PROMACEO LEAN

Privacy policy

Version dated 19 October 2026

Data controller

PROMACEO SAS, A202 – 132 avenue Valéry Giscard d'Estaing, 80000 Amiens — contact@promaceo.fr. No data protection officer has been appointed; requests are handled by the President.

Data processed and purposes

Account: name, e-mail address, password (hashed with Argon2, never stored in plain text), language, date of acceptance of the terms — purpose: provision of the service, performance of the contract.

Progress: lessons opened and completed, quiz answers, scores, personal notes, certificates — purpose: performance of the contract (tracking training, issuing the certificate).

Orders: program, amount, status, Mollie payment identifier, invoice — purpose: performance of the contract and statutory accounting obligations. Card details never pass through PROMACEO.

Technical log: IP address, date, event (login, failed login, purchase) — purpose: security and fraud prevention (legitimate interest), kept for 12 months.

Marketing: only if you ticked the optional box; you can withdraw at any time from your account.

Legal basis

Performance of the contract (Article 6(1)(b) GDPR) for the account, progress and orders; legal obligation (6(1)(c)) for the retention of invoices; legitimate interest (6(1)(f)) for security; consent (6(1)(a)) for marketing.

Recipients and processors

Infomaniak Network SA (Switzerland): hosting and sending of transactional e-mails. Mollie B.V. (Netherlands): payment processing, acting as an independent controller for payment data. No data is sold or shared for advertising purposes. No transfers outside the European Union and Switzerland.

Retention periods

Account and progress: for the duration of access, then 3 years after the last login, or until the account is deleted. Invoices and order data: 10 years (French Commercial Code). Certificates: identifier, program, holder's name, score and date kept for 10 years to allow verification; you may request that your name not be published on the verification page. Technical logs: 12 months.

Your rights

Access, rectification, erasure, restriction, portability and objection: from your account (JSON export, editing, account deletion) or by e-mail to contact@promaceo.fr. We respond within one month. You may lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority, if you believe your rights are not being respected.

Cookies

Strictly necessary cookies only: lean_session (authentication, 30 days), lean_csrf (form security, 30 days), lean_lang (language, 1 year). No third-party cookies, no analytics, no advertising trackers.

Security

Encrypted connection (HTTPS), hashed passwords (Argon2id), secure HttpOnly cookies, CSRF protection, login attempt rate limiting, logging of sensitive access, encrypted backups. In the event of a data breach likely to result in a risk to your rights, you will be informed in accordance with Article 34 GDPR.