Privacy policy
Version of 31 October 2026
This English version is provided for convenience. In case of discrepancy, the French version prevails.
How Ductis uses the personal data of its visitors, its customers and their users. In short: only what is necessary, no advertising, no tracking.
Who is responsible?
[to complete: publisher’s company name — ORIGO EVERWORKS, or your own name if a sole trader], reachable at contact@ductis.eu, is the controller of the processing described below. For the data our customers record in Ductis about their own customers, prospects or suppliers, the customer is the controller and Ductis acts as a processor (see the data processing agreement).
What data, why, and for how long?
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form | Name, email, company, phone, size, message | Pre-contractual steps and legitimate interest in replying | 3 years after the last exchange |
| User accounts | Name, email, role, password (hashed), language, date the terms were accepted | Performance of the contract | Duration of access, then 30 days |
| Service security | Log of actions, sign-in attempts, IP address (temporary) | Legitimate interest: securing the service | Audit log: duration of access; sign-in rate limiting: 15 minutes |
| Backups | Copy of the database | Legitimate interest: preventing data loss | 14 days |
Who has access?
Only the Ductis team, for the needs of the service. Our providers:
- IONOS SARL (France) — server hosting. Data centre: [to complete: country of the server’s data centre, shown in the IONOS customer area].
- Brevo (France) — sending the service’s emails, once this feature is enabled.
No data is sold, rented or used for advertising. No data is transferred outside the European Union.
Cookies
Ductis uses two cookies. ductis_session is strictly necessary to keep you signed in to the
application; it is only set after you sign in and is not used for tracking. The website sets a single cookie,
ductis_lang, which remembers your chosen language (English or French) for one year. Both are strictly
necessary; no audience measurement tool or advertising cookie is used, so no consent banner is needed.
Security
Encrypted connections (HTTPS), hashed passwords, revocable sessions, two-factor authentication, data isolated between companies, audit log, daily backups, server administration by key only.
Your rights
You can ask to access, correct, delete or port your data, to restrict its processing or to object to it, by writing to contact@ductis.eu. We reply within one month. If you believe your rights are not respected, you can complain to the CNIL, the French data protection authority (cnil.fr).
If your data was entered into Ductis by a customer company (for example as its customer or supplier), please contact that company first: we will help it reply to you.