Privacy policy

Two processing activities, not to be confused

This document describes the data processed by the rookup.fr website, for which RookUp is the controller under the GDPR. It concerns people who browse the website and those who request a demonstration.

It does not describe the processing of apprentice data held in the application. For that data, the client company is the controller and RookUp acts as a processor, under the contract between them. The last section returns to this point.

Data collected on this website

Simply browsing the website requires no sign-up and sets no cookie.

Requesting a demonstration collects a first name and an email address. That information is not stored on RookUp servers: it is passed directly to the scheduling tool to prefill the booking form, and that tool retains it together with the chosen date.

Audience measurement records anonymous navigation events: a page view, a click on a call-to-action button, the opening of the demonstration form. No personal identifier, no email address and no cookie is attached to them.

Purposes and legal bases

Responding to a demonstration request and arranging the meeting: steps taken at the request of the data subject prior to entering into a contract, under Article 6(1)(b) GDPR.

Measuring website audience and improving its content: the publisher’s legitimate interest, under Article 6(1)(f). As the measurement is anonymous and cookie-free, it requires no prior consent and therefore no banner.

Responding to a message sent to the contact address: the publisher’s legitimate interest in handling enquiries addressed to it.

Recipients and processors

Data is neither sold, rented, nor passed on for advertising purposes. It is accessible only to those RookUp staff who need it, and to the technical providers strictly necessary to operate the service.

Those providers are the website host, the scheduling tool, the audience measurement tool and the email delivery service. Each accesses only the data required for its function and acts on RookUp’s instructions.

Hosting and data location

The servers hosting the application and the database are located in the European Union: in France for the application, in Germany for the database. Data at rest does not leave the European Economic Area.

The rookup.fr website is delivered from a network of servers spread around the world, but it stores no personal data: its delivery therefore involves no transfer.

Should a processing activity in future involve a transfer of data outside the European Economic Area, it would be governed by the standard contractual clauses adopted by the European Commission, and this policy would be updated.

Retention periods

Contact details provided when requesting a demonstration are kept for three years from the last contact, in line with the French data protection authority’s recommendation on commercial prospecting, then deleted.

Email exchanges are kept for as long as needed to handle the request, and for three years at most.

Traffic statistics, which contain no personal data, are kept in aggregate form without a time limit.

Cookies and trackers

This website sets no advertising cookie, no social network cookie and no audience measurement tracker.

The scheduling tool, once opened, may set its own functional cookies. Those fall under its own privacy policy, available from the booking window.

Security

Exchanges with the website and the application are encrypted end to end using TLS, and unencrypted access is refused.

In the application, passwords are never stored: only an irreversible cryptographic fingerprint is kept. Access to an account is temporarily suspended after several failed attempts.

Isolation between client companies is enforced by the database engine itself, through row-level security policies, rather than by application code alone. A query therefore cannot reach another organisation’s data, even in the event of a programming fault.

Your rights

You have the right to access, rectify, erase and port your data, as well as the right to object to and restrict processing. You may also set instructions on what becomes of your data after your death.

These rights are exercised by email to the contact address given in the legal notice. You will receive a reply within one month. Proof of identity may be requested where there is reasonable doubt as to the identity of the person making the request.

If the reply does not satisfy you, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Apprentice data held in the application

When a company uses RookUp to follow its apprentices, that company determines the purposes of the processing: it is the controller, and RookUp acts as a processor on its instructions.

An apprentice wishing to exercise their rights should therefore contact their company first. The application offers them, directly from their account, an export of all their data under Article 15 GDPR, and deletion of their account under Article 17.

The precise terms (retention periods, authorised sub-processors, security measures, assistance in the event of a data breach) are set out in the data processing agreement attached to the contract signed with each client company.