Privacy & GDPR

Personal Data Protection Policy

Preamble

This "Personal Data Protection Policy" document concerns any natural person (hereinafter "Natural Persons") whose Personal Data is processed by Formality, in accordance with the General Data Protection Regulation (GDPR) adopted on 27 April 2016 by the European Parliament and the Council.

When you visit our website and/or our platform, Formality (hereinafter "we") collects your Personal Data in order to use it in various automated processing operations.

I — The processing of your personal data

Definitions

Personal data (hereinafter "Personal Data") means any information that may relate to a natural person who is identified or identifiable, directly or indirectly.

DPO: The Data Protection Officer (DPO) is responsible for ensuring compliance with the European data protection regulation within the organization that appointed them, for all processing operations carried out by that organization.

You can contact our DPO at any time: dpo@datae-consulting.com

Data controller: The data controller is the legal or natural person who determines the purposes and means of a processing operation. In practice and in general, it is the legal entity embodied by its legal representative.

The data controller is: Formality.

Our commitments

We process your Personal Data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter referred to as the "GDPR".

We are committed to protecting your personal data. Only our authorized personnel, trained in confidentiality rules, take part in operating the website https://www.formality.com and the Formality platform https://app.eu1.formality.com/

In addition, Formality implements appropriate technical and organizational measures to prevent the loss, misuse, alteration and deletion of your Personal Data.

These measures are adapted according to the sensitivity level of the data processed and the level of risk presented by the processing or its implementation.

If a security breach affecting your data occurs, Formality will inform you within the timeframes and according to the procedures specified by the applicable legal and regulatory provisions.

Article 13 of said regulation requires us to inform you of the following:

  • ◆The identity and contact details of the data controller and, where applicable, of the controller’s representative;
  • ◆The purposes of the processing for which the Personal Data is intended, as well as the legal basis for the processing;
  • ◆The recipients or categories of recipients of the Personal Data, if any;
  • ◆The retention period of the Personal Data or, where that is not possible, the criteria used to determine that period;

II — The personal data we process

We collect and process the following Personal Data:

Personal Data collected Purpose Legal basis Retention period
Data collected through the recruitment form
  • Last name
  • First name
  • Email
  • LinkedIn account
 Recruitment management Legitimate interest 2 years
Data collected through the demo booking form
  • Last name
  • First name
  • Title
  • Email address
  • Company name
 Management of demo bookings Legitimate interest 3 years
Data collected for sales prospecting and marketing communication
  • Email address
 Prospecting and communication management Consent 3 years after our last exchange
Data collected to ensure the operation and continuity of our services
  • Last name
  • First name
  • Email address
  • Contact details
 Support management Contract performance Data is kept for the duration of the contractual relationship, then 5 years after the end of that relationship
Data recorded when you browse our site
  • IP address
 Management of visitors’ browsing information Legitimate interest 3 years
Data recorded when using the platform
  • Last name
  • First name
  • Email address
  • Contracts and documents uploaded to the platform
 Platform data management Contract performance For the duration of the contractual relationship, then data kept for 1 month after the end of the contractual relationship
Data recorded during sales calls
  • Last name
  • First name
  • Voice
  • Phone number
  • Email
 Analysis of call quality and sales practices Legitimate interest 6 months
Cookies
Axeptio Management of the collection and proof of cookie consent Legal obligation 13 months
Matomo Audience measurement, statistical traffic analysis Consent 13 months
Google Ads (Conversion Linker, Tag Google, etc.) Ad conversion tracking and performance measurement Consent 13 months
LinkedIn Insight Tag Conversion tracking, ad targeting on LinkedIn Consent 6 months
HubSpot Browsing tracking, visitor tracking, CRM integration Consent 13 months

III — The recipients of personal data

The Personal Data collected on the website https://www.formality.com and the platform https://app.eu1.formality.com/ is intended primarily for Formality; however, it may be shared with our partners.

In order to carry out site maintenance, cookie management, data hosting, or the provision of our services, some of your data may also be shared with our processors.

The list of our partners, providers and processors likely to process your personal data is available in the table below.

Partner / Provider / Processor Purpose
AWSHosting
NotionData storage
GoogleEmail, Drive, document storage
SlackCommunication of documents and information
SentryDebugging and error management
OpenAIData extraction from documents + Assistant answers within the platform
Mistral AIData extraction from documents + Assistant answers within the platform
Google GeminiData extraction from documents + Assistant answers within the platform
Google Maps APIAuto-completion — help formatting addresses within the platform

We ensure that all our partners and processors are subject to adequate, GDPR-compliant Personal Data protection mechanisms and that data will only be processed by authorized personnel bound by a confidentiality clause or any other equivalent contractual document.

IV — Exercising your GDPR rights

  1. Right of access and rectification of your data: You have the right to obtain confirmation from the data controller as to whether Personal Data concerning you is or is not being processed and, where it is, the right to access it and/or have it rectified. (See Articles 15 and 16 of the GDPR.)
  2. Right to erasure of your data. In accordance with Article 17 of the GDPR, you have the right to request the erasure, as soon as possible, of your Personal Data, on certain grounds / under certain conditions which you can consult in said article / in the cases provided for by the article.
  3. Right to restriction of data processing. You have the right to ask us to restrict the processing of your Personal Data in the cases provided for by Article 18 of the GDPR.
  4. Right to object to data processing. In accordance with Article 21 of the GDPR, you have the right to object to the processing of Personal Data concerning you where the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject requiring the protection of Personal Data prevail, in particular where the data subject is a child.
  5. Right to data portability. You have the right to portability of your Personal Data, which gives you the possibility to receive the Personal Data you have provided to us in a structured, commonly used and machine-readable format, as well as the possibility to transmit this data to another data controller. The exercise of this right is subject to the conditions provided for by Article 20 of the GDPR.
  6. Right to withdraw your consent. In accordance with Article 7 of the GDPR, where processing is based on consent, you have the right to withdraw your consent at any time. This will end the processing of your data.
  7. Right to define post-mortem directives. You have the possibility to define directives relating to the retention, erasure and communication of your Personal Data after your death, with a trusted, certified third party responsible for enforcing the deceased’s wishes in accordance with the requirements of the applicable legal framework (Article 85 of French Law No. 78-17 of 6 January 1978 on information technology, files and freedoms).

You can exercise your rights as follows: by sending your request to the following email address: dpo@datae-consulting.com or by post, accompanied by a copy of an identity document, addressed to Formality at the following address: 6 rue du Bois Sauvage, 91000 Evry-Courcouronnes, France. You may also lodge a complaint with the CNIL.

Updates

In order to comply with regulatory changes and to reflect our practices, we reserve the right to modify this policy.

We will publish changes in this document; we advise you to consult our privacy policy regularly.

Last updated: 18/06/2025