Who are we?

SAS Seekoya
12 Rue de la Part-Dieu, 69003 Lyon, France
Represented by Matthieu THOMAS, as President, and Nicolas LEGENDRE, as Managing Director.

Legal information: SIRET: 83460654300025
RCS: LYON – NAF: 6201Z

Capacity, purpose and aim of data processing

‍Personal data is processed by Seekoya as data controller when you are a customer, an administrative contact, or a prospect connected to our business relationship.

We sometimes work with partners to manage our business relationship with customers and prospects. These trusted partners then act as data processors for Seekoya (this covers tools such as our CRM, social networks, payment, newsletters, customer satisfaction, and usage stats for our Cards platform, etc.)

Processing carried out by Seekoya:

As part of our business relationship
(i.e. prospecting, customer relations, exchanges on social media, job applications, meetings and exchanges at online or in-person events), the processing is as follows:
• Through our online contact forms (including resource downloads) -> To handle the request made, get back to you, and deliver the requested resources and services.
• Prospecting -> To reach out to our prospects and identify their interest in our solution and related services.
• Exercising your rights -> To assist you with this process and respond to it, while informing our internal teams of the requested action.

The retention period for this business-relationship processing, as described above, is up to 13 months.
The categories of data involved are: data related to browsing our website, contact identity data, professional data, and any data you expressly provide within the relevant form(s).

Legal basis for processing: our company's legitimate interest and initiatives, legal obligations (GDPR), and consent for cookies.
‍
Processing carried out as a user,
to access the microlearning and materials shared by one of our customers or partners, Seekoya may process personal data as a data processor.

In this case, the processing carried out by Seekoya is as follows:
- Setting up the Customer account
- Managing the Customer account (recording, storing, viewing and deleting Personal Data, and providing the Tool)
- Support / technical maintenance

The Customer's Personal Data is processed for the following purposes:
- Main purpose: Creating microlearning courses with Cards
- Sub-purpose 1: Providing support and advice on using the Tool
- Sub-purpose 2: Accessing shared microlearning courses
- Sub-purpose 3: Enabling usage statistics tracking

Categories of data processed on Cards

We distinguish 2 types of profiles on Cards:
- Owners: people who create their workspace on the platform and manage the subscription
- Learners & editors: users added by the owner. Learners access microlearning shared with them. Editors create microlearning and share it with learners.

Identification data:
- first name
- last name
- photo (optional)

Professional data:
- work email address
- department/team (optional)
- phone number (optional, except for the owner at sign-up)

Usage data:
- Usage statistics, types of content created, type of plan/subscription

Retention period on Cards

Data category -> Retention period
- Contractual data -> Duration of the service agreement + 10 years per legal requirement
- Identification data -> 13 months from the last request
- Professional data -> 13 months from the last request
- Usage data -> 6 months after the end of the contract
‍

Sensitive data:

Data considered "sensitive" includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, or sexual orientation. We do not collect any of this data.

Data ownership

Data used, processed, hosted, backed up or stored by Seekoya on behalf of the Customer, or at the Customer's initiative, is and remains the property of the Customer.

How do we use your personal data?
Seekoya acts as data controller in the relationship between Seekoya and our customers (creators of microlearning with Cards), for the personal information you provide us in order to use our service. Seekoya does not sell personal data to third parties and does not use it for marketing purposes or to serve ads. We only share your information with service providers who help us run our business, in which case those third parties are required to comply with GDPR.

Confidentiality and integrity
‍
Seekoya undertakes to:
- Have staff sign a confidentiality agreement for the performance of Services, in line with Art. 5(1)(f) of the GDPR;
- Train and inform staff on data protection regulations and the Customer's instructions;
- Not disclose the Customer's confidential information without the Customer's prior written authorization;
- Not use the Customer's confidential information for any purpose other than performing the rights and obligations under this Agreement;
- Not disclose the Customer's confidential information to anyone, by any means, except to staff, any agents or subcontractors who need it to perform the Services and who are bound by confidentiality obligations at least as strict as these, or when requested by a law enforcement, judicial or administrative authority;
- Inform staff, any agents, subcontractors and their staff and agents, as well as any third-party entities or persons, of the confidential nature of the information provided by the Customer, and to take responsibility for any disclosure resulting from their actions;
- Take the protective measures it would take to protect its own confidential information, including in the context of remote work.


Access to Personal Data

- Seekoya and its staff
Certain teams at Cards may see your data, but only what they need to do their job. They cannot use this information for anything else and must keep this data confidential.

- Your company and staff
Depending on whether you're a Learner or a User on the platform, your employer and those with rights to manage the platform (such as Owners and Editors) may access your data.
‍
- Competent authorities‍
We may be required to share your personal data with authorities if a law, regulation, or decision of a competent authority, whether regulatory or judicial, requires us to. We are committed to strictly complying with applicable laws and regulations, particularly those concerning the protection of your data, in order to limit, regulate or prevent the disclosure of your information without compromising your privacy.‍
- Social media
If you interact on social media via our pages and our site, this information will be sent to the social network and shown on your profile. To prevent the social network from linking this info to your account, log out of it beforehand. Also check their privacy policies for more information.‍
- Our partners and providers
Certain data may be shared with our partners, listed below in the "Data hosting" section.

Data hosting

Data is stored exclusively on servers in France, except upon special request from customer(s) located outside Europe

‍
The [app.cards-microlearning.com] website and the MS Teams app are hosted by:
Clever Cloud SAS, with capital of €22,952
Registered under RCS Nantes: B 524 172 699.
Registered office: 3 rue de l'Allier, 44000 Nantes, France.
Intra-EU VAT number: FR 87 524 172 699

Files are hosted by:
SCALEWAY, a French simplified joint-stock company with capital of €214,410.50
SIREN: 433 115 904, RCS Paris – Registered office: 8 rue de la Ville l'Évêque, 75008 Paris
Intra-EU VAT number: FR 35 433115904
‍
Data processors
-> We make sure that none of your users' (Cards learners') personal data is transferred outside the European Union. The sub-processors listed below let us access or use specific services. We invite you to review our Data Protection Agreement, between Cards (Seekoya) and the company acting as Cards Customer under a Cards subscription or plan.

List of data processors:

- Pipedrive: for CRM records, only the subscription owner's information is recorded. No data about users ("learners" and "editors") is transmitted to the CRM.
  - Location: Europe (Pipedrive Ireland Ltd = Ireland)
‍
- Mailjet: email addresses are sent to Mailjet so the platform can send notification emails.
  - Location: Europe (France)

- Firebase: push notifications (for mobile apps) are sent via Firebase. No personal data is transmitted.
  - Location: Europe

- Stripe: email address, first and last name of the subscription owner (only), for customers who pay for their subscription online via Stripe. No user data is transmitted. If an account doesn't use Stripe for payment, no data is sent to Stripe.
  - Location: USA

- PostHog: only platform usage data is sent, and it's anonymized (no email address, only a user ID is sent). No personal data is transmitted.
  - Location: Europe

- OpenAI: No personal data is transmitted. Only used if the AI option is enabled and the editor uses an AI feature. Data transmitted (queries or prompts) is then deleted within 1 to 30 days.
  - Location: Europe

- Sentry: Application monitoring. No personal data is transmitted.
  - Location: USA

‍

- Mistral AI: "Text to Speech" feature in the Cards tool. No personal data is transmitted.

• Location: France

‍

Some data may be shared with our partners and services when your Cards account is created: only the account of the owner of the Cards workspace and the "editor" licenses purchased. No "Learner" user data is transmitted.
‍
The list of services and partners with access to this data is available above, before creating a customer account, or when creating your Cards account by accepting and reviewing this Cards privacy policy.

Data protection contact
‍
The company's data processing contacts are:
Matthieu THOMAS and Nicolas LEGENDRE, representing Seekoya, 12 Rue de la Part-Dieu, 69003 Lyon, France
‍
To contact them, please use the following email format: [FIRSTNAME] @ seekoya [DOT] com
or via the contact form on our website.

User rights

Any user affected by the processing of their personal data can exercise the following rights, under EU Regulation 2016/679 and the French Data Protection Act (Law 78-17 of January 6, 1978):
Right of access, rectification and erasure of data (set out in Articles 15, 16 and 17 of the GDPR, respectively);
Right to data portability (Article 20 of the GDPR);
Right to restriction (Article 18 of the GDPR) and to object to processing (Article 21 of the GDPR);
Right not to be subject to a decision based solely on automated processing;
Right to determine what happens to data after death;
Right to lodge a complaint with the relevant supervisory authority (Article 77 of the GDPR).

To exercise your rights, please send your request to Matthieu THOMAS or Nicolas LEGENDRE, by mail to the company's registered office, or by email to DPO [AT] seekoya [DOT] com

To let the data controller act on the request, users may need to provide certain information such as: their first and last name, their email address, and their account, workspace or subscriber number.
‍
If you have a Cards user account, a form is also available from the "My Profile" page and the "Support" page.