1. Purpose and scope
This Privacy Policy describes how RAYDOCS, a French simplified joint-stock company (SAS) with share capital of €1,900, registered with the Nanterre Trade and Companies Register under number 108 074 139, whose registered office is at 17 rue de l’Église, 92200 Neuilly-sur-Seine, France, represented by its President Mr Julien Nahum (hereinafter “Raydocs” or “we”), processes personal data.
It applies to two distinct situations, which should not be confused:
- Processing for which Raydocs acts as data controller: website browsing, user account management, customer relations, billing and support. This processing is described in this Policy.
- Processing for which Raydocs acts as data processor: the documents and data that the Customer sends to the Platform as part of its professional activities. The Customer is the data controller. This processing is governed by the Data Processing Agreement between Raydocs and the Customer, not by this Policy.
2. Data we process as controller
| Category | Data concerned | Source |
|---|---|---|
| User account | First and last name, professional email address, role, firm name and login credentials | Provided by the person or their employer |
| Customer relationship | Professional contact details, correspondence and order history | Provided by the person |
| Billing and payment | Company name, SIRET number, address, bank details included in the direct debit mandate and billing history | Provided by the Customer |
| Support and assistance | Content of requests and incident logs | Provided by the person / collected automatically |
| Technical logging | IP address, timestamp, browser type, pages viewed and login events | Collected automatically |
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account creation and management; provision of the Services | Performance of a contract (Article 6(1)(b) GDPR) | Term of the contract + 5 years (general limitation period) |
| Billing, debt recovery and accounting | Legal obligation (Article 6(1)(c) GDPR) | 10 years (Article L.123-22 of the French Commercial Code) |
| Support, assistance and incident management | Performance of a contract (Article 6(1)(b) GDPR) | 3 years |
| Service security, abuse prevention and logging | Legitimate interests (Article 6(1)(f) GDPR) | 12 months |
| Business-to-business sales prospecting | Legitimate interests (Article 6(1)(f) GDPR), with a right to object | 3 years from the last contact |
| Website audience measurement (cookie-free solution) | Legitimate interests (Article 6(1)(f) GDPR) | 12 months |
At the end of the periods above, data is deleted or moved to a restricted-access archive where a legal retention obligation applies.
For documents sent to the Platform by Customers, for which Raydocs acts as data processor, the default retention period is ninety (90) days from processing, unless a different period is agreed in the Order Form.
4. Recipients
Data is accessible to authorised Raydocs personnel within the scope of their responsibilities. It may also be shared with the following categories of recipients:
- the provider hosting the infrastructure on which the Platform operates;
- the artificial intelligence model providers used by Raydocs to perform the Services;
- the website audience measurement tool, which does not place cookies or collect directly identifying data;
- customer relationship management and professional data enrichment tools;
- the bank handling SEPA direct debits and payment management;
- billing and accounting service providers;
- where applicable, administrative or judicial authorities acting under a lawful request.
The current named list of subprocessors used by Raydocs and the location of the corresponding processing is included in the Data Processing Agreement entered into with each Customer. It is available on request.
Raydocs does not sell or rent data to third parties for commercial purposes.
5. Transfers outside the European Union
Data is hosted and processed within the European Union.
Where an artificial intelligence model provider is established outside the European Union, the transfer is governed by an adequacy decision or the standard contractual clauses adopted by the European Commission, together with additional measures where appropriate.
6. Security
Raydocs implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, within the meaning of Article 32 GDPR. These measures are detailed in Appendix 2 to the Data Processing Agreement.
7. Your rights
Under Articles 15 to 22 GDPR, each data subject has the following rights: access, rectification, erasure, restriction of processing, objection and data portability, as well as the right to define instructions concerning the handling of their data after death.
You may exercise these rights by emailing contact@raydocs.com or writing to Raydocs’ registered office. We will respond within one month of receiving the request. This period may be extended by two months where the request is complex. Proof of identity may be requested where there is reasonable doubt about the requester’s identity.
Where a request concerns data processed by Raydocs as data processor on behalf of a Customer, Raydocs forwards the request to the relevant Customer, which responds as data controller.
8. Cookies
The website uses only session cookies that are strictly necessary for its operation and to secure login. These cookies do not require the user’s prior consent.
Audience measurement is provided by Plausible Analytics, which does not place cookies or collect directly identifying data. No advertising or third-party service cookies are placed.
9. Changes
This Policy may be amended at any time to reflect legal, regulatory or technical developments. The version applicable is the version published on the website on the date it is viewed.