Privacy policy

EMITY, a French limited liability company (SARL) with capital of €10,000, 40 rue de la Pierre Plantée, 34830 JACOU, France, registered with the Montpellier Trade and Companies Register (RCS) under number 835 398 058.

Data Protection Officer (DPO): dpo@emity.io

• Contact forms and demo requests: first name, last name, email, telephone, company, message. Purpose: to reply to you and prepare a demonstration. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). Retention: 3 years from the last contact.
• Chat and support: the messages exchanged and the contact details you provide. Purpose: to reply to you. Legal basis: pre-contractual steps or performance of the contract (Art. 6(1)(b) GDPR).
• Access to the E-MANAGER platform: login, business email, user connection logs (customers’ administrators and operators). Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: term of the contract, then deletion or anonymisation of the logs within 6 months.
• Newsletter and marketing communications: business email, name, company. Legal basis: consent (Art. 6(1)(a) GDPR). Retention: 3 years from the last active contact (open, click). Every email contains an unsubscribe link.
• Audience measurement and campaigns: pages viewed, browsing path, origin of the visit, technical browser data, in pseudonymised form. Legal basis: consent (Art. 6(1)(a) GDPR), collected through the cookie banner. Retention: 13 months at most.
• Website security: IP address and requests sent to the website. Purpose: to protect the website against attacks and abuse. Legal basis: EMITY’s legitimate interest (Art. 6(1)(f) GDPR).

For E-MANAGER and the E-CLICK modules (visitor register, queue management, room booking and Smart Office), EMITY acts as a processor within the meaning of Article 28 GDPR. The data processed in these modules (visitors, employees in flexible offices, people in a queue) falls under the responsibility of the customer, who is the controller. EMITY processes this data only on the customer’s instructions, under a GDPR-compliant data processing agreement. To exercise your rights over this data, please contact the organisation that welcomed you first.

The data entrusted to E-MANAGER and E-CLICK is hosted exclusively in France, with OVHcloud. A data processing agreement (DPA) can be signed with each customer, and the list of EMITY’s sub-processors is available on request.

Your data is intended for EMITY’s teams. It is neither sold nor rented.

EMITY uses the following service providers, which process some data on its behalf or set cookies when you accept them:

• OVHcloud (France): hosting of the website and the EMITY software. OVHcloud is ISO/IEC 27001, 27017 and 27018 certified, and a data processing agreement is signed with it.
• Google (Google Analytics, Google Ads, Google Fonts, YouTube): audience measurement, advertising campaign measurement, font display, playback of embedded videos. Google’s policy
• HubSpot: management of contacts, forms and email sending. HubSpot’s policy
• LinkedIn: campaign measurement and content sharing. LinkedIn’s policy

Data may also be disclosed to the authorities where the law requires it.

The data your teams entrust to E-MANAGER and E-CLICK remains hosted in France. Transfers outside the European Union concern only some of the website and sales tools listed above, which are based in the United States or process data there. These transfers are covered by the EU–US Data Privacy Framework where the provider participates in it, or otherwise by the standard contractual clauses adopted by the European Commission. A copy of these safeguards can be obtained from our DPO.

On your first visit, a banner informs you that cookies are used and asks for your consent before any non-essential cookie is set.

• Strictly necessary cookies (no consent required): operation and security of the website, remembering your language and your privacy choices. Duration: session or up to 1 year depending on the cookie.
• Audience measurement cookies (with consent): visit and page usage statistics, in pseudonymised form. Maximum duration: 13 months, in line with the CNIL’s recommendations.
• Marketing cookies (with consent): measuring campaign effectiveness and tracking interactions with our content for prospecting purposes.
• Embedded content (with consent): videos and content from other websites (YouTube, LinkedIn) behave as if you were visiting those websites, which may set their own cookies.

You can change your choices at any time through the consent settings link at the bottom of the page, or in your browser settings. Refusing audience measurement and marketing cookies does not prevent access to the website’s content.

EMITY has implemented an information security management system (ISMS) compliant with ISO/IEC 27001:2022, covering the design, hosting, operation and support of E-MANAGER and E-CLICK. A certification process is under way with an accredited body. The measures in place include:

• services accessible only over HTTPS (TLS 1.2 minimum);
• encrypted backups, kept in France; user passwords never stored in plain text;
• access granted on a least-privilege basis, multi-factor authentication for administration, access revoked on the day an employee or contractor leaves;
• a confidentiality undertaking signed by every employee and every contractor with access to the information system.

In the event of a serious incident affecting their data, customers are informed without delay, and at the latest within 24 hours of its qualification. Personal data breaches are notified to the CNIL within 72 hours, in accordance with the GDPR. To report a security event or a vulnerability: rssi@emity.io.

You have the following rights over your data:

• right of access, rectification and erasure;
• right to restriction of processing;
• right to object, in particular to direct marketing;
• right to data portability;
• right to withdraw your consent at any time;
• right to give instructions about what happens to your data after your death.

To exercise them, write to dpo@emity.io or to EMITY, 40 rue de la Pierre Plantée, 34830 JACOU, France. You will receive a reply within one month. If you consider that your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the supervisory authority of the country where you live.

In accordance with Article 30 GDPR, EMITY keeps a record of processing activities, updated regularly, both as a controller (website, marketing, human resources, customer and partner management) and as a processor (E-CLICK and E-MANAGER modules deployed at its customers’ premises).

The privacy policy specific to the E-Box application (the digital signage player installed on the players) is set out on the Terms of use page.

This policy may change. Any change is published on this page, with its update date.

See also: Website terms of use · Legal notice