Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

For any question about how we process your data, contact us at the email address above.

2. Data we collect

We collect the following categories of data:

• Account data: first name, last name, business email address, phone number, language preference, connection logs.
• Business data entered in the application: legal entities, bank accounts, mandates, and the data of signatories and legal representatives (first name, last name, role, email, date of birth). This data remains the property of the customer.
• Supporting documents uploaded for mandates: identity documents (ID card, passport, driving licence), proof of address, signature specimen, company registration extract (Kbis), articles of association, delegations of authority.
• Electronic signature evidence: timestamp, IP address, and consent elements forming the evidence file, generated by our signature provider.
• Technical data: IP address, device type, browser, pages visited, for audience measurement and security purposes.
• Prospecting data: when you request a demo or contact us through the site, name, business email, company, message, along with the IP address and the source of the visit.
• Communications: content of emails exchanged with us, slots booked via our scheduling tool.

3. Purposes and legal bases

Your data is processed for the following purposes:

• Providing the Kable service (account creation, mandate management, electronic signature). Legal basis: performance of a contract (Art. 6.1.b GDPR).
• Replying to your requests and sending transactional emails. Legal basis: performance of a contract.
• Measuring audience and improving the service. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• Handling your demo requests and sales enquiries. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• Complying with legal obligations (accounting, fraud prevention). Legal basis: legal obligation (Art. 6.1.c GDPR).

4. Sub-processors

We rely on the following sub-processors. We require each of them to be bound by a data processing agreement (DPA) compliant with Article 28 GDPR before any processing of real data.

We never sell or rent your data to third parties.

5. Retention period

Your data is retained:

• User account: for the entire duration of the contractual relationship, then deleted or anonymized, except for legal retention obligations.
• Mandates and supporting documents (including identity documents): for the validity period of the mandate, then for the time necessary to establish evidence in the event of a dispute.
• Accounting records: 10 years (Art. L123-22 of the French Commercial Code).
• Technical and connection logs: 12 months.
• Prospecting data: up to 3 years after the last contact.
• Audience measurement: in pseudonymized form, up to 7 years (the retention period of our audience measurement tool).
• Support communications: for the time necessary to handle and follow up on your request.

6. International transfers

Account and business data is hosted in the European Union. Some technical sub-processors are based outside the EU, notably in the United States, where their data may be subject to local law. These transfers are governed by the mechanisms provided for under the GDPR: the European Commission's Standard Contractual Clauses, or the Data Privacy Framework where applicable.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access to your data
• Right to rectification of inaccurate data
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time when processing is based on it

To exercise these rights, email privacy@kableapp.com. We will reply within the timeframes set by the GDPR (in principle one month, extendable if the request is complex).

Automated decisions: Kable does not make any decision producing legal effects concerning you based solely on automated processing, including profiling (Art. 22 GDPR). Mandate approvals and signatures are carried out by natural persons.

Post-mortem directives: you may define directives regarding the fate of your data after your death and communicate them to us (Art. 85 of the French Data Protection Act).

8. Cookies and trackers

The site and the application use only trackers strictly necessary for the service. Your authentication session and your interface preferences (theme, language, filters) are stored locally in your browser (local storage). Our audience measurement tool is configured without any cookie or persistent advertising identifier.

9. Security

We implement the following technical and organizational measures:

• Encryption in transit (TLS)
• Encryption at rest
• Hardened authentication mechanisms
• Strict logical isolation of data between customers
• Immutable audit log on sensitive actions
• Hosted on ISO 27001 and SOC 2 certified infrastructure (Supabase, Vercel)

10. Changes

This policy may be updated to reflect changes in the service or in applicable regulations. The last updated date is shown at the top of the page. Any material change will be notified to you through appropriate means.

11. Contact and complaints

For any question about this policy or to exercise your rights, email privacy@kableapp.com.

You may also file a complaint with the CNIL (French data protection authority): https://www.cnil.fr/en/plaintes