Privacy Policy & Data Protection

1. WHO WE ARE

This policy is published by Aliston SARL, with share capital of €7,500, registered with the Versailles Trade and Companies Register (RCS) under number 511 850 471, with its registered office at 7 rue Christophe Plantin, 78540 Vernouillet, France (hereinafter "Aliston" or "we").

Aliston publishes the Cirrus Shield SaaS platform as well as the following websites (hereinafter the "Sites"):

https://www.cirrus-shield.fr
https://www.cirrus-shield.com
https://help.cirrus-shield.com
https://www.cirrus-shield.net (application platform)

Data protection contact: Aliston has appointed a data protection contact who can be reached at contact@cirrus-shield.com or by mail at the registered office address, for the attention of the "Personal Data Officer."

2. SCOPE — AN IMPORTANT NOTE

This policy describes the processing activities for which Aliston acts as data controller within the meaning of Regulation (EU) 2016/679 ("GDPR") and French Act No. 78-17 of 6 January 1978, as amended (the "French Data Protection Act"), namely:

data of visitors to our Sites;
data of prospects (requests for demonstrations, free trials, content downloads, event or newsletter sign-ups);
data of our customers' contacts and users, to the extent necessary for managing the contractual relationship, billing and support;
data of job applicants.

Data processed within Cirrus Shield on behalf of our customers

When a customer uses the Cirrus Shield platform to store and process personal data (contacts, prospects, patients, members, etc.), the customer is solely the data controller for that data. Aliston acts exclusively as a data processor within the meaning of Article 28 of the GDPR, in accordance with the customer's documented instructions.

Such processing is governed exclusively by the services agreement and the Data Processing Agreement (DPA) entered into with each customer, and not by this policy. Individuals whose data appears in a customer's Cirrus Shield environment must exercise their rights directly with that customer. Aliston will forward to the relevant customer any request it receives in error, without responding to it on the merits.

3. WHAT DATA DO WE COLLECT?

Category	Examples	Source
Identification and contact details	Name, first name, company, job title, email, phone number	You
Contractual and billing data	Billing details, order history, subscription plan	You / performance of the contract
Account data	Username, login logs, preferences	You / automatically generated
Support data	Content of support requests, call recordings where applicable	You
Browsing data	IP address, browser type, pages viewed, cookies and trackers (see Section 10)	Automatically generated, subject to your consent for non-essential trackers
Application data	CV, cover letter	You

We do not collect any so-called "sensitive" data (health, opinions, etc.) via our Sites, and we ask that you do not send us any such data through these channels. Mandatory fields are indicated on our forms; if they are not completed, the corresponding request cannot be processed.

Note —We do not sell or rent your personal data to third parties.

4. WHY, AND ON WHAT LEGAL BASIS?

Purpose	Legal basis (Art. 6 GDPR)	Retention period
Providing the services, managing accounts, performing contracts	Performance of the contract	Duration of the contract, then intermediate archiving for 5 years (statute of limitations)
Billing and accounting/tax obligations	Legal obligation	10 years (Art. L.123-22 of the French Commercial Code)
Responding to requests for information, demos or trials	Pre-contractual measures / legitimate interest	3 years after the last contact
Marketing communications (see Section 8)	Legitimate interest (B2B) or consent	3 years after the last contact or withdrawal of consent
Newsletters and content	Consent	Until unsubscribed
Improving the Sites and services, statistics	Legitimate interest or consent (trackers)	See Section 10
Recording customer service calls (quality, training, dispute prevention)	Legitimate interest — prior notice given and option to object at the start of the call	6 months maximum
Security of the Sites and platform, technical logs	Legitimate interest / legal obligation	6 to 12 months
Managing job applications	Pre-contractual measures	2 years after the last contact, unless agreed otherwise
Handling requests to exercise rights, pre-litigation and litigation	Legal obligation / legitimate interest	Applicable statutory limitation periods

Once these periods have elapsed, the data is deleted or irreversibly anonymized.

5. WHO HAS ACCESS TO YOUR DATA?

Your data is accessible, strictly within the limits of their duties and on a need-to-know basis, to:

Aliston's authorized staff (sales, support, technical and administrative teams), who are bound by confidentiality obligations;
our processors involved in hosting, maintenance, emailing, audience analysis, billing and support, who are bound by contractual commitments in accordance with Article 28 of the GDPR;
where applicable, our advisors (lawyers, accountants, auditors) and the relevant authorities, where required by a legal obligation or court order.

Hosting: Cirrus Shield platform data is hosted in France, in data centers operated by OVH SAS (OVHcloud). The list of our main processors is available on request at contact@cirrus-shield.com.

6. DOES YOUR DATA LEAVE THE EUROPEAN UNION?

We favor providers established in the European Union. Where a transfer to a third country is necessary (for example, to a provider established in the United States), it is systematically governed by one of the mechanisms set out in Articles 45 to 49 of the GDPR:

an adequacy decision issued by the European Commission — in particular the EU–US Data Privacy Framework, for certified US organizations; and/or
the Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where necessary by additional safeguards identified through a transfer impact assessment.

Should a mechanism be invalidated or suspended, Aliston will switch to the applicable alternative mechanism. You can obtain information about these safeguards by writing to contact@cirrus-shield.com.

7. HOW DO WE PROTECT YOUR DATA?

Aliston implements technical and organizational measures appropriate to the risks involved: encryption of data in transit (TLS), access control and authentication, environment segregation, logging, backups, staff awareness training, and contractual oversight of processors.

In the event of a data breach likely to result in a risk to your rights and freedoms, Aliston will carry out the notifications required under Articles 33 and 34 of the GDPR to the CNIL and, where applicable, to the individuals concerned.

As no system is entirely foolproof, these measures constitute a best-efforts obligation.

8. MARKETING COMMUNICATIONS

In accordance with Article L.34-5 of the French Postal and Electronic Communications Code:

Business contacts (B2B): you may receive marketing emails related to your professional activity without prior consent, with the right to object at any time, free of charge and easily, via the unsubscribe link included in every message, or on request at contact@cirrus-shield.com.
Individuals (B2C): electronic marketing communications are only sent with your prior consent, which may be withdrawn at any time.

Objecting to marketing communications does not affect communications necessary for the performance of the contract (service notices, security, billing).

9. WHAT ARE YOUR RIGHTS?

Subject to the conditions and limits set out by applicable law, you have the following rights:

access to your data (Art. 15 GDPR);
rectification (Art. 16);
erasure (Art. 17);
restriction of processing (Art. 18);
data portability (Art. 20);
objection, in particular to marketing communications (Art. 21);
withdrawal of your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
instructions regarding the fate of your data after your death (Art. 85 of the French Data Protection Act).

You may exercise these rights by email at the address below, or by mail at our registered office address:

contact@cirrus-shield.com

We will respond within one month, which may be extended by two months for complex requests. Where we have reasonable doubts about your identity, we may ask you for proof of identity.

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the CNIL (www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

Reminder —for data processed within a customer's Cirrus Shield environment, please direct your request straight to that customer, who acts as the data controller (see Section 2).

10. COOKIES AND OTHER TRACKERS

On your first visit to our Sites, a banner lets you accept, refuse, or configure the placement of non-essential trackers, purpose by purpose. No tracker requiring consent is placed before you make your choice. Refusing is just as easy as accepting.

We use the following categories:

Trackers strictly necessary for the Sites to function
Session, security, and remembering your consent choice: exempt from consent.
Audience measurement and performance trackers
Subject to consent, unless exempted under conditions set by the CNIL.
Personalization trackers
Language, preferences. Subject to consent.
Marketing and ad-targeting trackers
Subject to consent.

Retention periods: trackers are kept for a maximum of 13 months; information collected via audience measurement trackers for a maximum of 25 months; your choice (consent or refusal) is kept for 6 months before you are asked again.

You can change or withdraw your choice at any time via the "Manage cookie consent" link available at the bottom of every page of the Sites.

11. LINKS TO THIRD-PARTY SITES

Our Sites may contain links to third-party sites (for example, YouTube or LinkedIn). Aliston has no control over these sites and disclaims all responsibility for their personal data practices. We encourage you to review their own privacy policies.

12. CUSTOMER TESTIMONIALS

Testimonials published on our Sites (name, job title, company) are published with the prior consent of the individuals concerned, who may withdraw it at any time by writing to contact@cirrus-shield.com.

13. MINORS

Our Sites and services are intended exclusively for professionals and adults. We do not knowingly collect data relating to minors under the age of 15. If you believe a minor has provided us with data, please contact us so that it can be deleted.

14. USERS LOCATED OUTSIDE THE EUROPEAN UNION

If you access our Sites from a country with its own data protection laws (including the United Kingdom, Switzerland, or certain US states), you may be entitled to rights similar to those described in Section 9, which you can exercise using the same contact details. We do not sell your personal data and do not share it for cross-context targeted advertising purposes within the meaning of applicable US laws.

15. CHANGES TO THIS POLICY

Aliston may amend this policy at any time, in particular to reflect legal, regulatory, case-law, or technical developments. The version in effect is the one published on this page, along with its update date. In the event of a material change affecting your rights, you may be notified specifically by an appropriate means.

Personal Data Protection Policy