Privacy policy

1.Who is responsible

The controller of the processing described here is Orfi BODLLI EI, a sole trader trading as Praz SI (185 avenue des Nations, 57970 Yutz, France; SIREN 131 404 634 — RCS Thionville). Contact for personal data: contact@praz.si, or +33 7 68 27 22 29. Data protection officer: none; Article 37 of the GDPR does not require one for our processing, which is neither regular and systematic large-scale monitoring of persons nor large-scale processing of sensitive data. If this changes, we will appoint one and state it here.

This policy covers the persons for whom Praz SI itself decides on the processing: visitors to the site, prospects, customer garages and their team, business introducers. For the garages’ customers (callers, appointments, messages), Praz SI acts on behalf of the garage: the data processing agreement applies, and requests are made to the garage.

2.Visitors to the public site

Pages: no measurement cookie or tracker, no third-party content, no advertising. We do not know who visits the site. The chosen language is kept in a cookie sent to the site to display the pages in that language; the theme and the text size stay in your browser and are not sent to us. The other cookies (login, demonstration, sign-up in progress, referrer’s link) are described in the cookie policy.

QR codes on flyers and cards: the scan is counted per day; to count the same person only once in the day, an irreversible fingerprint of the connection address is kept for that day only, then erased; only daily totals remain.

Conversation with Sia on the site: nothing is kept on our servers; the conversation stays in your browser and disappears when you leave the page. Rate limits protect the service, calculated from an irreversible fingerprint of your address, never the address itself.

Question forwarded to the team: if you ask Sia to forward a question, we keep your question, your email, the language and the page, for 90 days at most, to answer you (legal basis: your request, pre-contractual measures). No IP address, no browser, no conversation.

Telephone demonstration and call-back request (when they open): number called or left, name of the garage and content of the exchange, kept for 12 months at most, to contact you again if you asked for it (legal basis: consent).

3.Prospects: garages we contact

To present Sia to garages, Praz SI consults public information (business listing, name, address, opening hours, public rating and reviews) and may create a presentation page in the garage’s name, not indexed by search engines, valid for 30 days.

Legal basis: Praz SI’s legitimate interest in presenting its service to professionals whose trade it is, in the countries open to sales. In France and in Luxembourg, we write to a garage only if the message concerns its activity, with information and an unsubscribe link; in Switzerland, consent is generally required, and sending is blocked there until it is obtained.

Rules we impose on ourselves: one follow-up message at most; an unsubscribe link in every email and the “STOP” word by text message, complied with immediately; a “do not contact” list shared by all our tools; no guessed personal name (at the slightest doubt, we write to the garage, not to a person); retention for 12 months after the last contact, then deletion, except an objection, which is kept in order to be respected.

The rules of use of Google services (attribution, limited caching) are complied with for information obtained from those services.

Our prospecting emails contain no tracking pixel: we do not know whether you open them. Their links (demonstration, your garage’s page) carry an identifier: when you click, we note it in your garage’s record, to contact you again at the right time.

4.Customer garages and their team

Account and workspace: identity, email and phone of the users, role, preferences, the garage’s activity log. Legal basis: performance of the contract. Retention: for the duration of the contract, then 90 days (see the data processing agreement): on that date, the activity log, the team’s accounts and records and the supporting documents sent (register extract, identity document, documents of the number file) are erased. What remains is the account of the subscription holder (name, email, phone), the garage’s identity and its settings: they make it possible to consult Praz SI invoices, to prove the accepted documents and to come back. You can request their deletion (see “Your rights”), subject to what the law requires us to keep.

Linked mailbox (if you choose it): address, server and password of the garage’s mailbox; the password is encrypted and never shown; they are only used to read the inbox (without deleting anything or marking it as read) and to send your replies from the site. Legal basis: performance of the contract (your request). Retention: until you remove the mailbox, at the latest at the end of the contract. Gmail and Outlook are not linked: a simple link opens your mailbox.

Billing: company number, address, invoices, means of payment (kept by our payment provider, never by Praz SI in clear text). Legal basis: contract and accounting obligations. Retention: at least ten years for accounting records (accounting obligation).

Accepted documents: version, fingerprint of the text, date, time, identity of the signatory, irreversible fingerprint of the connection address, signed PDF. Legal basis: contract and evidence. Retention: for the duration of the contract and five years after its end (limitation period).

Company verification: to keep Praz SI for garages only, we consult the official register (existence, status, activity, published legal representatives) and compare the account holder’s name with the published legal representatives; failing that, we ask for a supporting document, read by Sia. In France, if the option is offered to you and you choose it, ProConnect, the French State’s service that identifies professionals, sends us your first name, your last name, your organisation’s SIRET number and the confirmation that you are its legal representative; ProConnect remains responsible for its own processing. We compare this data with your account and your company and keep only the result (date, SIRET number received, match), never your login details or tokens. Legal basis: legitimate interest (keeping the service for garages and preventing a company from being impersonated). Retention: with the verification file, as long as the garage’s account exists.

Security: security log (successful logins, lockouts after too many failures, password changes, administrator actions) with the connection address, kept to detect an attack. Legal basis: legitimate interest (security). Retention: 2,000 lines at most, the oldest erased.

Ideas and reports: the ideas sent through the “An idea?” button and problem reports are reviewed after removal of personal data; your garage is named only with your consent. A screenshot attached to a report may show your customers’ data: only the Praz SI team sees it, and it is erased 90 days after the problem is fixed, or at the end of the contract.

Origin of the sign-up: at the end of the sign-up, the question “How did you hear about Praz SI?” is optional. If you answer “Flyer” or “Business card”, only that word is kept in your garage’s record, to know which printed materials bring in garages; if you do not answer, or answer “Other”, nothing is kept. No cookie is set when you scan a QR code. Legal basis: legitimate interest (knowing which printed materials work). Retention: as long as the garage’s record exists; you can ask for it to be erased at any time.

Founders’ wall and testimonials: only with your written consent, given through a box never ticked in advance, and withdrawable at any time.

5.Business introducers and referral

Introducers: name, company, email, phone, garages presented, commissions. Legal basis: introducer agreement. Retention: duration of the agreement then ten years for accounting records.

Referral: the link between referrer and referee, the discounts applied and, to prevent abuse, an encrypted and irreversible fingerprint of the means of payment (never the card number or the IBAN, which Praz SI does not see) are kept as long as the discount exists, then at least the legal retention period for accounting records. Legal basis: performance of the contract (the discount) and legitimate interest (the fight against fraud). Each party sees only what concerns it; the name of the partner garage is shown only once the referral is validated. When the referee has left, the link, the names and the fingerprint are erased earlier, as described in the next paragraph; the amounts, the dates and the invoice numbers remain.

Return rule: the date on which a referee garage left Praz SI (end of its subscription) and the company identifier that makes it possible to recognise it, even under a new account, are used to apply the return rule: no new referral during the 12 months following that departure. Legal basis: legitimate interest (preventing abuse of the referral programme). The company identifier is kept during these 12 months, then erased, as soon as no discount of this referral is still in progress or to be recovered, together with the names of the two garages, the referrer’s code, the fingerprints of the means of payment and the references of the secure payment; the referrer is no longer linked to it. What remains, without name or company identifier, are the dates (including that of the departure), the amounts, the plans, the country and the invoice numbers, attached to the referee’s account as long as that account exists: they are used never to count a payment made before that departure as the first payment of a new referral.

6.Cookie-free statistics

Today, no audience-measurement tool for the site is in place; only the scans of printed QR codes are counted, as described above. If we add one, it will work without cookies and without personal identifiers, with aggregated data (page views, country, type of device); this policy and the cookie policy will be updated beforehand.

7.Providers and transfers

Praz SI relies on providers for hosting, telephony, voice, language models, payment, emails and Google services. They are named, with their country, in the annex to the data processing agreement.

For language models, we use two providers established in the United States, named in that annex with their transfer safeguard: one reads and translates, for our team only, the replies of the garages we prospect, prepares the draft answers that the team reviews, and operates the Sia assistant (including on this site) when Praz SI activates it; the other operates Sia otherwise. Only the text of the reply received is sent to the model.

The site and its database are hosted in our host’s Frankfurt (Germany) region. Several providers, including the host, are established in the United States or process data there: data may therefore be transferred there. We transfer data outside the European Union and Switzerland only to providers for which the transfer is governed by a safeguard provided for by the GDPR and Swiss law (the EU–US Data Privacy Framework and its Swiss extension for certified providers, or standard contractual clauses); each provider’s safeguard is stated in the annex to the data processing agreement. A provider that publishes no transfer safeguard is not used.

8.Your rights

You can request access to your data, its correction, its erasure, its export (portability), the restriction of a processing, and object to prospecting, by writing to contact@praz.si. We answer within one month; we may ask for proof of identity in case of doubt. You can also withdraw a consent at any time, without effect on what was done before.

You can lodge a complaint with the supervisory authority: in France, the CNIL; in Luxembourg, the National Commission for Data Protection (CNPD); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the United Kingdom, the ICO.

No decision producing legal effects concerning you is taken in a fully automated way.

9.European Union and European Economic Area (GDPR)

The GDPR applies to all the processing described here. The legal bases, retention periods and rights are those stated above. The garages’ customers exercise their rights with their garage, which Praz SI assists.

10.Switzerland (revised FADP, “nLPD”)

The Swiss Federal Act on Data Protection (revised FADP, “nLPD”) and its ordinance apply to garages established in Switzerland and to their customers. Praz SI commits to the same rules as under the GDPR: information, security, rights of access and erasure, notification of breaches to the FDPIC where the law requires it. Representative in Switzerland: none; Article 14 of the Act requires one only if several conditions are met, including large-scale processing, which is not the case today. If they are met one day, we will appoint one and state it here.

11.United Kingdom (UK GDPR)

The United Kingdom is not yet open to sales. As soon as it opens, the UK GDPR and the Data Protection Act 2018 will apply to garages established there, with the same commitments; a representative in the United Kingdom will be appointed if the law requires it, and this section will be completed before any sale.

12.Canada (not open)

Canada is not open to sales: no Canadian garage is accepted for now. Before any opening, we will check the federal law (PIPEDA) and Quebec’s Law 25, then complete this section (consent, designated officer, privacy impact assessment).

13.United States (not open)

The United States is not open to sales: no American garage is accepted for now. Before any opening, we will check the laws of the states concerned (California in particular) and the rules on automated calls and the recording of conversations, then complete this section.

14.Minors

Praz SI is aimed at professionals. We do not knowingly collect data from minors.

15.Changes

Each version of this policy is dated. A significant change is announced to customer garages by email and in “My documents” at least thirty days before, with what changes; previous versions remain available.

This English translation is provided for convenience. In case of discrepancy, the French version of this document, published at praz.si/juridique, prevails.