Personal Data Protection Policy
Who are we and who is this policy for?
This Personal Data Protection Policy defines how our company, Ofelia (Bonitasoft) SAS, with capital of €170,871.25, located at 60 rue François 1er, 75008 Paris (France), registered with the Paris Trade and Companies Register (RCS) under number 512854514 (hereinafter, "We" or "Ofelia"), processes your personal data.
It applies to any user of our products, solutions, and websites (the "Solutions"), whether you have entered into a contract with us directly, use our Solutions as an employee of one of our clients, or as a member of one of our communities (hereinafter, "You" or the "Users").
In connection with the use of our Solutions, we may collect certain of your personal data, acting either as a controller or as a processor.
This Personal Data Protection Policy sets out our practices regarding the collection, processing, and retention of personal data, in accordance with the General Data Protection Regulation (GDPR) and any applicable regulations.
Why do we process your data?
Certain features of our Solutions require the processing of your personal data, including to create your user account, download free versions of our products, access certain sections, or enable us to provide you with support and tailored services.
When you use our Solutions, Ofelia may carry out the following processing activities, acting as controller within the meaning of Article 4 of the GDPR:
Processing necessary for the performance of a contract entered into between Ofelia and the User Management of client relationships;
- Management of support requests;
- PS Consulting (custom development on the Ofelia platform);
- Management of client improvement requests;
- Management of platform updates;
- Training of users on how to use the platform;
- Management and selection of partners;
- B2B invoicing.
The retention period for data used in connection with the processing activities above corresponds to the duration of the contract entered into between Ofelia and the User, unless otherwise required by specific legal provisions.
Management of the Ofelia community (formerly the Bonitasoft community), including the management of the creation or deletion of a community account.
Within the Ofelia community, we also collect the content of your exchanges in order to process your requests and improve our products and services.
The retention period for data used in connection with the processing activities above is three years after the last contact between the Community member and Ofelia.
Processing based on the User's consent
- Management of virtual and in-person events;
- Management of written client testimonials (for as long as the author of the testimonial remains a client);
- Management of contact requests;
- Management of the newsletter;
- Management of downloads.
Processing based on Ofelia's legitimate interest
Management and outreach to prospects.
The retention period for data used in connection with the processing activities above (consent and legitimate interest) is three years after the last contact between the User and Ofelia, unless consent is withdrawn or an objection request is made.
What data does Ofelia collect and process?
In connection with the processing activities carried out by Ofelia, we may process the following data:
- Your professional contact details (last name, first name, job title, email/phone/employer name/address);
- The exchanges we may have with you (in connection with a contact or support request, or in connection with the performance of the contract);
- Data relating to your User account (including your IP address and connection data);
Any questions or comments you send us or post on our community, as well as the responses we provide to them.
Processing carried out by Ofelia as a processor on behalf of its clients
Where the contract entered into with a User provides that Ofelia carries out the processing of personal data on the User's behalf, we act as a processor within the meaning of Article 4 of the GDPR.
The processing activities carried out as processor concern:
Management of User support requests (support);
- Provision of Bonita Cloud services;
- Management of security on behalf of the client.
In connection with the Ofelia Agentic offering, the following processing activities may also be provided as processor:
- Assignment of login permissions (identity management, User access, and account creation);
- Ingestion and indexing of the knowledge base (RAG);
- Hosting of the database;
- Hosting of data related to prompts formulated by users;
- Analysis of prompts and formulation of responses;
- Execution of actions in third-party tools;
- Configuration and execution of business processes.
The legal basis for these processing activities is defined by the User client, as controller.
The User client also defines the personal data whose processing it entrusts to Ofelia.
In connection with the outsourced processing activities, the personal data processed generally consists of:
- data hosted by Ofelia for the Client or imported by the Client;
- Users' contact details and their login permissions;
- connection data;
- the text content of prompts and responses.
Unless otherwise instructed by the client, data is retained for the duration of the contract entered into with the client.
By way of exception:
- data related to prompts formulated by Users is retained only for a rolling period of twelve months;
- data related to the analysis of prompts and the responses formulated is retained for a rolling period of thirty days;
- data related to the execution of actions in third-party tools is also retained for a rolling period of thirty days.
Once these periods have elapsed, personal data that may constitute necessary elements in the event of litigation, and data subject to a legal or contractual retention obligation, is retained for the period provided by law or the contract. It is stored on a separate server with restricted access and used exclusively in connection with a complaint or at the request of judicial or administrative authorities.
Who can access your personal data?
Only Ofelia personnel who strictly need access to your data in order to carry out one of the processing activities described in this Policy may be recipients of your data.
Ofelia does not, under any circumstances, sell your data.
Where applicable, your data may be disclosed to one of our processors, exclusively in connection with and for the purposes of carrying out the outsourced processing activity.
In such cases, the processor is bound by the same confidentiality and personal data protection obligations as Ofelia.
Use of sub-processors
Ofelia reserves the right to engage sub-processors in order to provide the services accessible through the Solutions.
The list of Ofelia's current sub-processors may be provided to the User at any time upon simple request.
Ofelia undertakes to engage only sub-processors that comply with the provisions of the GDPR.
Ofelia guarantees compliance by its sub-processors with the commitments it itself has made, particularly with regard to any commitments it may have made within standard contractual clauses or any other appropriate safeguard.
Transfer of personal data outside the European Union
Ofelia does not voluntarily transfer personal data outside the European Union.
In the event that a User or one of its processors is located outside the European Union or a country benefiting from an adequacy decision, Ofelia will implement all necessary legal measures to govern the data transfer. These measures must take the form of either standard contractual clauses, adherence to the Data Privacy Framework, or another mechanism provided for under the GDPR.
In the event the validity of the transfer mechanism is called into question, Ofelia undertakes to immediately suspend the transfer until the legal conditions necessary to authorize it are met again.
Security and confidentiality of personal data
Ofelia undertakes to implement all sufficient and appropriate technical measures to preserve the integrity and confidentiality of personal data and to protect it against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as well as any other form of unlawful processing. Taking into account the state of the art and the costs of implementation, these measures must ensure a level of security appropriate to the risks presented by the processing and the nature of the personal data to be protected. Ofelia uses secure means of communication to process personal data.
User rights
Each User has a right of access, modification, rectification, objection, and erasure with respect to the personal data concerning them.
The rights set out in the preceding paragraph may be exercised with our customer service department at the following email address: gdpr@ofelia.com.
For any questions relating to the use of our Solutions, please refer to their respective terms of use.
Where a User's data is processed by Ofelia as a processor on behalf of a client acting as controller, requests to exercise these rights must be addressed directly to the controller.
Ofelia has also appointed a Data Protection Officer: the company Virtual-DPO. It may be contacted at any time at contact@virtual-dpo.fr or via its website www.virtual-dpo.fr.
In the event of any difficulty relating to the management of their personal data, the User has the right to lodge a complaint with the CNIL or with any other competent supervisory authority.
This policy may be revised at any time.
If the User does not agree with the new version of our Data Protection Policy, they must stop using our Solutions after the effective date of the change.
External links
Links to other websites managed by third parties may be accessible from our Solutions. Even where the third party is affiliated with Ofelia through a partnership or any other contractual relationship, Ofelia cannot be held responsible for that third party's practices regarding privacy or personal data, or for content accessible from those sites. These links are provided solely to facilitate navigation on our interfaces, and you access them at your own risk.
Cookies
The website https://www.ofelia.com/fr may use cookies.
Certain cookies are strictly necessary for the operation of our site.
Where Ofelia uses cookies that are not strictly essential to the operation of the site, these are only placed on the visitor's browser after they have accepted them. Browsing preferences can be changed at any time via the cookie management platform, accessible at any time from our homepage.