Privacy Policy

The data controller responsible for your personal data is:

For any question about how we process your data, contact us at the email address above.

We collect the following categories of data:

• Identification data provided at account creation (name, business email, preferences).
• Business data entered in the application: legal entities, bank accounts, signatories, mandates. This data remains the property of the customer.
• Technical data: IP address, device type, browser, pages visited, for the purpose of audience measurement.
• Communications: content of emails exchanged with us, slots booked via our scheduling tool.

Your data is processed for the following purposes:

• Providing the Kable service (account creation, mandate management, electronic signature). Legal basis: performance of a contract (Art. 6.1.b GDPR).
• Replying to your requests and sending transactional emails. Legal basis: performance of a contract.
• Measuring audience and improving the service. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• Complying with legal obligations (accounting, fraud prevention). Legal basis: legal obligation (Art. 6.1.c GDPR).

We rely on the following sub-processors. Each is bound by a GDPR-compliant data processing agreement (DPA).

We never sell or rent your data to third parties.

Your data is retained:

• Active account: as long as you use the service.
• After account closure: deleted within a reasonable timeframe, except for legal retention obligations (notably 10 years for accounting records, Art. L123-22 of the French Commercial Code).
• Technical logs: retained for the duration necessary to the security of the service.
• Support communications: retained for the duration necessary to maintain the relationship.

Account and business data is hosted in the European Union. Some technical sub-processors are based outside the EU, notably in the United States. Transfers are governed by the mechanisms provided for under the GDPR: European Commission's Standard Contractual Clauses, or the Data Privacy Framework where applicable.

Under the GDPR, you have the following rights:

• Right of access to your data
• Right to rectification of inaccurate data
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time when processing is based on it

To exercise these rights, email jonathan.perbet@kableapp.com. We will reply within the timeframes set by the GDPR (in principle one month, extendable if the request is complex).

The site uses only cookies strictly necessary for the service (authentication, language preference). Our analytics tools are configured to minimize the use of persistent identifiers.

We implement the following technical and organizational measures:

• Encryption in transit (TLS)
• Encryption at rest
• Hardened authentication mechanisms
• Strict logical isolation of data between customers
• Immutable audit log on sensitive actions
• Hosting infrastructure certified ISO 27001 or SOC 2 Type II

This policy may be updated to reflect changes in the service or in applicable regulations. The last updated date is shown at the top of the page. Any material change will be notified to you through appropriate means.

For any question about this policy or to exercise your rights, email jonathan.perbet@kableapp.com.

You may also file a complaint with the CNIL (French data protection authority): https://www.cnil.fr/en/plaintes