Last update: October 2025

This policy describes how elloha SAS collects, uses, stores and protects your personal data when you use theelloha website and all its sub-domains (e.g. https://app.elloha or any sub-domain of theelloha typeelloha(hereinafter the Website). It also explains your right to object, your rights of access, rectification, deletion, limitation, portability, and withdrawal of consent, as well as our rules relating to cookies.

We may modify this policy to reflect legal or technical developments; the update date above attests to this. By continuing to use the Site after publication, you accept the current version; we invite you to consult it regularly.

1) Data controller & DPO

elloha SAS - 2 bis, rue Fabrique d'en Nabot, 66000 Perpignan, France
Privacy contact/DPO:elloha(or by post to the above address, "for the attention of the DPO").

2) Data we collect

Identification and contact data: surname, first name, email, telephone, company, job title.

Browsing/technical data: logs, equipment identifiers, pages consulted, application events, preferences.

Contractual and support data: information about your subscriptions/orders, exchanges with support.

Marketing data: communication preferences, participation in our events, responses to our forms (newsletter, white papers, etc.).

The mandatory or optional nature of the fields is specified at the time of collection. Failure to provide the mandatory fields may result in certain services not being rendered.

3) Purposes & legal basis (RGPD art. 6)

Provision of Site, applications and support (account creation/management, assistance, security, billing, fraud prevention) - performance of contract and legitimate interest (security, service improvement).

Sending of requested information (white papers, demonstrations, documentation) - execution of pre-contractual measures.

Prospecting/Newsletter (containing news, professional content, offers) - consent (opt-in, can be withdrawn at any time).

Audience measurement & Site/product improvement - consent via our cookies banner (excluding strictly necessary cookies).

Legal obligations (accounting, taxation, responding to authorities) - legal obligation.

Where we rely on legitimate interest, we ensure that your fundamental interests and rights prevail where necessary (documented balancing tests).

4) Recipients & subcontractors

Your data is processed by our authorized teams and by service providers (hosting, emailing, analytics, support, payment) acting onelloha's instructions, bound by contract (DPA) and subject to security and confidentiality obligations. We do not sell your data.

5) Transfers outside the EU

Where processing involves a transfer to third countries, we use one of the following mechanisms:

Adequacy decision (e.g. EU-US Data Privacy Framework - DPF of July 10, 2023, confirmed by the EU General Court on September 3, 2025);

Standard contract clauses (SCCs) + additional measures if necessary.
‍

6) Shelf life

We keep your data for as long as is strictly necessary for the purposes for which it is to be used, and then archive/delete it in accordance with legal requirements:

Prospects: 3 years after last active contact (open email/click, form, appointment).

Customers/contracts: duration of relationship, then legal archiving (up to 10 years for accounting purposes).

Technical logs: up to 6 months, except for security reasons.

Cookies: see §11 (specific durations).

7) Safety

We implement appropriate technical and organizational measures: access control, encryption in transit/at rest as appropriate, logging, segmentation, regular testing, authorization management and an incident response plan.

8) Your rights

In accordance with the RGPD and the "Informatique & Libertés" law, you have the following rights, subject to conditions:

Access to your data; rectification; deletion ("right to be forgotten"); limitation; portability (structured format); opposition (in particular to canvassing); withdrawal of consent at any time; right not to be the subject of a fully automated decision, including profiling, producing legal effects.
How to exercise your rights:elloha or postal address (see §1). We may ask you for proof of identity if necessary. Response time: 1 month (extendable by 2 months for complexity/volume). You can also lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes

9) Children

Our services are aimed at professionals/adults. We do not knowingly collect data from children; if a parent or guardian believes that a child has provided us with data, they can contact us for deletion.

10) Cookies & similar technologies
10.1 Principles

Non-essential cookies (audience measurement, personalization, etc.) can only be deposited/read with your consent, which you can accept, refuse or personalize at any time. Refusal must be as simple as acceptance; continued browsing does not imply consent. We keep a record of your choice and periodically ask for your consent.

Cookies strictly necessary for Site operation (authentication, load balancing, security, shopping cart, language preference) are deposited without consent.

Recommended durations: lifetime of a non-essential cookie ≤ 13 months; retention of choice (consent/refusal) generally 6 months before re-solicitation.

10.2 Categories of cookies

Essentials (consent-free): session authentication, anti-fraud, load balancing, interface preference.

Audience measurement (subject to consent): traffic and performance statistics. NB: in France, the configuration of audience measurement tools must comply with CNIL guidelines; certain parameters and transfers to third countries may require additional guarantees.

Personalization (consent).

Social networks / sharing (consent): embedded buttons and content.

Up-to-date details (publisher, purpose, duration) are available in our Cookie Preference Center (link in banner and footer).

10.3 Parameter setting

You can modify your choices at any time via our Preference Center or from your browser (note: global blocking may degrade the experience). Browser help links are provided in the Preference Center.

11) Marketing communications

We will only send you e-mail marketing with your prior consent (opt-in), or in cases where B2B is permitted, and always with the possibility of unsubscribing easily.

Unsubscribers are placed on a suppression list; they are not recontacted by email marketing without explicit re-permission (double opt-in recommended).

12) How to contact us

For questions or to exercise your rights:elloha

For complaints, the competent authority is the CNIL: https://www.cnil.fr/fr/plaintes

‍