deleted with the organisation's data |
| Exchanges with support | 3 years | Last exchange |
| Requests to exercise rights | 3 years | Handling of the request, as evidence |
A client organisation may ask for erasure before these deadlines, subject to the data GreenScale must keep to meet a legal obligation (invoices, essentially). Beyond their period of usefulness, data is deleted or irreversibly anonymised.
5. Recipients and processors
Your data is neither sold, nor rented, nor exchanged. It is accessible:
- to the people you authorise yourself within your organisation, according to the roles and permissions you give them;
- to the recipients of a read-only share that you decide to open (the link only gives access to the shared dashboard);
- to authorised GreenScale staff, strictly for operating the service and providing support, under a confidentiality undertaking;
- to the processors listed below, bound by contract within the meaning of article 28 of the GDPR;
- to the authorities, upon a duly made request.
| Processor | Role | Location |
|---|---|---|
| OVH SAS 2 rue Kellermann, 59100 Roubaix |
Hosting of the site, the application, the databases and the backups, and delivery of transactional messages (SMTP service) | France |
Three external services receive, at your initiative and without any personal data, information about your organisation: the Base Adresse Nationale (api-adresse.data.gouv.fr, a French public service) and, outside France, Geoapify GmbH (Germany) receive the postal address of a site to find its geographic coordinates; recherche-entreprises.api.gouv.fr (a French public service) receives the organisation's SIREN or company name to complete its record. None of these calls carries personal data, and none takes place outside the European Union.
Two payment institutions are involved at subscription, and neither is a processor: each acts as an independent controller for the data it processes in that capacity, in performance of its own regulatory obligations. Their privacy policies then apply, and no processing agreement within the meaning of article 28 of the GDPR binds them to GreenScale.
- Qonto executes SEPA direct debits. It receives the Client's identity, its bank details, the amount and the reference of the instalment.
- Stripe (Stripe Payments Europe, Limited, Ireland) handles card payments on Starter and PME. Card data is entered on its page and never reaches us: we receive only the outcome of the transaction and the last four digits. Stripe may transfer certain data to the United States, under an appropriate transfer mechanism; see article 6.
The artificial intelligence model does not appear in this table: it is not subcontracted. See article 7.
6. Location and transfers outside the European Union
All of the application's data (databases, imported files, backups) is hosted in France. The processing described above takes place within the European Union.
GreenScale carries out no transfer outside the European Union of the data you submit to the application: indicators, imported documents, campaign answers, exchanges with the assistant. Should a processor in future operate from a third country, the transfer would be governed by an adequacy decision or by the European Commission's standard contractual clauses, and this policy would be updated before the change took effect.
One exception, which concerns payment only. Card payment on the Starter and PME tiers goes through Stripe, whose contracting entity is established in Ireland and whose group operates from the United States: transaction data may be transferred there, under the transfer mechanism Stripe relies on (adequacy decision or standard contractual clauses). That transfer concerns payment data, never your organisation's business data. SEPA direct debit, the only means accepted from the ETI naissante tier upwards, involves no such transfer.
For the sake of accuracy: the typefaces of the marketing site were until now called from the Google Fonts service, which passed the visitor's IP address to its publisher. That call has been removed: the fonts are now served from our own server, and the presentation site no longer calls on any third-party domain.
7. Artificial intelligence and your data
The model runs on our own servers, in France. No client data is sent to a third-party AI provider, so the question of transfer outside the European Union does not arise for this processing.
Your data is not used to train any model. Neither ours, nor a third party's. It is not pooled between organisations, nor used to produce identifiable personal or sector statistics.
Nothing is saved without your validation. Every AI proposal (column mapping at import, extraction from a PDF, dashboard layout, generation of issues) waits for your explicit agreement. The processing is therefore never fully automated within the meaning of article 22 of the GDPR.
The assistant answers from two sources only: the KitScale methodology knowledge base, which contains no client data, and your own organisation's validated data. It states its sources and does not invent an answer in their absence. The answers produced remain indicative and do not bind GreenScale: responsibility for the data published remains the client's.
8. Security
The technical and organisational measures in place:
- Encrypted exchanges over HTTPS, on the site as on the application.
- Partitioning by organisation: no data belonging to one organisation is accessible from another, including in aggregate or anonymised form. The consultant portal is a strictly personal view.
- Authentication by named account, passwords kept as hashes, and a TOTP second factor available on every account, which the organisation may make compulsory.
- Roles and permissions defined by the organisation's administrator, as close as possible to the need to know.
- Change history: every validation and every share is traced, with its author and its date.
- Encrypted backups, whose key is kept away from the server it protects.
- Restricted operational access for authorised staff, and logged.
No system is invulnerable: GreenScale undertakes to apply measures appropriate to the risk, within the meaning of article 32 of the GDPR, not to guarantee absolute security. If you find a vulnerability, report it to the address in article 14: a good-faith report will not be prosecuted.
9. Contributors and third parties
A collection campaign means asking people: site managers, subsidiary contacts, sometimes suppliers. By entering them into PilotScale, you remain the controller in their regard: it is for you to inform them of the use made of their contact details and their answers, and to have a legal basis for approaching them.
GreenScale uses those contact details only to deliver the request and the reminders: never for its own marketing. A contributor who writes directly to GreenScale is directed to the organisation behind the campaign, and that organisation is informed.
The same rule applies to personal data that might appear in an imported file: check that it is necessary before submitting it. A social indicator is almost always steered on aggregate headcounts, with no names.
10. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability in respect of your data, as well as the right to set directives on its fate after your death.
Where to exercise them. For data relating to your account, your invoicing or your exchanges with support, write to oceane@greenscale.fr. For data submitted to the application by a client organisation, address that organisation: GreenScale has no standing to decide alone, and will pass the request on.
Timescale. You will receive a reply within one month of the request being received, extendable by two months if it is complex, in which case you will be informed. Proof of identity is only requested where there is reasonable doubt as to the identity of the requester.
Exports. Independently of these rights, the application allows an organisation's data to be exported at any time in Excel and Word formats. Reversibility at the end of the contract is covered by article 14 of the terms and conditions.
12. Data breach
In the event of a personal data breach, GreenScale notifies the CNIL within 72 hours of becoming aware of the incident, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.
Where the breach is likely to result in a high risk, the individuals concerned are informed as soon as possible. Where GreenScale acts as a processor, the client organisation is alerted without undue delay and receives what it needs to meet its own notification obligations.
13. Changes to this policy
This policy may be amended to follow a change in the service, in the regulations or in the list of processors. The version date appears at the head of the page.
Any substantial change (a new purpose, a new recipient, a longer retention period) is brought to clients' attention by email at least 30 days before it takes effect.
14. Contact and complaints
For any question about this policy or to exercise your rights: oceane@greenscale.fr, or by post to GreenScale, 39 rue de la Gare de Reuilly, 75012 Paris, France.
If the reply given does not satisfy you, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr.