Data protection policy
Last updated: 09/07/2026
This English translation is provided for convenience. In case of any discrepancy, the French version prevails.
Article 1: Foreword
The protection of personal data is one of our major concerns. This privacy policy is part of a legal framework shaped by the European General Data Protection Regulation (Regulation EU 2016/679 of 27 April 2016), applicable since 25 May 2018, and the French Loi Informatique et Libertés no. 78-17 of 6 January 1978, as amended, on information technology, data files and civil liberties.
This data protection policy is therefore intended to inform you about:
- The controller of your personal data
- How your data is collected and processed. Personal data is any data that makes it possible to identify a natural person.
- Your rights regarding the use of your personal data
- The recipients to whom your data is transmitted
- The website's policy on cookie management
This privacy policy is complementary to the legal notice available on the website.
Article 2: Glossary
Personal data is any information relating to an identified or identifiable person, i.e. allowing that person to be identified directly (e.g. first and last name) or indirectly (e.g. cookies).
Processing of personal data is any operation or set of operations (whether automated or not) applied to personal data or sets of personal data, such as: collection, recording, organisation, storage, transmission of data (…)
The Data controller determines the purposes (the objectives of the processing) and the means of the processing.
The Data processor processes personal data on behalf of the data controller and under its instructions.
Article 3: General principles
In accordance with Article 5 of the General Data Protection Regulation (GDPR), the collection and processing of your personal data comply with the following principles:
- Lawfulness, fairness and transparency: the collection and processing of personal data may only rely on a legal basis defined beforehand (performance of a contract, legal obligation, consent, legitimate interest, protection of vital interests)
- Purpose limitation: personal data is collected and processed to meet one or more defined objectives
- Data minimisation: only the data strictly necessary for the proper achievement of the objectives pursued is collected
- Limited storage period: the data controller is required to define retention periods for the personal data it processes
- Integrity and confidentiality of the data collected and processed: the data controller undertakes to guarantee the integrity and confidentiality of the data collected.
- Accuracy of the data: the data controller undertakes to take all reasonable steps to keep the data it processes up to date, so as to correct inaccurate data and delete obsolete data.
Article 4: Data controller and data processor
As data controller, PROXY PAPERS DEVELOPPEMENT undertakes to comply with the obligations arising from the Regulation and from the amended Loi Informatique et Libertés (the French Data Protection Act) regarding the collection and processing of personal data. In accordance with Article 32 of the GDPR, we implement all technical and organisational measures to ensure the protection of your personal data.
As data processor, PROXY PAPERS DEVELOPPEMENT undertakes to process the client's personal data only insofar as necessary for the performance of the contract entered into. PROXY PAPERS DEVELOPPEMENT has included a data-processing clause in its contracts.
Article 5: Personal data collected and processed: what data?
In accordance with the principle of data minimisation, we only collect the data necessary to carry out our assignments. Thus, in the context of our services, PROXY PAPERS DEVELOPPEMENT may collect and process the following information:
| Category | Data |
|---|---|
| Identity | Last name, first name, age, date of birth, gender, place of birth |
| Professional life | Qualifications, job, place of work, degree, employment contract |
| Connection data | Login credentials, temporary passwords |
| Personal life | Address, children, personal telephone number, marital status. |
| Financial information | Payslips, bank account details (RIB), banking data, taxes |
| Internet | IP address, connection history |
We do not collect any sensitive data such as religion, trade union membership, racial or ethnic origin, criminal convictions or health-related data. Should sensitive data be uploaded to the Papers Box, PROXY PAPERS DEVELOPPEMENT cannot be held liable for such uploads.
Article 6: Personal data collected and processed: for what purposes?
In all of these situations, PROXY PAPERS DEVELOPPEMENT acts as a “data controller” within the meaning of the GDPR.
| Data collected | Reasons for collection | Legal basis | Retention period |
|---|---|---|---|
| BROWSING THE WEBSITE: Identity, Personal life, Connection data, Location, Internet | We use this data to: Send you commercial communications (if you have asked us to); Send you our quotes (if you have asked us to); Contact you when you fill in the contact form; Sign you up to the newsletter (if you have asked us to); Respond to your request for an information meeting (if you have asked us to); Register you on the Papers Box (if you have asked us to); Process your order | Consent | Your browsing data on our website is kept for a maximum of 13 months. Data collected through online forms is kept for 3 years from collection or from the last contact initiated by the prospect. |
| Offer you personalised services; Monitor and improve our website and our Proxy Papers Box platform; Carry out audience analyses or compile statistics; Secure our website and platform and protect both you and us against fraud. | Legitimate interest | ||
| CUSTOMER RELATIONSHIP MANAGEMENT: Identity, Personal life, Professional life, Financial information, Connection data, Location | We use this data to: Manage the business relationship; Manage your subscription requests for Proxy Papers plans; Manage payments and invoicing following orders; Answer your questions and interact with you in any other way | Performance of a contract | Data is kept for the duration of the business relationship and for 5 years after it ends. Invoices are kept for 10 years. For commercial communications sent with your consent, your data is kept until you unsubscribe. |
| Send you commercial communications (if you have asked us to) | Consent | ||
| Offer you personalised services; Monitor and improve our website and platform; Carry out audience analyses or compile statistics; Secure our website and platform and protect both you and us against fraud; Protect transactions against fraud; Handle any dispute relating to a purchase; Send you informational communications | Legitimate interest | ||
| COMMERCIAL COMMUNICATIONS: Identity, Personal life, Professional life | We use this data to: Send you commercial communications (if you have asked us to) | Consent | Data is kept until the person concerned unsubscribes (via the unsubscribe link included in the newsletters) |
| Carry out audience analyses or compile statistics; Send you informational communications | Legitimate interest | ||
| Keep an up-to-date suppression list if you have asked not to be contacted | Legal obligations | ||
| PROVISION OF SERVICES: Identity, Personal life, Professional life, Financial information, Connection data, Internet | We use this data to: Perform the service for which you engaged us; Assist you with the administrative procedures of private life: day-to-day management, insurance, loans, retirement, property projects, claims, loss of autonomy...; Sort your documents; Digitise all of your personal documents; File your documents in an online digital safe made available to you (PAPERS BOX); Remind you of upcoming deadlines; Make your documents accessible to you from the Papers Box at any time and from anywhere. | Performance of the contract | Data is kept for the duration of the business relationship and for 5 years from the end of the business relationship. For all documents stored in the PAPERS BOX, your confidential documents are kept throughout the business relationship. At the end of the contract, you have 2 months to retrieve the documents and data uploaded to the platform by exporting them in HTML format. |
In the context of its services, PROXY PAPERS DEVELOPPEMENT acts as a “data processor” on behalf of its professional clients:
| Data collected | Reasons for collection | Legal basis | Retention period |
|---|---|---|---|
| HOSTING AND SUPPORT OF THE PAPERS BOX: Identity, Personal life, Professional life, Connection data, Internet | We use this data to: Host your client data under the terms of a client contract; Provide data support following any complaints you may have; Handle issues relating to the use of the Papers Box; Make the Papers Box available to you in SaaS mode at any time; Make all of your previously digitised documents stored in the Papers Box accessible to you | Performance of the contract | Data is kept for the duration of the business relationship and for 5 years after the end of the business relationship. For all documents stored in the PAPERS BOX, your confidential documents are kept throughout the business relationship. At the end of the contract, you have 2 months to retrieve the documents and data uploaded to the platform by exporting them in HTML format. |
| Carry out statistical analyses; Monitor and improve the Papers Box platform; Carry out updates to the Papers Box; Ensure the security of the Papers Box in order to guarantee the integrity, confidentiality and security of the hosted data | Legitimate interest |
Article 7: Personal data: who has access to your personal data?
PROXY PAPERS DEVELOPPEMENT undertakes to transmit your personal data only to duly authorised persons internally and to authorised third parties such as the tax, customs or economic authorities, the courts, the police and gendarmerie, or the social action and health authorities.
PROXY PAPERS DEVELOPPEMENT may, where applicable, transmit your personal data to processors for the hosting of the website, the CRM and the Papers Box, or for the management of its IT tools and accounting (an accounting firm, for example). The use of these providers is necessary for the proper delivery of our services. We undertake to verify and guarantee their compliance with the GDPR and the amended Loi Informatique et Libertés.
Apart from the recipients mentioned above, PROXY PAPERS DEVELOPPEMENT undertakes not to transmit your personal data to third parties or external organisations without your express consent.
PROXY PAPERS DEVELOPPEMENT does not and will not sell, assign or communicate your personal data to unauthorised third parties.
PROXY PAPERS DEVELOPPEMENT does not use any automated decision-making based on your personal data. No profiling is carried out during processing, and the data we collect will never be used without human intervention.
Article 8: Your rights
8.1 Your rights
In accordance with the applicable regulations, you have the following rights regarding your personal data:
- RIGHT OF ACCESS — You may, at any time, access the personal data we hold about you.
- RIGHT TO RECTIFICATION — If you notice an error, omission or ambiguity in your personal data, you may submit a request to complete, correct or clarify your personal information.
- RIGHT TO OBJECT — You retain, at any time, the right to object to the use of your personal data in connection with the activities carried out by our company with regard to the processing of your data.
- RIGHT TO RESTRICTION — You may request the restriction of future processing of your personal data under certain conditions.
- RIGHT TO ERASURE — You may also ask us to delete your personal data.
- RIGHT TO DATA PORTABILITY — You have the right to receive the data concerning you in a structured, commonly used and machine-readable format. You may also request that we transmit your personal data to another organisation.
- DIGITAL DEATH — You may decide what happens to your digital personal data after your death.
8.2 Internal contact
To exercise your rights, you can contact us by email at the following address: privacy@proxy-papers.fr
In accordance with the GDPR, PROXY PAPERS DEVELOPPEMENT reserves the right to charge a reasonable fee reflecting the administrative costs incurred in providing the information, making the communications or taking the measures requested. PROXY PAPERS DEVELOPPEMENT also reserves the right to refuse to act on any manifestly unfounded or excessive request, informing you of the reasons for the refusal.
8.3 Complaints to the CNIL
You may, at any time, lodge a complaint with the competent authority, namely the Commission Nationale de l'Informatique et des Libertés (CNIL), via the following link: https://www.cnil.fr/fr/plaintes.
Article 9: Security measures
PROXY PAPERS DEVELOPPEMENT cares about the security of the personal data it processes, which it undertakes to handle securely and only for as long as necessary to achieve the purpose pursued.
PROXY PAPERS DEVELOPPEMENT has implemented technical and organisational measures to ensure a level of data protection appropriate to the nature and purpose of the processing.
Thus, in accordance with Article 32 of the GDPR on the security of processing, PROXY PAPERS DEVELOPPEMENT has put in place:
- Measures to guarantee the ongoing confidentiality, integrity, availability and resilience of processing systems and services
- Measures to restore the availability of and access to data within an appropriate timeframe in the event of a physical or technical incident;
- A procedure for regularly testing, analysing and evaluating the effectiveness of the technical and organisational measures for ensuring the security of the processing.
The security obligation nevertheless remains a best-efforts obligation, meaning that we do everything in our power to guarantee the confidentiality and integrity of your personal data.
Everyone with access to your personal data has been made aware of data protection best practices. They are bound by a confidentiality obligation and face disciplinary sanctions in the event of non-compliance.
Article 10: Data transfers outside the European Union
In the course of our business and for the handling of your requests, we do not transfer your data outside the European Union.
However, should your personal data be transmitted outside the European Union, we will ensure that the countries concerned guarantee a sufficient and appropriate level of data protection.
We undertake to inform you in advance of any potential data transfers outside the European Union and to communicate the safeguards put in place to ensure a sufficient and appropriate level of protection.
Article 11: Cookies
Like most websites, our website uses cookies. If you wish to limit your digital footprint, we recommend refusing them by default via the cookie management banner we have set up on our website.
You will also find in our cookie policy the procedure to follow to accept, customise or refuse cookies by expressing your choice using the banner that appears on your screen.
Article 12: Updates to the data protection policy
This personal data protection policy may change over time.
It was last updated on 09/07/2026.
See also