Privacy Policy

1. Data controller and Data Protection Officer

The controller of the personal data collected via the Site is SAS ALL IN BOX, located at Parc des Varimonts, 10 avenue de Thionville, 57140 WOIPPY, registered with the RCS of Metz under number 838 227 908.

SAS ALL IN BOX has appointed a Data Protection Officer (DPO), who can be contacted at the email address dpo@allinbox.com for any question relating to the processing of personal data or the exercise of the rights provided for in Article 9.

2. Data collected

All in Box collects the following categories of personal data:

• Data provided voluntarily by the User via the Site's forms (contact form, demo request, newsletter subscription): surname, first name, business email address, telephone number, company name, job title, business sector, message content;
• Data collected automatically when browsing the Site: IP address, connection identifiers, browser type and version, operating system, pages viewed, date and time of visit, visit duration, referring site, data from cookies and other trackers;
• Data from interactions with All in Box: written or telephone exchanges, request history.

3. Purposes of the processing

The personal data collected is processed for the following purposes:

• Responding to requests submitted via the Site's forms (contact, demo request, etc.);
• Sending the User commercial communications and the newsletter, subject, where required, to obtaining their prior consent;
• Carrying out audience measurement and improving the operation and content of the Site;
• Ensuring the security of the Site, preventing and detecting fraud or intrusion attempts;
• Complying with the legal and regulatory obligations applicable to All in Box.

4. Legal bases

The processing operations carried out rely on the following legal bases, within the meaning of Article 6 of the GDPR:

• The legitimate interest of All in Box, for the handling of requests submitted via the forms, prospecting directed at legal entities, the security of the Site and audience measurement for exclusively internal purposes;
• The User's consent, for the sending of commercial communications by electronic means where such consent is required, as well as for the placing of cookies that are not strictly necessary;
• Compliance with legal obligations to which All in Box is subject.

5. Recipients of the data

The personal data collected is intended for the internal departments of All in Box authorised to access it, in particular the sales, marketing and support teams.

It may also be communicated to processors acting on behalf of All in Box, in particular providers of hosting, electronic message sending, audience measurement and behavioural analysis services. These processors act only on the instructions of All in Box and are bound by contractual obligations equivalent to those of All in Box with regard to data protection.

All in Box does not sell, rent or market personal data to third parties for prospecting purposes.

6. Retention periods

Personal data is retained for the following periods:

• For requests submitted via the Site's forms and associated data: three (3) years from the last active contact initiated by the User;
• For data collected in the context of a contractual relationship (Client): for the entire term of the Contract, plus the applicable statutory retention periods (in particular ten (10) years for accounting and tax matters);
• For data from cookies: in accordance with the periods indicated in the cookie management policy;
• For connection logs and technical data: one (1) year in accordance with the applicable provisions.

7. Transfers outside the European Union

The Site is hosted by Webflow, Inc., a company established in the United States (San Francisco, California). The personal data collected via the Site may therefore be processed and stored on servers located in the United States.

Other processors acting on behalf of All in Box (in particular for audience measurement, the sending of electronic communications or behavioural analysis) may also process data from countries located outside the European Union, mainly the United States.

These transfers are governed by the appropriate safeguards provided for in Articles 44 et seq. of the GDPR. In particular, Webflow, Inc. is certified under the EU-US Data Privacy Framework. Where a processor is not certified under this framework, transfers are carried out on the basis of the standard contractual clauses adopted by the European Commission.

8. Security

All in Box implements appropriate technical and organisational measures to preserve the security, integrity and confidentiality of the personal data collected: encryption of data flows in transit (HTTPS/TLS), access control, traceability of sensitive operations, regular backups, staff awareness training.

9. Rights of data subjects

In accordance with Articles 15 to 22 of the GDPR, the User has, with regard to personal data concerning them, the following rights:

• Right of access: to obtain confirmation that data is being processed and to receive a copy of it;
• Right to rectification: to have inaccurate or incomplete data rectified;
• Right to erasure: to obtain the erasure of data in the cases provided for by the GDPR;
• Right to restriction of processing: to obtain the restriction of processing in the cases provided for by the GDPR;
• Right to object: to object to processing on grounds relating to their particular situation, or at any time and without justification with regard to commercial prospecting;
• Right to portability: to receive the data in a structured, commonly used and machine-readable format, or to have it transmitted to another controller;
• Right to withdraw consent at any time, where the processing is based on consent;
• Right to set directives regarding the fate of their data after their death.

These rights may be exercised at any time, free of charge, by email addressed to the Data Protection Officer at dpo@allinbox.com, or by post addressed to SAS ALL IN BOX – Data Protection Officer, Parc des Varimonts, 10 avenue de Thionville, 57140 WOIPPY. For security reasons, All in Box may ask the User to provide proof of identity before acting on their request.

10. Complaints to the CNIL

The User also has the right to lodge a complaint with the CNIL (French Data Protection Authority — Commission Nationale de l'Informatique et des Libertés), in particular at the following address: 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07, or online at www.cnil.fr.

11. Changes to this policy

All in Box reserves the right to amend this policy at any time, in particular to take account of any legal, regulatory, case-law or technical developments. The applicable version is the one in force at the time the Site is consulted.

PART II — COOKIE MANAGEMENT POLICY

1. What is a cookie?

A cookie is a small text file placed on the User's device (computer, tablet, smartphone) when browsing the Site, enabling the Site's publisher or a third party to recognise that device, store certain information and collect other information.

This policy also covers, by extension, all trackers placed or read when browsing the Site (pixels, tags, identifiers, web beacons and equivalent technologies), hereinafter collectively referred to as "Cookies".

2. Categories of Cookies used

The Site uses the following categories of Cookies:

Strictly necessary Cookies. These Cookies are essential to the proper functioning of the Site and to the provision of the services requested by the User (session management, security, load balancing, storage of display and language preferences). They are exempt from the consent requirement, in accordance with the recommendations of the CNIL (French Data Protection Authority).

Audience measurement Cookies. These Cookies enable All in Box to compile statistics on the Site's traffic and usage, in order to improve its relevance and operation. Where these Cookies are configured in accordance with the CNIL's recommendations (audience measurement strictly limited to the publisher), they may be placed without prior consent. Otherwise, their placement is subject to the User's prior consent.

Marketing communication and personalisation Cookies. These Cookies, placed by All in Box or by third-party partners, are intended to present the User with personalised advertising, measure the performance of advertising campaigns or offer tailored content on third-party sites. Their placement is subject to the User's prior and explicit consent.

Social media Cookies. When the User interacts with social media modules embedded in the Site, Cookies may be placed by the publishers of those social networks. Their placement is subject to the User's prior consent and is governed by each publisher's own privacy policies.

3. Consent and settings

On their first visit to the Site, the User is invited, via an information banner, to express their choice regarding Cookies that are not strictly necessary. They may accept all Cookies, refuse all Cookies, or customise their choices by category.

The absence of an express choice does not constitute consent. Until the User has expressed their choice, only strictly necessary Cookies and, where applicable, audience measurement Cookies exempt from consent are placed.

The User may at any time change their preferences, withdraw or renew their consent, via the Cookie management module accessible from the Site ("Cookie preferences" link or equivalent).

4. Cookie retention period

In accordance with the CNIL's recommendations, the period of validity of the User's consent to the placing of Cookies does not exceed six (6) months. Beyond that, their consent is requested again.

The lifespan of the Cookies themselves (the period during which they remain stored on the User's device) does not exceed thirteen (13) months, in accordance with the CNIL's recommendations.

5. Browser settings

Independently of the management module made available by All in Box, the User may configure their web browser to accept, refuse or be notified of the placing of Cookies. Each browser has its own settings options, accessible from its help menu. The User is informed that refusing all Cookies, including strictly necessary Cookies, may impair the proper functioning of the Site.

6. Exercise of rights

The User has, with regard to the personal data collected via Cookies, the same rights as those mentioned in Part I (Article 9). They may exercise them under the same conditions, at the address dpo@allinbox.com.