Privacy policy

1. Controller

For processing carried out in connection with the website, contact requests, demonstration requests and, more generally, the business relationship with MyDotation, the controller is:

For any question about the protection of your personal data, or to exercise your rights, you may write to us at this address.

2. Scope of this policy

This policy mainly concerns the personal data processed when you:

• visit the MyDotation website;
• fill in a contact form;
• request a demonstration;
• request a trial or information about our services;
• communicate with our sales team;
• are a prospective client or a client of MyDotation;
• use MyDotation services as a client;
• use the MyDotation platform as a staff member, employee or representative of a client company;
• communicate with our support team;
• use platform features that require the processing of personal data.

Some processing may, however, fall solely under the responsibility of a MyDotation client. Where this is the case, it is specified in this policy.

3. MyDotation’s different roles

The legal characterisation of processing depends on its purpose and context.

3.1. MyDotation as controller

MyDotation acts as controller where it determines, for its own needs, the purposes and essential means of the processing.

This is the case in particular, subject to the processing actually carried out, for:

• the management of the website;
• the handling of contact requests;
• the handling of demonstration requests;
• the management of the business relationship;
• the management of contracts and billing;
• the security of its own services;
• the management of its legal obligations;
• the defence of its rights and interests;
• certain direct marketing activities.

3.2. MyDotation as processor

Where a client company uses MyDotation to manage the data of its own staff members or of other persons for whom it is responsible, that company determines the purposes and essential means of the processing.

In this context, MyDotation acts, as a rule, as processor within the meaning of Article 28 of the GDPR.

MyDotation then processes the data in accordance with the client’s documented instructions and the provisions of the applicable data processing agreement.

The client remains responsible for determining the purposes of the processing, for its lawfulness and for informing data subjects, insofar as these obligations are incumbent upon it.

This characterisation is assessed on a processing-by-processing basis and does not mean that MyDotation acts as processor for all processing concerning a user of the platform.

3.3. Processing of data on behalf of our clients and data processing agreement (DPA)

Where MyDotation processes personal data on behalf of a client company in the course of providing its services, MyDotation acts as processor within the meaning of Article 4(8) and Article 28 of the EU General Data Protection Regulation (‘GDPR’).

In this context, the processing carried out on behalf of the client is governed by a data processing agreement (‘DPA’), which is incorporated into the contract or concluded separately.

The DPA specifies, in particular, the subject matter and duration of the processing, its nature and purpose, the categories of personal data and of data subjects, and the obligations and rights of the client as controller.

MyDotation undertakes, in particular, to process personal data only on documented instructions from the client, to ensure that persons authorised to process such data are subject to an obligation of confidentiality, to implement appropriate technical and organisational measures to protect the data and to assist the client, to the extent provided for by the regulations and the contract, in complying with its obligations under the GDPR.

The conditions applicable to any sub-processors engaged by MyDotation are also governed in accordance with the requirements of Article 28 of the GDPR.

4. What personal data may we process?

Depending on your relationship with MyDotation and the services used, we may process different categories of personal data.

MyDotation takes care to limit collection to the data necessary for the purposes pursued.

5. Data relating to our clients’ staff members

MyDotation is designed, in particular, to enable businesses to manage certain allocations, equipment, authorisations and related operations.

In this context, a client may provide MyDotation with data concerning its staff members.

This data may include, in particular:

• first name and surname;
• work email address;
• department or site;
• job title;
• information necessary for managing allocations;
• information relating to equipment, clothing, badges, keys or other items managed in the platform;
• information relating to authorisations;
• the history of operations carried out in the platform;
• login data and logs necessary for the security of the service.

For such processing, the client company determines the purposes and essential means of the processing and, as a rule, acts as controller.

MyDotation then acts as processor and processes the data in accordance with the client’s documented instructions and the applicable data processing agreement.

If you use MyDotation on behalf of a client company and wish to exercise your rights in respect of data processed on behalf of that company, we invite you to contact the company concerned in the first instance.

MyDotation assists its client in handling requests to exercise rights where such assistance is provided for by the GDPR and the applicable contract.

6. Purposes and lawful bases of processing

MyDotation processes personal data only for specified, explicit and legitimate purposes.

The main purposes and lawful bases are as follows.

The applicable lawful basis depends on the purpose and the specific context of the processing.

Where processing is based on our legitimate interests, MyDotation ensures that those interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

7. Marketing communications

MyDotation may send marketing communications to its clients or prospective clients under the conditions laid down by the applicable regulations.

Depending on the situation, these communications may be based:

• on the consent of the individual, where consent is required;
• on MyDotation’s legitimate interests, where the applicable regulations permit such direct marketing;
• on the specific rules applicable to direct marketing to existing clients.

Where the regulations so require, each electronic marketing communication includes a simple means of unsubscribing.

You may also object at any time to the use of your data for direct marketing purposes.

For prospective clients, data used for direct marketing purposes is, as a rule, retained for a maximum period of three years from its collection or from the last contact initiated by the prospective client, subject to any specific rules that apply and to the exercise of your right to object.

8. Retention periods

We retain personal data only for as long as is necessary for the purposes for which it is processed, subject to legal retention obligations or to the need to retain certain data for evidential purposes.

For guidance:

• Contact or demonstration requests: for the time needed to handle the request and, where the person becomes a prospective client, in accordance with the rules applicable to direct marketing;
• Prospective clients: up to three years from collection or from the last contact initiated by the prospective client, unless they object or a specific obligation applies;
• Clients: for the duration of the contractual relationship, then archived where necessary to comply with our legal obligations or to defend our rights;
• Billing data and accounting records: for the periods required by the applicable regulations;
• Functional platform logs: for the lifetime of the account, then deleted with it, unless longer retention is necessary for security purposes, for handling an incident or for the defence of rights;
• Data processed on behalf of a client: in accordance with the client’s instructions and the DPA. At the end of the service, read-only access is provided for 30 days; active data is then deleted according to the contractual cycle, subject to legal obligations and to acknowledgements placed under a retention lock;
• Signed acknowledgements: for the entire duration of the assignment, then for three years from the actual return or, failing that, from the final closure of the file; for a consumable allocation, three years from its final handover;
• Raw payloads received through the HR system API: 30 days, with automatic deletion.

The exact periods are determined according to the purpose concerned and the applicable legal obligations. The CNIL (the French data protection authority) recommends that retention periods or, failing that, the criteria used to determine them be defined according to the purposes of the processing.

9. Recipients of the data

Personal data may be accessible, within the limits of their respective duties and on a need-to-know basis, to:

• authorised members of the MyDotation team;
• technical service providers acting on behalf of MyDotation;
• hosting and infrastructure providers;
• maintenance and security providers;
• customer relationship management providers;
• email delivery providers;
• professional advisers, where necessary;
• administrative or judicial authorities, where required by law.

MyDotation does not sell its users’ personal data.

Where MyDotation uses a service provider that processes personal data on its behalf, the relationship is governed in accordance with the GDPR requirements applicable to processors.

10. Our main service providers

In order to provide and administer MyDotation, we may use various technical and commercial service providers.

These service providers may be involved, in particular, in:

• hosting;
• customer relationship management;
• sending emails;
• security;
• technical and statistical analysis;
• support;
• the maintenance and operation of the platform.

Service providers used by MyDotation

MyDotation uses several technical service providers for the operation and hosting of its platform and, where applicable, for certain of its features:

• Scaleway SAS – hosting of the PostgreSQL database and storage of acknowledgements and photographs in the Paris region, France. A daily backup is made; manual snapshots may also be created;
• Resend Inc. – sending of transactional emails from Ireland. Certain account data, metadata and sending logs are stored in the United States; these transfers are governed by the European Commission’s standard contractual clauses and by Resend’s certification under the EU-U.S. Data Privacy Framework;
• Gandi SAS – hosting of support mailboxes in France;
• PostHog Inc. – audience measurement for the website, only with your consent. The data is hosted in the European Union (Frankfurt, Germany).
• LinkedIn Ireland Unlimited Company – measuring the performance of our advertising campaigns on LinkedIn, only with your consent to advertising.

This list is kept up to date according to the service providers and features actually enabled. No artificial intelligence provider currently processes the data of the platform’s clients.

11. Transfers of data outside the European Economic Area

Where possible, MyDotation gives preference to service providers and infrastructure that allow data to be processed within the European Economic Area (EEA).

Where processing involves a transfer of personal data to a country outside the European Economic Area, MyDotation ensures that the transfer is governed in accordance with the GDPR.

Depending on the circumstances, the transfer may be based, in particular, on:

• an adequacy decision of the European Commission;
• standard contractual clauses adopted by the European Commission;
• or any other transfer mechanism recognised by the GDPR.

12. Cookies and similar technologies

The MyDotation website may use cookies and similar technologies that are necessary for its operation and, where applicable, technologies intended to measure audience or to improve the website.

Cookies and similar technologies that are not strictly necessary for the operation of the service are only placed or read after consent has been obtained, where such consent is legally required.

Where consent is required, you must be able to accept or refuse cookies and similar technologies with a comparable level of ease and to change your choice later.

The CNIL points out, in particular, that consent to cookies subject to this requirement must be prior, freely given, specific, informed and capable of being withdrawn at any time.

Cookies and similar technologies used on the MyDotation website

As at the date of the latest update of this policy, visiting the website places or reads the following cookies and similar technologies:

• ‘__dpl’: cookie placed by the website’s hosting provider (Lovable) to serve the published version of the website, necessary for its operation;
• ‘session-id’: cookie placed by the website’s hosting provider (Lovable) to measure website traffic;
• browser session storage: remembers the scroll position between pages of the website and, if you arrive from a campaign, its source parameters (utm_…); it is cleared when the tab is closed;
• ‘__ph_opt_in_out_…’: cookie that remembers your choice to accept or refuse audience measurement, kept for six months;
• ‘ph_…_posthog’: cookie and local storage of the PostHog audience measurement tool (random identifier of the visitor and of their visit), placed only if you accept audience measurement and kept for no more than six months;
• ‘mydotation_ads_consent’: cookie that remembers your choice to accept or refuse advertising, kept for six months;
• LinkedIn cookies (in particular ‘li_fat_id’, ‘bcookie’, ‘lidc’, ‘li_sugr’, ‘UserMatchHistory’ and ‘AnalyticsSyncHistory’): placed by the LinkedIn Insight Tag only if you accept advertising, and kept for up to one year depending on the cookie.

Audience measurement

If you accept, PostHog records the pages viewed, clicks, the path taken through the website and a recording of browsing sessions, in order to understand how the website is used and to improve it. Input fields, in particular those of the demonstration request form, are masked in these recordings.

Without your consent, no data is sent to PostHog and none of its cookies or similar technologies is placed. Refusing has no effect on your access to the website.

Advertising

If you accept, the LinkedIn Insight Tag measures the performance of our advertising campaigns on LinkedIn: pages viewed after clicking on an ad and submission of the demonstration request form. LinkedIn Ireland Unlimited Company receives this information and may match it with your LinkedIn account, under the terms of its privacy policy. We only receive aggregated statistics from LinkedIn.

When you submit the demonstration request form, the source parameters of your visit (utm_source, utm_medium, utm_campaign, utm_term, utm_content) are attached to your request in our customer relationship management tool (HubSpot), together with the LinkedIn click identifier (li_fat_id) if you have accepted advertising.

Without your consent, the LinkedIn Insight Tag is not loaded and no data is sent to LinkedIn. Refusing has no effect on your access to the website.

Your choice is kept for six months, after which you will be asked again. You may change it at any time using the ‘Cookie preferences’ link at the bottom of every page or with the button below.

Change my cookie choices

13. Data security

13.1. Technical and organisational measures

MyDotation implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing of personal data that it carries out.

Depending on the services concerned, these measures may include, in particular:

• encryption of communications;
• access control;
• management of authorisations;
• secure authentication and protection of user accounts;
• one-time codes, where this feature is used;
• logging of sensitive operations;
• data backup and restoration;
• infrastructure protection measures;
• prevention, detection and management of security incidents;
• confidentiality undertakings from persons authorised to access the data.

Access to personal data is limited to persons and service providers who need it in the performance of their duties or tasks and who are subject to appropriate confidentiality obligations.

MyDotation regularly reassesses its security measures and may adapt them to take account of technical developments, identified risks and applicable regulatory requirements.

The detailed technical and organisational measures applicable to processing carried out on behalf of clients may be specified in the DPA or in a dedicated security document.

13.2. Security incident management

In the event of a security incident, MyDotation applies its incident management procedures in order to limit its effects, identify its cause and prevent it from recurring.

Where MyDotation acts as controller and a personal data breach occurs, it notifies the CNIL of the breach under the conditions laid down in Article 33 of the GDPR and informs the data subjects where Article 34 so requires.

Where MyDotation acts as processor on behalf of a client, it notifies the client of the breach without undue delay after becoming aware of it, in accordance with Article 33 of the GDPR and the DPA.

14. Anonymised data and statistics

When we produce statistics from the data of our services, we may use aggregated or anonymised data.

Where data has been genuinely and irreversibly anonymised, it no longer constitutes personal data.

We take care to distinguish anonymised data from data that has merely been pseudonymised, which remains subject to the GDPR.

15. Automated decision-making and profiling

In connection with the processing described in this policy, MyDotation does not take any solely automated decision producing legal effects concerning a person or similarly significantly affecting them, within the meaning of Article 22 of the GDPR.

Nor does MyDotation use users’ personal data to build a profile producing such effects.

Should MyDotation’s practices change in this respect, this policy will be updated and the required information will be provided to the data subjects.

16. Your rights

Under the conditions laid down by the GDPR, you have, in particular, the following rights:

• right of access to your personal data;
• right to rectification of inaccurate or incomplete data;
• right to erasure under the conditions laid down by the regulations;
• right to restriction of processing in certain cases;
• right to object to certain processing, in particular where it is based on our legitimate interests;
• right to data portability where this right applies;
• right to withdraw your consent where the processing is based on consent.

The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

You may also give instructions on what happens to your data after your death, under the conditions laid down by French law.

17. How to exercise your rights

You may exercise your rights by sending your request to:

privacy@mydotation.co

Where necessary, MyDotation may request additional information to verify the identity of the person making the request.

Such verification must remain proportionate and will only be carried out where it is necessary to protect the data concerned.

MyDotation responds to requests within the time limits laid down by the GDPR and, as a rule, within one month of their receipt.

This period may be extended by two further months where the request is complex or where a large number of requests has been received. In that case, MyDotation informs the data subject of the extension within one month.

Data processed on behalf of a client

Where MyDotation processes the data solely on behalf of a client company acting as controller, the request may be forwarded to the client concerned so that it can respond.

MyDotation provides its client with the assistance required under the GDPR and the applicable data processing agreement.

18. Lodging a complaint with the CNIL

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority.

You may also consult the CNIL website for up-to-date information on how to lodge a complaint.

19. Changes to this policy

We may amend this policy to take account of:

• changes to our services;
• changes to our data processing practices;
• legal or regulatory changes;
• recommendations from the competent authorities.

In the event of a substantial change affecting the rights of individuals or the way in which their data is processed, we will take appropriate steps to inform them.

The date of the last update appears at the top of this policy.

20. Contact

For any question about the protection of your personal data or about this policy:

privacy@mydotation.co

Version: 2.4 – Last updated: 27 October 2026