Privacy policy
Courtesy translation — only the French text is authoritative. Read the French text
1. Purpose of this policy
This policy explains which personal data is processed when you use the BySince platform and the Cartographe mobile application, why, by whom, for how long, and how to exercise your rights. It applies in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (“loi Informatique et Libertés”).
2. Who is responsible for your data?
2.1. Your organisation is the controller
The platform is made available to you by your organisation (your employer, your institution, your training body). It is your organisation that decides to create an account for you on it and what it tracks there: activities, learning paths, skills, assessments, reviews, badges. It is the controller of that data. It owes you its own information notice, which supplements this policy.
2.2. Since & Co is a processor
[to be completed] (“Since & Co”), publisher of the platform, processes that data on behalf of your organisation and on its instructions, as a processor within the meaning of Article 28 of the GDPR. Its commitments are set out in the data processing agreement.
2.3. Cases where Since & Co is the controller
Since & Co alone decides on the following processing operations and is the controller for them:
- the security of the platform: authentication, login history, technical logs, prevention of abuse;
- proof of your acceptance of the terms of use and of your consent to AI;
- the AI usage log and the encrypted storage of API keys;
- management of the relationship with client organisations and handling of support requests.
Contact details of Since & Co: see the legal notice.
3. Which data is processed?
| Category | Data | Source |
|---|---|---|
| Identity and account | Login identifier, surname, first name, email address (optional depending on the organisation), photo or avatar, language, organisation, department, groups, job profiles, roles and rights, account status. | Your organisation; yourself. |
| Security | Password (hashed), date of its last change, two-factor authentication settings (authenticator application secret, temporary code sent by email), trusted devices, login dates, IP address, browser. | Yourself; automatic collection. |
| Learning and skills | Enrolments in learning paths, progress, resources viewed, sheets printed, validated learning outcomes, assessments and reviews, skills booklet, declared experiences, proposed or recognised skills, versatility data, badges earned. | Yourself; your tutor; the authorised persons in your organisation. |
| Content | Texts, documents and images you upload; indication of your status as author or reviewer; review comments. | Yourself. |
| Field captures (Cartographe application) | Sound recordings, photographs and videos made on site, with their timestamps; transcription of the recordings. These captures may contain the voice, image and words of individuals, including individuals who do not have an account. | The cartographer; the persons recorded. |
| Terms and consents | Version of the terms of use accepted, date and language of acceptance; consent to AI: date, version of the terms, date of withdrawal if any; agreement given for the issuing of a badge. | Yourself; your tutor for the badge. |
| Artificial intelligence | API keys you register (encrypted; last four characters readable; label; dates of testing and of last use); usage log (who, when, feature, provider, model, key used, success or failure, volumes). | Yourself; automatic collection. |
| Support | Content of your support requests and related exchanges; technical information about your browser and the page concerned, attached to the request to enable diagnosis. | Yourself. |
| Audit log | Sensitive administration actions carried out within an organisation: author, date, nature of the action. | Automatic collection. |
The platform is not intended to receive sensitive data within the meaning of Article 9 of the GDPR (health, opinions, trade union membership, etc.). Do not enter such data in free-text fields.
4. Why is this data processed?
| Purpose | Legal basis | Controller |
|---|---|---|
| Creating and managing accounts, roles and rights | Determined by your organisation: generally the performance of the employment or training contract, or its legitimate interest in organising training and the passing on of know-how. | Your organisation |
| Describing activities, building learning paths, tracking progress, assessing learning outcomes, keeping the skills booklet, drawing up reviews, managing versatility | Determined by your organisation, as above; where applicable, its legal obligations regarding training and safety. | Your organisation |
| Collecting recordings, photos and videos in the field | Determined by your organisation: legitimate interest or consent of the persons recorded, as the case may be. | Your organisation |
| Issuing and publishing digital badges | Agreement of the learner, obtained before the badge is issued. | Your organisation |
| Using AI features | Consent of the user who triggers them, which may be withdrawn; for the content processed, basis determined by your organisation. | Your organisation; the holder of the API key for the relationship with the provider |
| Securing the platform: authentication, two-factor authentication, login history, logs, detection of abuse | Legitimate interest of Since & Co and of its clients in the security of the service; security obligation (Article 32 of the GDPR). | Since & Co |
| Keeping proof of acceptance of the terms and of consent to AI | Legitimate interest of Since & Co in proving that its terms are enforceable, including after the account has been deleted, for the establishment, exercise or defence of legal claims; obligation to demonstrate consent (Article 7 of the GDPR). | Since & Co |
| Keeping the AI usage log | Legitimate interest: security, support, information of the key holder, invoicing where applicable. | Since & Co |
| Sending service emails: login code, password reset, notifications | Performance of the service requested by your organisation. | Your organisation; Since & Co for security |
| Responding to support requests | Performance of the contract entered into with your organisation. | Since & Co |
| Backing up and restoring data | Security obligation (Article 32 of the GDPR). | Since & Co, on behalf of your organisation |
The platform does not use your data for advertising, for marketing or to profile you. It contains no third-party audience measurement tool. It takes no automated individual decisions (see the terms of use, Article 18).
5. Who has access to your data?
5.1. Within your organisation
- the administrators of your organisation, who may also temporarily log in in your place for support purposes;
- your tutor or tutors, for your progress and your learning outcomes;
- persons holding “human resources” rights, for reviews, the skills booklet and versatility, within the limits of their rights;
- other users, for the content of which you are the author;
- where applicable, the parent organisation or the subsidiaries with which your organisation shares content.
Each organisation's data is segregated from that of the others.
5.2. At Since & Co
Authorised Since & Co staff (operations, support, development) may access data where this is necessary for hosting, maintenance, security or a support request. They are bound by a duty of confidentiality. Your personal API keys are not accessible to them from the interface.
5.3. Processors and service providers
| Provider | Role | Data concerned | When |
|---|---|---|---|
| [to be completed] | Hosting of the platform and of its database. Location: [to be completed]. | All the platform's data. | At all times. |
| Infomaniak Network SA (Switzerland) | Remote storage of backups, where off-site backup is enabled. | Copy of the database and of the uploaded files. | At each backup. |
| Anthropic | AI: conversion of a transcription into sheets; reviews and drafting launched by operations staff. | Text of the transcriptions and content of the sheets, which may contain personal data. | Only when the feature is used. |
| OpenAI | AI: audio transcription where local transcription is not available; reviews and drafting, at the operator's choice. | Audio files (voice and words); content of the sheets. | Only when the feature is used. |
| Google (Gemini) | AI: reviews, drafting and keywords, at the operator's choice. | Content of the sheets, names of the activities. | Only when the feature is used. |
| Stability AI | AI: image generation. | Text description entered. | Only when the feature is used. |
| Image libraries: Wikimedia Commons, Pexels, Unsplash, Pixabay, Flickr | Search for and import of illustrative images, depending on the configuration. | Search keywords, sent by the platform's server. The previews of the results are loaded directly from the image library, which then receives the IP address and browser of the person carrying out the search. | When an image search is made. |
| MyMemory (Translated) | Machine translation of the title of an imported image. | Title of the image, taken from the image library. No personal data. | When an image is imported. |
| DiceBear; Lorem Picsum | Default avatars and illustrative images. | No personal data. DiceBear receives a hashed random value; neither name nor email address. The requests are sent from the platform's server. | When a default avatar or image is created. |
| “Recherche d'entreprises” API (French State) | Verification of the SIREN number of an attached entity. | SIREN number of the entity. No personal data. | When a subsidiary is created. |
| jsDelivr | Delivery of display libraries on a few editing and administration screens. | IP address and browser of the person opening those screens, received directly by those services. | When those screens are opened. See cookies and trackers. |
Hugging Face is used solely for downloading models that are run locally: no user data is transmitted to it. Details of the AI features and of the data transmitted are given in the terms of use, Article 13.
The case of API keys. Where an AI feature uses your personal key or your organisation's key, the provider processes the data on the account of the key holder, under the contract that the holder has entered into with it. Where Since & Co uses its own resources in the course of operations, the provider acts as a sub-processor of Since & Co.
5.4. The public, for badges
The page and the verification data of a badge are public. See section 9.
5.5. Authorities
Data may be disclosed to the competent authorities, upon formal request and under the conditions laid down by law.
6. Transfers outside the European Union
The platform's data is hosted at the location indicated above. Remote backups are stored in Switzerland, a country recognised by the European Commission as ensuring an adequate level of protection.
The AI providers and certain technical service providers (Anthropic, OpenAI, Google, Stability AI, jsDelivr, image libraries) are established outside the European Union, mainly in the United States, or may process data there. Use of the corresponding features may therefore entail a transfer. The applicable safeguards (adequacy decision, standard contractual clauses) depend on each provider's terms and, for AI, on the plan subscribed to by the key holder. Your organisation satisfies itself of this before authorising those features. You may ask for the details from the contact indicated in section 12.
No transfer to an AI provider takes place if AI is disabled for your organisation, if you have not given your consent or if no key is available.
7. How long is data kept?
The retention periods for business data are set by your organisation, as controller. In the absence of instructions, Since & Co applies the following rules.
| Data | Duration |
|---|---|
| Account, roles, progress, learning outcomes, reviews, skills booklet | For as long as the account exists; until the account is deleted by your organisation or until the end of your organisation's contract. |
| Uploaded content and field captures | Until they are deleted by your organisation or until the end of the contract. Field captures sent by the Cartographe application are not deleted automatically by default: how long they are kept is decided by your organisation. Content you have written for your organisation remains vested in it after your account is deleted. |
| Login session | For the duration of the session. Trusted device: 30 days, extended at each login. |
| Login code sent by email | Until it is used or replaced by a new code. |
| Login history, audit log | Login history: 12 months. Audit log: 3 years. |
| Acceptance of the terms, consent to AI | For the lifetime of the account, then for 5 years after its deletion, solely as evidence. After the account has been deleted, they are kept in pseudonymised form: a keyed hash of the login identifier, with no name or email address. |
| API keys | Until they are deleted by their holder. Personal keys: deleted with the account. Organisation keys: deleted with the organisation. Never exported. |
| AI usage log | 13 months. If your account is deleted before then, your entries are kept with no link to you until they expire. |
| AI proposals (AI review), extracts of AI responses written to the technical log | The request sent to the AI and its response are erased 6 months after the review, once all its proposals have been dealt with; for as long as a proposal is pending, they are kept. The proposals and their status are kept for the lifetime of the organisation. Extracts written to the technical log: 30 days. |
| Technical logs, mobile application logs | Technical logs: 30 days. Logs sent by the Cartographe mobile application: 90 days. |
| Badges issued | On a lasting basis: they survive the deletion of the account so as to remain verifiable, with no link to it. A revoked badge remains flagged as revoked. |
| Backups | Daily: 7 days. Weekly: 4 weeks. Monthly: 12 months. Deleted data may therefore remain in the backups for up to 12 months, without being used there. |
| Organisation's data at the end of the contract | Deleted after the reversibility period provided for in the contract, after a safety export. |
Automatic deletions are carried out once a day: the periods above are therefore accurate to within one day.
8. How is your data protected?
- encrypted connection (HTTPS); protected session cookies;
- hashed passwords; complexity rules; renewal every two months;
- two-factor authentication by application or by email, at the user's choice;
- segregation of data by organisation, checked on every access;
- role-based access rights; audit log of sensitive administration actions;
- API keys encrypted (AES-256-GCM), never displayed again, masked in technical logs;
- encryption of the Cartographe application's captures on the device and in transit, where the organisation has enabled it (see the terms of use, Article 9.5);
- regular backups, including a remote copy transferred over an encrypted connection.
In the event of a personal data breach, Since & Co informs the organisation concerned under the conditions of the data processing agreement.
9. The special case of badges
An Open Badges badge is, by its nature, publicly verifiable. Its page and its verification data are accessible to everyone on the internet, without logging in, and remain so on a lasting basis. Your email address never appears there in clear text: only a salted hash is published. Your name does not appear there. You choose whether or not to share your badge.
A badge is issued only with your agreement. To have it withdrawn, ask your tutor or your organisation to revoke it: the public data will indicate that the badge is revoked. The reason for revocation is displayed publicly.
10. Artificial intelligence and personal data
- AI is optional, subject to your consent, which may be withdrawn at any time from your profile, and can be disabled by your organisation.
- The AI features transmit neither your name, nor your email address, nor your identifier. The content processed (transcriptions, recordings, sheets) may nevertheless contain personal data, including that of persons recorded in the field.
- Skill suggestion and local transcription are carried out on the platform's servers, with no third party involved.
- Since & Co does not train any model with your data. The use a third-party provider makes of it depends on that provider's own terms.
- No decision concerning you is taken by an AI.
The full framework is set out in Articles 11 to 24 of the terms of use.
11. Your rights
You have the following rights over your data:
- access: to know whether data concerning you is being processed and to obtain a copy of it;
- rectification: to have inaccurate data corrected; you can amend part of your profile yourself;
- erasure: to obtain the deletion of your data, within the limits laid down by law;
- restriction: to obtain the temporary freezing of a processing operation;
- portability: to receive, in a structured format, the data you have provided, where the processing is based on your consent or on a contract;
- objection: to object, on grounds relating to your particular situation, to processing based on legitimate interest;
- withdrawal of consent: at any time, for AI (from your profile) and for badges (by revocation);
- post-mortem instructions: to define what is to become of your data after your death.
How to exercise them
- Contact your organisation first (its administrator or its data protection officer): it is the controller for most of the processing. Since & Co assists it in responding to you.
- For the processing for which Since & Co is the controller (section 2.3), write to: [to be completed].
You will receive a response within one month, which may be extended by two months if the request is complex. Proof of identity will be requested from you only in the event of reasonable doubt.
Complaint
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL): 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
12. Contact
Data protection contact at Since & Co: [to be completed].
Postal address: [to be completed], [to be completed].
13. Cookies
The platform uses only cookies and trackers that are strictly necessary for it to operate or to remember your display preferences. They are detailed on the cookies and trackers page.
14. Changes to this policy
This policy is versioned. Each version bears a number and an effective date; earlier versions remain available for consultation. The list of processors is updated whenever it changes.