Privacy policy

This English translation is provided for convenience. The French version is the only legally binding one: read the French privacy policy.

1. Who is the data controller?

The personal data of users of the website and related services is processed by:

HELLOSPOT (RDV360)

Legal form: SASU (French simplified joint-stock company with a single shareholder) with variable capital, share capital of €30,000 (minimum €3,000)
RCS (Trade and Companies Register): Rennes 798 825 170 (SIRET 798 825 170 00037)
Registered office: 90 B rue de Fougères, 35700 Rennes, France
Contact: contact form

When a professional uses the software to manage their customer relationships, that professional may be the data controller for their own customers’ data. HELLOSPOT (RDV360) then acts as the service provider/publisher of the software, as the case may be.

2. Who does this policy apply to?

This policy applies to professionals who:

visit the website,
create a professional account to access the software,
then use the application and its features.

3. What data do we collect?

Depending on the stage (sign-up on the website, then use of the application), we may collect the following categories of data.

A. Account creation data (professional)

Name of the business or organization
Email address
Password (stored in encrypted, non-reversible form)

B. Data entered in the application (professional account)

Business address
Last name (optional)
First name (optional)
Phone number (optional)

C. Technical data

We may collect certain technical information related to the use of the website and the service (e.g. connection logs, technical identifiers, data needed for security and proper operation).

4. Purposes of processing

The personal data collected is used to:

enable the creation and management of your professional account
allow you to log in and access the software
allow you to enter and maintain information about your business
sync certain account information to our CRM in order to manage the business relationship, handle support, follow up on onboarding and ensure service quality
ensure security, prevent fraud and improve the service

We process your personal data only when we have a valid legal basis.

Account creation and management, authentication, access to the software: necessary for the performance of the contract or for pre-contractual measures when you create an account.
Service security, fraud prevention, keeping the service operational: based on our legitimate interest.
Syncing and management in our CRM (e.g. following up on the business relationship, support, onboarding, quality): based on our legitimate interest in managing our relationship with professionals and improving the service, and may also relate to the performance of the contract, as the case may be.
Cookies and other trackers that are not strictly necessary (where applicable): based on your consent (which you can withdraw at any time).
Legal obligations: where required by law.

Personal data may be shared:

with our technical service providers (hosting, maintenance, tools needed for the operation and security of the service), only to the extent necessary
within HELLOSPOT (RDV360), in particular with the teams in charge of support, follow-up and the business relationship
when required by law, in particular to respond to a request from the competent authorities
in the event of a merger, acquisition, sale of assets or similar procedure, subject to the applicable information obligations

7. Retention periods

We keep data for as long as necessary for the purposes described above, then we delete or anonymize it, unless legal obligations require otherwise.

As a guide:

after a professional account is closed, data is kept for 30 days before deletion
copies may remain on our backup media for a maximum of 5 weeks (backup retention period), before automatic deletion
if the POS module was activated on the account in live mode, for legal data retention reasons (in particular in the event of an audit), data related to this module may be kept for 5 years, then permanently destroyed

8. Security

We implement organizational, technical, software and physical measures to protect personal data against alteration, destruction and unauthorized access.

As the Internet is not a fully secure environment, we cannot guarantee the absolute security of transmissions. We do, however, put appropriate safeguards in place.

9. Your rights

You have rights over your data, including:

right of access
right to rectification
right to erasure, within the limits set by law
right to object
right to restriction of processing
right to data portability, where applicable

From your account, you can also:

complete, modify and delete all or part of your data
delete your account from the My subscription section

You can also exercise your rights through our contact form.

Data is deleted within a maximum of 30 days from receipt of the request, when the request is admissible.

10. Cookies

We use cookies (small files saved on your device) and, in some cases, cookies set by third-party services.

A. Why do we use cookies?

to ensure the technical operation of the website and services (e.g. navigation, access to secure areas)
to strengthen security and fraud prevention
to remember your cookie consent choice
to measure audience and improve the service, when you consent to it

B. What data can these cookies contain?

Depending on the case:

a random technical identifier used to recognize your browser or your session
session information (e.g. a session token) to keep you logged in
preference information (e.g. your consent choice)

These cookies do not, as such, store your password.

C. Types of cookies used

We use:

cookies necessary for the operation of the website and the management of your choices (for example to remember your consent)
audience measurement cookies (for example through Google Analytics), only if you accept them
a cross-site journey cookie (_os_cid), set by our own measurement tool unless you refuse it in the banner: it records that you moved from one of our websites (RDV360, Blissa, HelloSpot) to another, so we know where sign-ups come from. It holds a random identifier, is never shared with third parties and expires after 13 months.
cookies related to our CRM / marketing tool (HubSpot), only if you accept them, in order to:
- understand whether the same business comes back to the website
- make it easier to get in touch (for example by displaying forms and pre-filling them when possible)
- recognize the user when using the live chat module, to make conversations and request follow-up easier
security cookies (in particular anti-fraud / anti-bot) that may be set through our service providers

D. How can you manage your cookies?

You can set your browser to block or delete cookies, bearing in mind that this may impair some features.

You can also change your choice through the cookie banner when it is available.

11. Contact and complaints

For any question: our contact form.

You can also file a complaint with the CNIL, the French data protection authority: https://www.cnil.fr/