Thank you for using Ecotropy’s services!

This Personal Data Protection Charter describes how we collect, use, process and disclose information about you, including personal data, in connection with your access to and use of the Portals.

If you encounter a term that is not defined in this Personal Data Protection Charter, that term shall have the same meaning as in our Terms of Use.

Where this Charter refers to “Ecotropy”, “we”, “our” or “us”, it refers to Ecotropy, the company responsible for the information about you in accordance with this Personal Data Protection Charter.

If you have any questions or complaints concerning this Personal Data Protection Charter or Ecotropy’s data-processing practices, you may email us at contact@ecotropy.fr or contact us by post.

1. Information collected

We request and collect the following personal data about you when you use the Portals. This data is necessary for the proper performance of the agreement between the Client and us and to enable us to comply with our legal obligations. Without it, we may not be able to provide you with all the services requested.

Account data. When you create your Account, we ask you to provide certain information, such as your first name, last name and email address.

Profile data. To use certain Portal features (such as access to health and safety logs or technical maintenance logs), we may ask you to provide additional information, which may include your telephone number and a profile photo. Telephone numbers are optional and are requested if you wish to set up SMS alerts through the ecotropy.fr service. A profile photo is optional. It is requested to make it easier to identify the different users of the service within your organisation.

When you use the Portals, we automatically collect information, including personal data, about the services you use and how you use them. This data is necessary for the proper performance of the agreement between you and us, to enable us to comply with our legal obligations, and in view of our legitimate interest in being able to provide and improve the Portals’ features.

Usage data. We collect information about your interactions with the Portals, such as the pages or content you view.

Connection and device data. We automatically collect connection and device data when you access and use the Portals, even if you have not created an Ecotropy Account or are not logged in. This data includes, among other things: information about how you used the Portals (including whether you clicked on links to third-party applications), your IP address, access dates and times, computer hardware and software information, device information, information associated with device usage, unique identifiers, crash data, cookies, and the pages you viewed or displayed before or after using our Portals.

Cookies and similar technologies. We use cookies and other similar technologies, such as web beacons, pixels and mobile device identifiers. We may also allow our business partners to use these tracking technologies on the Portals. You can disable cookies by selecting the appropriate settings in your browser. However, doing so may prevent you from using certain features of this website.

2. Use of collected information

2.0 Newsletter subscriptions and contact requests

Subscribing to the newsletter and requesting to be contacted are voluntary actions taken by the user on the ecotropy.fr portal. The double opt-in procedure verifies the identity of the person subscribing and confirms their consent. The information provided in these cases is stored solely for the purpose of establishing a business relationship.

2.1 Providing a continuous diagnostic service for building operations

When our services are used, we aggregate the data collected in buildings in order to provide our Clients with a high-quality, continuous energy diagnostic service that helps improve the operation of the buildings concerned.

Consumption, comfort, weather, occupancy, usage and operating data, as well as data entered manually by users—such as actual occupancy figures—are stored, automatically processed and compared in order to provide analyses of building operations.

These analyses are used to automatically provide information, advice and alerts about building operations, potential malfunctions in a building, part of a building or one or more of its components, and abnormal deviations in any of the measured variables.

2.2 Certifying the author of certain information

In certain services, such as the digital health and safety log, the occupancy monitoring log or technical logbooks, personal data (first name, last name and digital identifier) is used to identify the person who entered information. In connection with these services, the user who enters the information is understood to be responsible for its accuracy and relevance. As stated in the Terms of Use, Ecotropy can under no circumstances be held responsible for the content of this information.

2.3 Operating, improving and developing the Portals

• Enabling you to access and use the Portals.
• Managing, protecting, improving and optimising the services and user experience, for example by conducting analyses and studies.
• Providing customer support.
• Sending you support or service-related messages, updates, security alerts and Account notifications.
• Managing, protecting, improving and optimising the services and user experience, as well as personalising and tailoring your experience.

We process this data in view of our legitimate interest in improving the Portals and user experience, and where this data is necessary for the proper performance of our agreement with you.

2.4 Creating and maintaining a more secure, trusted environment

• Detecting and preventing fraud, spam, abuse, security incidents and other harmful activities.
• Conducting security investigations and risk assessments.
• Verifying or authenticating information or identification details you provide (for example, verifying the address of your Accommodation or comparing an identification photo with another photo you have provided).
• Complying with our legal obligations.
• Enforcing our Terms of Use and other policies.

We process this data in view of our legitimate interest in protecting the Portals, assessing the proper performance of our agreement with you, and complying with applicable laws.

2.5 Aggregated data

We may also share aggregated data (data about our users combined so that it can no longer identify or refer to an individual user) and other anonymised data for regulatory compliance, industry and market analysis, demographic profiling, business and advertising purposes, and other business purposes.

3. Your rights

3.1 Managing your data

You can update your personal data in your Account settings. You are responsible for keeping your data up to date.

3.2 Correcting inaccurate or incomplete data

You have the right to ask us to correct inaccurate or incomplete personal data about you that you cannot update yourself in your Account.

3.3 Access to and portability of data

You may request copies of the personal data you have provided to us in a structured, commonly used and machine-readable format and/or ask us to transmit that data to another service provider, where technically possible.

3.4 Data retention and deletion

In general, we retain your personal data for as long as necessary to perform the agreement between you and the Client and to comply with our legal obligations. If you no longer want us to use your data to provide the Portal services, you may ask us to delete your personal data and close your Account. Please note that, because we maintain the Portals in order to protect them against accidental or malicious loss or destruction, residual copies of your personal data may not be removed from our backup systems for a limited period of up to one (1) month. This period corresponds to the maximum interval between two software version upgrades.

3.5 Withdrawal of consent and restriction of processing

If you have given your consent to Ecotropy’s processing of your personal data, you may withdraw your consent at any time by changing your Account settings or by sending a notice to Ecotropy specifying the consent you are withdrawing. Please note that withdrawing your consent does not affect the lawfulness of any processing activity based on that consent before it was withdrawn.

In addition, in certain jurisdictions, applicable law may give you the right to restrict how we use your personal data, particularly where (i) you contest the accuracy of your personal data; (ii) the processing is unlawful and you object to the deletion of your personal data; (iii) we no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or (iv) you have objected to processing under section 6.6, pending an assessment of whether Ecotropy’s legitimate interests override yours.

3.6 Complaints

You have the right to lodge complaints concerning data-processing activities carried out by Ecotropy with the competent data protection authorities.

4. Security

We implement and continually update administrative, technical and physical security measures to protect your data against unauthorised access, loss, destruction or alteration. Some of the safeguards we use to protect your information include firewalls, encryption of authentication data (passwords), information access controls, securing servers using the SSH protocol, and securing domains using the SSL protocol.

The data host guarantees the security of the infrastructure: OVH undertakes to provide optimal infrastructure security, including by implementing an information systems security policy and meeting the requirements of several standards and certifications (PCI-DSS certification, ISO/IEC 27001 certification, SOC 1 TYPE II and SOC 2 TYPE II attestations, etc.).

If you know or have reason to believe that your Account login details have been lost, stolen, misappropriated or otherwise compromised, or if there has been or may have been unauthorised use of your Account, please email us at contact@ecotropy.fr or contact us at 34 rue du Corps de Garde, 44100 Nantes, France.

5. Changes to this Personal Data Protection Charter

Ecotropy reserves the right to make changes to this Personal Data Protection Charter at any time, in accordance with this clause. If we make a change to this Charter, we will publish the new version and update the “Last updated” date at the top of this Personal Data Protection Charter. We will also notify you of the change by email at least thirty (30) days before it takes effect. If you do not agree to the terms of the new Personal Data Protection Charter, you may delete your Account. If you do not delete your Account before the new Personal Data Protection Charter takes effect, your continued access to and use of the Portals will be subject to the new Personal Data Protection Charter.

6. Notifications in the event of a personal data breach

Ecotropy undertakes to notify all affected individuals of any breach of their personal data resulting from a failure of the company’s or one of its processors’ security systems. The breach will be reported no later than 72 hours after it becomes known. The CNIL will also be informed in accordance with the GDPR.