Privacy policy

This is a translation. In case of discrepancy, the French version prevails.

Data controller

The controller of the personal data collected on the Platform is RG Solutions, 41 rue de Fontenay, 92220 Bagneux, France. No data protection officer has been appointed; any request concerning personal data should be sent to support@europepacker.com.

Data collected

• Account: email address, first and last name, chosen language. The password is managed by our identity provider and is never stored in plain text.
• Company (professional users): company name, SIREN, EU VAT number and the result of its verification, address, role of each member.
• Invitations: email address of the invited person, proposed role, date of acceptance.
• Transactions: orders, quotes, requests for quotation and their attachments, sample requests, reviews, messages exchanged through the Platform.
• Payment: no card data is stored by the Platform; entry and processing of the payment method are handled by the payment provider.
• Evidence: acceptance of the conditions (document, version, date, IP address, browser) and log of sensitive actions on accounts and companies (author, action, date).
• Technical: login session, log of emails sent.

Purposes and legal bases

• Performance of the contract (Art. 6(1)(b) GDPR): creation and management of accounts and companies, invitations, processing of orders, quotes and requests for quotation, matchmaking, notifications, payment.
• Legal obligation (Art. 6(1)(c)): invoicing and retention of accounting documents, verification of the EU VAT number, traceability of professional sellers (DSA).
• Legitimate interest (Art. 6(1)(f)): security of the service, fraud prevention, evidence of acceptances and sensitive actions, handling of reports of illegal content.
• Consent (Art. 6(1)(a)): no processing currently relies on consent; only strictly necessary cookies are set (see the cookie policy).

Recipients and processors

Data is accessible to authorised staff of RG Solutions and, as far as they are concerned, to the companies you deal with on the Platform (the supplier receives the information needed to fulfil your order). The following providers process it on our behalf, under a contract compliant with Article 28 GDPR:

• OVH SAS (France) — hosting of the application, databases and files.
• Resend — sending of transactional emails, from its European infrastructure.
• Google (Google Workspace) — mailbox of the address support@europepacker.com.
• Stripe — payment processing, once this feature is opened.

SIREN and VAT numbers are checked against public sources: the French administration's "Recherche d'entreprises" API and the European VIES system.

Transfers outside the European Union

Some providers belong to groups established outside the European Union (Resend, Google, Stripe). Where data may be transferred outside the Union, such transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision.

Retention periods

• Account and company: for the whole contractual relationship. When the account is deleted, personal data is erased or anonymised, except data the law requires to be kept.
• Invoices and accounting documents: 10 years (French Commercial Code).
• Evidence of acceptance of the conditions and log of sensitive actions: for the life of the account, then for the applicable limitation period (5 years), as evidence.
• Log of emails sent: 90 days.
• Invitations: 30 days after their acceptance, revocation or expiry.
• Login session: until logout or expiry of the session.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions regarding your data after your death. You can delete your account yourself from your account area. These rights are exercised with support@europepacker.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

Security

Communications are encrypted (HTTPS). The session is represented by a cookie that browser scripts cannot access; access tokens remain on the server, encrypted. Access to a company's data is restricted to its members, according to their role. Private attachments are only served after an authorisation check, on every request.