Privacy Policy — EPIC PERSONA®

1. Who processes your data?

The data controller is:

Association FRANCE PLAIDOYER
40 Allée de la Chapelle, 38890 Vignieu, France
Email: contact@epic-persona.com

Contact person for questions relating to personal data:
Mr. Emeric Vallespi, President of FRANCE PLAIDOYER

2. Who is this policy for?

This policy applies to individuals who use EPIC PERSONA®, including:

website visitors;
individuals who take the free test;
individuals who request that their result be sent by email;
users with an account;
premium customers;
B2B contacts;
individuals subscribed to marketing communications, where they have consented to them.

Additional terms may later be published for B2B offers, teams, coaches, or certified practitioners.

3. What data may we process?

Depending on how you use the service, we may process in particular the following categories of data:

Identification data

first name;
last name;
email address;
technical identifiers linked to the account or session.

Test-related data

test responses;
free results;
herotype and derived characteristics;
premium report and history of its availability.

Technical data

session identifiers;
technical logs;
security information;
IP address or equivalent elements necessary for security, abuse prevention, or provision of the service;
information relating to cookies and trackers, depending on the choices you make.

Payment and order data

information relating to the purchase;
payment status;
technical transaction identifiers;
order history;
information necessary to activate premium access.

We describe here only the categories necessary to understand the service. The technical details evolve with the product.

4. Why do we use your data?

4.1 To provide the website and the test

We process certain data in order to enable:

access to the website;
operation of the test;
progress through the user journey;
display of the result;
technical security.

4.2 To send the result by email

If you choose to receive your result by email, we use the data necessary to send it to you and, depending on the user flow offered, to associate your result with an account.

4.3 To manage your account

If you create or use an account, we process the data necessary to:

authenticate you;
associate your result with your account;
allow you to access your history;
secure your access.

4.4 To manage the premium purchase

We process the data necessary to:

create the order;
collect payment through our service provider;
activate the premium report;
manage access to the report and the retake window;
handle complaints relating to the order.

4.5 To respond to your requests

We may use your data to process:

your requests for information;
your requests to exercise your rights;
your complaints;
your reports.

4.6 To improve the service

We may use certain data to:

understand how the product is used;
detect errors;
improve the quality, usability, or security of the service;
produce general statistics.

Whenever possible, these uses rely on aggregated data, technical data, or data limited to what is strictly necessary.

4.7 Marketing and communications

We may send you informational messages, lead-nurturing communications, or newsletters:

in B2C, only where permitted by law and, where applicable, on the basis of your consent;
in B2B, under the conditions permitted by applicable regulations.

We do not address here the sending of offers from third-party partners: as of today, that is not one of the purposes pursued.

5. Legal bases

Depending on the circumstances, we process your data on one or more of the following legal bases:

performance of a contract or pre-contractual measures;
compliance with a legal obligation;
our legitimate interest, in particular for security, abuse prevention, evidentiary purposes, maintenance, and service improvement;
your consent, where required, in particular for certain marketing emails or certain trackers.

6. Is providing the data mandatory or optional?

Certain data are necessary in order to:

take the test under proper conditions;
send a result by email;
create an account;
purchase premium access;
secure the service.

Where certain information is mandatory, this is indicated at the time of collection.
If you do not provide certain data that are necessary, we may be unable to provide the requested feature.

7. Recipients of the data

Your data may be accessible, on a need-to-know basis, to:

the authorized FRANCE PLAIDOYER team;
our technical service providers or processors;
our payment service providers;
our transactional email service providers;
our hosting, security, or observability service providers;
legally authorized authorities where we are required to do so by law.

As of today, the technical tools identified within the scope of the service include, in particular, components such as Stripe, Brevo, Sentry, and the website's hosting / infrastructure with OVH.

9. Transfers outside the European Union

Some of our technical service providers may be located outside the European Union or may process certain data from third countries.

Where such transfers exist, they must be governed in accordance with applicable regulations, in particular by mechanisms recognized under the GDPR, such as appropriate contractual clauses where necessary.

10. How long do we keep your data?

We apply the principle of limited retention.

10.1 Leads without an account and requests for results by email

We retain data relating to prospects or result requests for a maximum period of 36 months from the last meaningful contact or the last relevant interaction, unless a legal obligation applies or an earlier erasure request is validly made where applicable.

10.2 Free accounts

In the event of prolonged inactivity, we may delete or anonymize account data after 36 months of inactivity.

10.3 Premium accounts and premium reports

Data relating to the premium account and access to the premium report are retained for 60 months (5 years) from the date of purchase, subject to:

legal retention obligations;
evidentiary requirements;
valid erasure requests;
applicable technical or litigation-related constraints.

10.4 Marketing data

Data used for marketing purposes are retained in compliance with applicable regulations and, where no other retention basis applies, for a maximum period of 36 months from the last meaningful contact.

10.5 Data necessary for evidentiary purposes, security, or legal obligations

Certain data may be retained for a longer period where required by law or where necessary for the establishment, exercise, or defense of legal claims.

11. Your rights

Depending on your situation and within the limits provided by law, you have the following rights:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to object;
right to data portability where that right applies;
right to withdraw your consent at any time where processing is based on consent;
right to define instructions regarding the fate of your data after your death, where permitted under French law.

To exercise your rights:
contact@epic-persona.com

You may also lodge a complaint with the CNIL if you believe that your rights are not being respected.

12. Commercial solicitation

12.1 B2C

For individuals, we do not send commercial solicitation by email where consent is required without complying with that legal framework.

12.2 B2B

For professionals, certain communications may be sent within the limits provided by applicable regulations, in particular where they relate to the recipient's professional activity.

12.3 Unsubscribe

Each marketing communication must allow you to unsubscribe easily.

13. Minors

The website may be viewed by minors.

A minor may purchase premium access only if he or she has the necessary legal capacity or acts through his or her legal representative where required by applicable law.

Parents or legal representatives may contact us with any question relating to a minor's situation: contact@epic-persona.com

14. Important decisions and sensitive uses

The EPIC PERSONA® service must not be used as the sole basis for a sensitive decision concerning a person, particularly in matters of recruitment, evaluation, disciplinary action, or career management.

The service is designed as an informational and analytical tool, and not as an automated decision-making system that by itself produces a legal effect or a similarly significant effect.

15. Security

We implement appropriate technical and organizational measures in order to protect data against unauthorized access, loss, alteration, disclosure, or misuse.

Because no security measure is absolute, we cannot, however, guarantee perfect security in all circumstances.

16. Cookies and trackers

To learn more about the cookies and other trackers used on the website, please consult our Cookie Policy.

17. Changes to the policy

This policy may be updated to reflect:

changes to the service;
changes to processing activities;
changes to the law;
changes to our tools.

The applicable version is the one published on the website on the date it is consulted.

Privacy Policy - EPIC PERSONA®