Personal data

Privacy policy

SASETY privacy policy · November 2024 (English translation; the French version prevails)

Introduction

This Privacy Policy describes SASETY's practices regarding the information collected from users or clients:
- who access our website at www.sasety.com (the “Site”)
- who subscribe to our services
- who share personal information with us
(together: the “Users”).

We encourage our Users to read this Privacy Policy carefully and to use it to make informed decisions.

How do we receive information about you?

Your Personal Information is collected in several ways:
• When you voluntarily provide your personal data by registering on our Site;
• When you use or access our Site in connection with your use of our services;
• From third‑party providers, services and public registers (for example: traffic analytics providers).
• When you subscribe to services

We do not rent, sell or share Users' information with third parties.

What information do we collect?

We collect two types of data and information about our Users.

The first type is non‑identifying information relating to one or more Users, which may be made available to us or collected through their use of the Site (“Non‑personal Information”). We do not know the identity of the Users from whom this non‑personal information has been collected. The non‑personal information collected may include your aggregated usage information and technical information transmitted by your device, including certain information about software and hardware (e.g. the type of browser and operating system your device uses, language settings, access time, etc.) in order to improve the functionality of our Site. We may also collect information about your activity on the Site (e.g. pages viewed, online browsing, clicks, actions, etc.).

The second type is Personal Information, i.e. individually identifying information that identifies an individual or may, by reasonable means, allow an individual to be identified.

    For what purposes do we process your data?

    In line with the data minimisation principle, we only collect the Personal Data necessary for the purposes for which it is processed.

    Processing of your personal data is necessary in the following cases:
    - When you browse our site. In this case you agree to the collection, storage, use, disclosure and other uses of your Personal Data as set out in this Privacy Policy.
    - When you request information about our offers
    - To perform our contractual obligations towards you if you subscribe to Services and to provide our Services, protect our legitimate interests and comply with the regulatory obligations (legal and financial) to which we are subject.
    - When we process your job application
    - When you contact us for support (by phone, email, extranet or collaboration tools) directly or through our suppliers' platforms
    - When you use our suppliers' technologies
    - When you create an account, log in and/or purchase our services
    - When you create administrators for your use of the subscribed Services
    - When your administrator user creates Users for your use of the subscribed Services and technologies
    - When you attend a marketing event and/or we exchange business cards and you provide us with your Personal Data
    - When we acquire your Personal Data from third‑party sources
    - When we use the Personal Data of our resellers, distributors, agents and/or intermediaries

    The processing of Personal Data carried out by SASETY serves several purposes and may be carried out by SASETY as Data Controller or as Processor.

      Data processing carried out by SASETY as Data Controller

      We are the data controller when we determine the purposes and means of processing.
      This is the case for the following processing:
      Purposes Legal basis Category of personal data
      Responding to a request for information made by email or on the website Legitimate interest Full name, address, email, job title, company name, phone number, country and state, message, any other information you choose to provide
      Provision of an Internet access service Performance of the contract Public IP
      Routing and securing exchanges between sites and Users through our SASE technology delivered by our supplier Cato Networks Performance of the contract IP address, browsing data, connection data (logs), traffic data
      Management of contracts, orders, complaints Legitimate interest Details of the purchase, subscription, service subscribed, address, surname, first name, correspondence with the client, exchanges and comments from clients and prospects, person(s) in charge of the client relationship…
      Invoicing Legal obligation Payment methods, billing data, invoice payment terms
      Business prospecting and promotion of services Legitimate interest or consent Full name, address, email, job title, company name, phone number, country and state, message, any other information you choose to provide
      Satisfaction surveys to improve our Services and technologies Legitimate interest or consent Full name, address, email, job title, company name, phone number, country and state, message, any other information you choose to provide
      Responding to legal requisitions Legal obligation Any data requested as part of the requisition
      Management of unpaid invoices and debt collection, litigation management Legitimate interest Financial data
      Logging and control of access to services Legal obligation Connection logs
      Processing a job application Performance of the employment contract Surname, first name, date and place of birth, postal address, gender, photo, email address, phone number, information contained in a CV
      Marketing, analytics, market research, to improve our website Consent and legitimate interest Cookies and other trackers placed on our website and applications: geolocation data, IP address and other information about your activity on the Site

      Data processing carried out by SASETY as Processor

      Some processing carried out by SASETY is performed on behalf of our Clients and according to their instructions. We then act as their processor.
      This concerns the following processing:
      Purposes Legal basis Category of personal data
      Monitoring, incident management, problem management and change management associated with our SASE technology delivered by our supplier Cato Networks Performance of the contract IP address, browsing data, connection data (logs), traffic data
      At the Client's request, support and analysis of the results of tests performed by our security validation technology delivered by our supplier Pentera Performance of the contract and at the client's request IP address, traffic data, login, password
      At the Client's request, support and analysis of authentication results produced by our identity protection technology delivered by our supplier Silverfort Performance of the contract IP address, connection data (logs), login, password hash, email address, surname, first name
      At the Client's request, production and communication of activity and performance reports Performance of the contract IP address, browsing data, connection data (logs), traffic data
      Management of specific Client requests to implement data processing Performance of the contract Surname, first name, email address

      Who receives your data?

      We share Personal Data:
      - with our Processors or suppliers whom we use to perform the Services
      - the companies in charge of checking and storing your supporting documents, contractual
      documents and your electronic signature;
      - To the extent necessary, we may share your personal data on a “need to know” basis as part of an obligation towards legal counsel, data protection advisers and/or accountants.
      - Where necessary, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and with requests from law enforcement, regulatory bodies and other government bodies or, where required by a court order.

      Users' rights

      When SASETY acts as Data Controller, you may at any time ask us for:
      - access to the Personal Data concerning you and to receive a copy of the personal information you have voluntarily provided to us in a structured, commonly used and machine‑readable format (right to data portability)
      - the rectification of the personal information we store about you.
      - the deletion of your personal information (insofar as this does not prevent the proper performance of our contractual relationship or SASETY's compliance with its legal obligations)
      - to refuse the processing of your personal information.
      - the restriction of one or more processing operations on your personal information.

      You also have the right to object to the processing of your Personal Data under the conditions set by the Regulation and the right to lodge a complaint with a supervisory authority.

      Please note, however, that these rights are not absolute and may be subject to our own legitimate interests and regulatory requirements.

      If you wish to exercise any of the above rights or receive more information, please contact our data protection officer:
      • Gaëlle Tilloy
      • g.tilloy@cta-avocats.fr

      Our DPO may ask you for information to confirm your identity in case of doubt. The DPO will respond as soon as possible and in any event within the time limits required by the Regulation from receipt of the request. If necessary, this period may be extended, taking into account the complexity of your request and/or the number of requests. Where applicable, the DPO will inform you of this extension and the reasons for the delay.

      If, after contacting us, you consider that your request has not been satisfied, you may lodge a complaint with the French data protection authority (Commission Nationale de l'Informatique et des Libertés, CNIL) or bring legal proceedings.

      Data retention

      When SASETY acts as Data Controller, we keep Personal Data only for as long as necessary to achieve the purposes for which we collected it and to comply with applicable legal and regulatory requirements.
      When SASETY acts as Processor, we keep Personal Data for the duration of the Contract unless otherwise required by law.

      Collection of information by third parties

      Our policy only concerns the use and disclosure of information we collect from you. Insofar as you disclose your information to other parties or sites on the Internet, different rules may apply to its use or disclosure. We therefore encourage you to read the terms of use and privacy policy of each third party to whom you voluntarily disclose your information.

      Our website may include links to third‑party websites or applications. Clicking on these links or enabling these connections may allow third parties to collect or share Personal Data about you. We do not control these third‑party websites and are not responsible for their privacy policies. We invite you to read the personal data protection policy of the other websites you visit.

      This Privacy Policy does not apply to the practices of companies we do not own or control, or to individuals we do not employ or manage, including any third party to whom we may disclose your information as indicated in this Privacy Policy.

      How do we protect your information?

      We have put in place appropriate technical, organisational and security measures designed to protect your Personal Data. However, please note that we cannot guarantee that information will not be compromised as a result of unauthorised penetration of our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and on the security you use to protect your credentials and passwords, please make sure you take appropriate measures to protect this information.

      Transfer of data outside the EEA

      Please note that some data recipients may be located outside the European Economic Area (EEA). In such cases, we will transfer your data to those countries only as approved by the European Commission as providing an adequate level of data protection, or we will put in place legal agreements guaranteeing an adequate level of data protection.

      Corporate transactions

      We may share information in the event of a business transaction (e.g. the sale of a substantial part of our business, a merger, consolidation or sale of assets). In the cases mentioned above, the beneficiary or acquiring company will assume the rights and obligations described in this Privacy Policy.

      Minors

      We understand the importance of protecting children's personal information, especially in an online environment. The Site has not been designed for use by children. Under no circumstances do we allow the use of our services by minors without the prior consent or authorisation of a parent or legal guardian. We do not knowingly collect Personal Information from minors. If a parent becomes aware that their child has provided us with Personal Information without their consent (or if a guardian becomes aware that the child in their care has provided us with personal information without their consent), they should contact us at the DPO's address.

      Updates or changes to this Privacy Policy

      We regularly review our privacy policy. The latest update of this document is the one shown at the top of this page.

      Contact us

      If you have general questions about the Site or our collection and use of information about you, please contact us at: privacy@sasety.com