What is the purpose of our Privacy Policy?

Cogniteev, which manages the website www.oncrawl.com, attaches great importance to the protection and confidentiality of your personal data, which we consider to be a guarantee of reliability and trust.

In this respect, our Privacy Policy is a clear demonstration of our desire to ensure that Cogniteev complies with the rules applicable to the protection of personal data and, more specifically, those of the General Data Protection Regulation (“GDPR”).

In particular, our Privacy Policy aims to inform you about how and why we process your personal data in connection with the services we provide to you.

Who is our Privacy Policy intended for?

Our Privacy Policy applies to you, regardless of where you live, as long as you are at least 15 years old, whether you are one of our customers or simply a visitor to the website www.oncrawl.com.

If you are under the legal age detailed above, you are not authorized to use our services without the prior and explicit consent of one of your parents or the holder of parental authority, which must be sent to us by email to dpo@oncrawl.com.

If you believe that we are holding personal data about your children without your consent, please contact us at the dedicated address detailed above.

Why do we process your personal data and on what basis?

We process your personal data mainly for the following reasons:

browse our website, benefit from our services and so that we can respond to your requests (e.g. requests for information, complaints, etc.) on the basis of our general terms of use and our legitimate interest in providing you with the best possible service.
manage our customer service on the basis of the performance of the contract and our legitimate interest in responding as effectively as possible to your requests and complaints.
to keep you informed of our latest offers and events by email, on the basis of our legitimate interest in building customer loyalty and prospecting potential new customers.
to be kept informed of our latest offers and events by SMS, on the basis of our legitimate interest in building customer loyalty and prospecting potential new customers.
to keep you informed of our latest offers and events by telephone, on the basis of our legitimate interest in building customer loyalty and prospecting potential new customers.
manage invoicing and any outstanding payments, on the basis of our legitimate interest in obtaining consideration for the provision of our service and on the basis of our general terms and conditions.
follow us and comment on our publications on social networks on the basis of our legitimate interest in having a dedicated page on social networks.
use our instant messaging service on the basis of our legitimate interest in communicating easily with you.
receive our newsletter informing you of all the latest news about our services on the basis of our legitimate interest in building customer loyalty.
operate the videos on our website on the basis of our legitimate interest in offering you content in video format.
allow documents to be downloaded on the basis of our general conditions of use.
record the conversations and meetings we have with you in order to improve our customer service, on the basis of your prior consent and our legitimate interest in improving the quality of our service and training our staff.
record conversations and meetings we have with you during our sales prospecting calls, based on your prior consent and our legitimate interest in proving the performance of a contract and training our staff.
to enable you to take part in our competitions, on the basis of our legitimate interest in organizing them and the execution of the associated competition rules.

How did we obtain your personal data?

Your data is collected directly from you when you are a customer of our services or a “simple” visitor to our website www.oncrawl.com and we undertake to process your data only for the purposes described above.

However, we may also obtain your personal data indirectly from partners if you have given your prior consent.

Your personal data may also be processed indirectly in the context of trade fairs or social networks (e.g. LinkedIn).

On the other hand, when you voluntarily publish content on the pages that we publish on social networks, you acknowledge that you are entirely responsible for any personal information that you may transmit, whatever the nature and origin of the information provided.

What personal data do we process and for how long?

We have summarized the categories of personal data and their respective retention periods below:

Professional identification data (e.g. surname, first name, position, company, etc.) and contact details (e.g. e-mail address and business telephone number, etc.) kept for the duration of the service, plus the statutory limitation periods, which are generally 5 years.
When there is confusion between the name of your organization and your personal name (e.g. auto-entrepreneur, VSE, etc.), economic and financial data (e.g. bank account number, verification code, etc.) retained for the time required for the transaction and for managing invoicing and payments, plus the statutory limitation periods, which are generally 5 to 10 years.
Telephone number for our commercial prospecting campaigns by SMS and telephone kept for a maximum of 3 years from the last contact we had with you.
Email address, kept for a maximum of 3 years from the last contact we had with you as part of our email prospecting campaigns, and kept until the end of your subscription to receive our newsletter.
Statistical data relating to the viewing of our videos, which is anonymized and stored indefinitely.
Connection data (e.g. logs, IP address, etc.) kept for 1 year.
Cookies are generally kept for a maximum of 13 months. For more details on how we use your cookies, you can consult our cookies policy, which can be accessed at any time on our website.
Trackers (“tracking pixels”) that are generally stored after each email communication. For more details on how we use trackers, please review our cookie policy, which is available at any time on our website.
Voice and video recording of meetings and telephone conversations for a maximum period of 6 months, with the exception of calls used to justify the conclusion of a contract, which are stored for the statutory limitation period, which is generally 5 years.

Once the applicable retention periods have expired, the deletion of your personal data is irreversible, and we will no longer be able to communicate it to you. At the most, we may only keep anonymous data for statistical purposes.

Please also note that in the event of a dispute, we are obliged to keep all your personal data for the duration of the case, even after the retention periods described above have expired.

What rights do you have to control the use of your personal data?

The applicable data protection regulations give you specific rights which you can exercise, at any time and free of charge, to control the use we make of your data.

The right to access and copy your personal data, provided that this request does not conflict with business secrecy, confidentiality or the confidentiality of correspondence.
The right to rectify any personal data that is incorrect, obsolete or incomplete.
The right to object to the processing of your personal data for commercial prospecting purposes.
The right to request the deletion (“right to be forgotten”) of your personal data that is not essential for the proper functioning of our services.
The right to limit your personal data, which allows you to photograph the use of your data in the event of a dispute over the legitimacy of processing.
The right to data portability, which allows you to recover part of your personal data so that it can be easily stored or transmitted from one information system to another.
The right to give instructions on what should happen to your data in the event of your death, either through you or through a trusted third party or beneficiary.

For a request to be taken into account, it must be sent directly by you to dpo@oncrawl.com. Any request that is not made in this way cannot be processed.

Requests cannot come from anyone other than you. We may therefore ask you to provide proof of identity if there is any doubt about the identity of the person making the request.

We will respond to your request as quickly as possible, subject to a maximum of three months from receipt if the request is technically complex or if we receive many requests at the same time.

Please note that we can always refuse to respond to any excessive or unfounded request, particularly if it is repetitive.

Who can access your personal data?

Your personal data is processed by our teams and by our technical service providers for the sole purpose of operating our service.

We would like to point out that we check all our technical service providers before recruiting them to ensure that they scrupulously comply with the applicable rules on the protection of personal data.

WE GUARANTEE THAT WE WILL NEVER TRANSFER OR SELL YOUR DATA TO THIRD PARTIES OR COMMERCIAL PARTNERS.

Can your personal data be transferred outside the European Union?

The personal data processed by our website is exclusively hosted on servers located within the European Union.

Furthermore, we do our utmost to use only technical tools whose servers are also located within the European Union. However, if this is not the case, we scrupulously ensure that they implement the appropriate guarantees required to ensure the confidentiality and protection of your personal data.

How do we protect your personal data?

We implement all the technical and organizational means required to guarantee the security of your personal data on a day-to-day basis and, in particular, to combat any risk of destruction, loss, alteration or disclosure.

Do we use cookies when you browse our website?

WE GUARANTEE THAT WE DO NOT USE ANY ADVERTISING COOKIES FOR THE OPERATION OF THIS WEBSITE.

However, we would like to inform you that we use statistical cookies when you browse our website. For more information, please consult our Cookies Policy.

Who can you contact to obtain more information about the use of your personal data?

To guarantee the protection and integrity of your data, we have officially appointed an independent Data Protection Officer (“DPO“) to our supervisory authority.

You can contact our DPO free of charge at any time at dpo@oncrawl.com to obtain more information or details on how we process your data.

How can you contact the CNIL?

You may at any time contact the “Commission nationale de l’informatique et des libertés” or “CNIL” at the following address: CNIL Complaints Department, 3 place de Fontenoy – TSA 80751, 75334 Paris Cedex 07 or by telephone on 01.53.73.22.22.

Can the Privacy Policy be modified?

We may amend our Privacy Policy at any time to adapt it to new legal requirements and to new processing operations that we may implement in the future.

Certified by Dipeeo ®

Data Processing Agreement

1. Introduction

The Data Processing Agreement (hereinafter the « Agreement ») aims to govern the use of Personal Data belonging to clients (hereinafter the « Client ») of Cogniteev (hereinafter the « Processor » or « Cogniteev ») when they use the feature of log monitoring and analysis provided by Cogniteev (hereinafter the « Service »).

2. Definitions

The terms “adequacy decision”, “technical and organisational measures”, “data subjects”, “data protection by design”, “data protection by default”, “register”, “joint controller(s)”, “controller”, “processor”, “processing”, “personal data breach” in the Agreement have the meanings described in Articles 4 et seq. of the GDPR.

Other terms are defined below:

“Agreement” means the appendix to the Contract governing the use of the Client’s Personal Data in accordance with the provisions of Article 28 of the GDPR, also referred to as the “Data Processing Addendum” (“DPA”).
“DPIA” means a data protection impact assessment that allows the proportionality of Personal Data processing to be verified and the risks associated with Personal Data processing to be prevented.
“Anonymisation” means processing aimed at making it impossible to identify the persons concerned by the processing carried out in the context of the Service, in an irreversible manner.
“Supervisory Authority” refers to the supervisory authority responsible for GDPR compliance for the Service provided by the Processor.
“Client” means the entity that has subscribed to the Service provided by the Processor.
“Client’s Employees” refers to natural persons (e.g. employees) working on behalf of the Client and using the Service in this capacity.
“Contract” means the contract concluded between the Processor and the Client for the use of the Service, to which this Agreement is attached.
“Right(s) request(s)” refers to the fundamental rights created by the GDPR in Articles 15 et seq. (e.g. right of access, right to erasure, etc.).
“Client’s Personal Data” refers to any data relating to an identified or identifiable natural person transmitted to the Processor and processed by the latter on behalf of the Client in connection with the Service, a detailed list of which is provided in the appendix.
“White label” refers to the unbranded Service provided by the Processor that allows the Client to customise and market the Service under its own brand.
“Party(ies)” means jointly the Client and the Processor.
“GDPR” means Regulation (EU) 2016/679 […] also known as the “General Data Protection Regulation”.
“Applicable regulations on the protection of personal data” means French Law No. 78-17 of 6 January 1978 […] and the GDPR.
“Reversibility” refers to enabling the transfer and integration […] to an equivalent service offered by another service provider.
“SaaS Service” refers to software hosted by the Processor that can be used simultaneously by an unlimited number of Clients.
“Sub-processor” refers to sub-processors recruited by the Processor to process the Client’s Personal Data exclusively within the scope of the Service.
“End Users” means the Client’s Clients who use the Service on a white label basis.

3. Contractual relations and terms

The Agreement is an integral part of the Contract signed between the Client and the Processor for the use of the Service.
In the event of any conflict between the Contract and the Agreement, the obligations in the Agreement shall prevail with regard to the GDPR.
The Agreement remains in force for the entire duration of the Contract and may continue beyond that date as long as all obligations set out herein remain applicable.

4. Role of the Parties and scope of application

The Client acts as the data controller and Cogniteev acts as a data processor within the meaning of Article 28 of the GDPR.
The Parties cannot be considered joint controllers.
In case of an error or change of status, the Parties will update the Agreement as soon as possible.

The Agreement exclusively governs processing carried out as a Processor under Article 28 GDPR, excluding processing carried out by Cogniteev as a data controller.

5. Instructions and commitments

The Processor undertakes to process the Client’s Personal Data only according to documented instructions in the appendix.
It will immediately notify the Client if an instruction appears unlawful.
The Processor is not liable if the Client maintains an unlawful instruction.

The Processor complies with the GDPR, keeps a processing record, applies “Data Protection by Design” and “Data Protection by Default”, and will never use the Client’s Personal Data for its own purposes.

The Processor ensures security through adequate technical and organisational measures.
It is never liable for the Client’s breaches as data controller.

6. Assistance with the implementation of DPIA

DPIAs must be conducted by the Client.
The Processor provides necessary information upon written request but does not perform DPIAs.

7. Assistance with data subjects requests

Requests from End Users are forwarded to the Client as soon as possible.
The Processor is not required to keep an inventory of such requests nor responsible for the Client’s failures.

Upon written request, the Processor takes the technical measures allowing the Client to respond to data subjects.
Requests addressed to the Processor as data controller are handled solely by the Processor.

8. Assistance with security measures

The Processor provides all necessary information about technical and organisational security measures related to the Service.

9. Personal Data Breaches

The Processor notifies the Client as soon as possible and no later than 48 working hours after becoming aware of a breach.
The Client acknowledges that its own 72-hour deadline starts only when it becomes aware of the breach.

The Processor is not authorised to notify Supervisory Authorities or End Users on behalf of the Client.

10. Sub-processors

The Client grants general authorisation for Sub-processors, provided it is informed of changes and may object within 8 days.
If objections are admissible, the Processor may withdraw the Sub-processor, implement additional measures, or terminate the Service.

The Processor ensures Sub-processors offer sufficient guarantees and remains liable (within contractual limits) for their breaches.

11. Hosting and transfers outside the European Union

a) Data hosting

The Processor undertakes to host Personal Data exclusively within the EU unless prior approval is obtained and safeguards implemented.

b) Data transfers

Transfers outside the EU are authorised only if Sub-processors comply with the GDPR and transfers rely on adequacy decisions or appropriate safeguards.
Otherwise, prior consent is required.

12. Retention periods and fate of the Client’s Personal Data

Data is retained only for the duration of the Service and deleted at the end of the Contract.
The Client must retrieve data before termination, as deletion is irreversible.
Anonymised data may be retained to improve the Service.

13. Audits

The Client may conduct a yearly written audit questionnaire and, in specific cases, an on-site audit with 30 days’ notice.
Certain areas may be restricted for confidentiality or security.

Discrepancies must be proven and the Processor must remedy them without delay.
In case of dispute, amicable resolution, authority arbitration, or expert review may be proposed.

14. Cooperation with the authorities

The Processor cooperates with the CNIL and informs the Client as soon as possible in case of authority requests concerning the Client’s Personal Data.

15. Contact

Each Party appoints a contact person for this Agreement.
The Processor has appointed Dipeeo SAS as Data Protection Officer:

Email: dpo@oncrawl.com

Postal address: Dipeeo SAS, 95 avenue du Président Wilson, 93100 Montreuil, France

Telephone: 01 59 06 81 85

16. Revisions

The Processor may modify this Agreement if required by legal or Service changes.

Certified compliant by Dipeeo ®