Privacy policy

Our privacy policy is presented in question and answer form. It sets out concisely the personal data in our possession and how we use and process it. It also summarizes your specific rights as regards personal data and explains how you can exercise them.

Who is responsible for processing my personal data (data controller)?

The data controller is: Hexaly, 251 Boulevard Pereire, 75017 Paris, France.

RCS Paris 499 282 143

Why do you need my personal data?

We use your personal data to:

  • To manage your user account and to provide the services available on the Hexaly website;
  • To allow you to contact us;
  • To communicate with you when you wish to exercise your rights.

What is the legal basis for using my personal data?

We process your personal data as they appear on this website based on your consent to this personal data policy.

How did you obtain my personal data?

We obtained personal data about you from the following sources:

  • The data you provided us with when you created your account;
  • The data you provided us with when you contacted us;
  • The technical data related to the use of this website(IP address and cookies).

What types of personal data about me do you collect?

We process the following types of data:

  • Name,
  • Email address,
  • Organization,
  • Position,
  • Country,
  • City,
  • Cookies,
  • IP address.

Do you use a service provider (sub-contractor) to process my data?

All personal information you enter during registration is only processed by our teams and is not resold or transmitted in any way to third parties.

However, your connection data, your browsing on our pages and your IP address are also recorded by third party services such as Google Analytics, LinkedIn or Hubspot. These services cross-reference your data across all websites where these cookies are present. They record your activity and your IP address. Other personal information such as your identity, your login data or other information entered during your registration on our site are never transmitted to them.

You can deactivate the tracking of these third party services at any time by using our Cookie manager. This manager can be accessed by clicking on the “Cookies” link located at the bottom of every page on our website.

Do you use cookies or other tracking technologies?

We use cookies to access or store information. Some cookies are required for technical reasons in order for our Websites to operate, and we refer to these as “required” or “strictly necessary” cookies. They can’t be deactivated. We also use third parties for analytics purposes. You can control these third party cookies at any time by using our Cookie manager. We currently use 3 tracking services: Google Analytics, Hubspot and LinkedIn.

Do you hold any sensitive data[1] about me?

No. We do not collect sensitive data about you.

Do you transfer my personal data outside the European Union[2]?

No. We do not transfer your personal data outside of the European Union.

Where is my personal data stored?

Your personal data is stored in the European Union (in France).

How long do you keep my personal data?

The data related to your user account is kept until deactivation of your account. Your account may be deactivated at your request and at any time. The technical data related to the use of the website is kept up to 13 months.

Will my personal data be used for automated decision-making or profiling[3]?

No.

What are my rights as regards my personal data?

As an individual, you have the following rights as regards your personal data:

  1. Right of access
    You may ask us directly: whether we hold personal information about you; and to send you all the personal data we hold about you. You can exercise this right of access to check whether the information is correct and, if necessary, ask us to rectify or erase it if it is incorrect or out of date.
  2. Right to rectification
    You can ask us to rectify any incorrect information about you. This will avoid us passing on or processing incorrect information.
  3. Right to erasure
    You can ask us to erase your personal data for the reasons permitted by law.
  4. Right to object
    You can object to your personal data being passed on, transferred or retained, for legitimate reasons.
  5. Right to restrict processing
    You can ask us to temporarily stop processing your personal data for the reasons permitted by law.
  6. Right to data portability
    You may retrieve part of your personal data in an open, machine readable format (electronic file). You can then store or move your personal data easily from one IT environment to another for re-use.
  7. Right to withdraw consent to processing at any time
    (so long and when such processing is based on your consent).
  8. Right not to be the subject of an automated decision
    The right not to be the subject of a decision based exclusively on automated processing includes profiling and generally any processing operation producing legal effects concerning you or significantly affecting you in a similar way. However, your right does not apply when the decision made as a result of the automated decision: (i) Is necessary for the conclusion or performance of a contract between you and a controller, (ii) Is authorized by European Union law or French law, which also provides for appropriate measures to safeguard your rights and freedoms and your legitimate interests, or (iii) Is based on your explicit consent.
  9. Post-mortem rights

N.B.: These are not absolute rights. You may exercise them within the applicable legal framework and within the limits of those rights. In some cases, we may refuse your request (legal requirement, compliance with our commitments to you, etc.). If we do, we will inform you on the reason of this refusal. For further information about your rights, you may consult the CNIL’s website: https://www.cnil.fr/fr/comprendre-vos-droits.

What happens if I object to my personal data being processed or if I withdraw my consent?

Some data is required in order to retain a user account. If you object to this data being processed or if you ask for it to be deleted, you can no longer use the Hexaly website.

How do I exercise my rights and who should I contact?

If you wish to exercise your rights, please contact Hexaly:

E-mail: contact@hexaly.com

Or you can contact Hexaly by mail at the following address: Hexaly, 251 Boulevard Pereire, 75017 Paris, France.
In case of difficulty, you can also make a complaint to the competent control authorities. In France, this is the CNIL (https://www.cnil.fr/fr/agir).

[1] Sensitive or specific data is defined as:

  • Personal data about one’s racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, membership of a trade union, genetic data, biometric data for unique identification of a person, physical or mental health or condition, sexual life or orientation; and
  • Details about criminal offences and court sentences.

[2] As at 1st January 2024, the European Union member countries are: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Ireland, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Spain, Slovakia, Slovenia and Sweden.

[3] Profiling means any form of automated processing of personal data to evaluate certain things about an individual, for example to analyse or predict their performance at work, financial position, health, personal preferences, interests, reliability, behaviour, location and travel.