Privacy policy

1. Controller

BBX MEDIA, French SAS with €1,000 share capital, 5 rue de l’Industrie, 74000 Annecy, France. Privacy contact: [email protected].

2. Data processed

Depending on interaction: professional identity, company, role, contact details, diagnostic answers, proposed plan, booking reference, messages, onboarding information, definitions of the three agents, scope, approvals, acceptance cases, support requests, quotations, orders, invoices, language preference, a pseudonymised IP reference for abuse prevention, technical logs and rights-request information. The portal does not request passwords, API keys, full banking details or sensitive data.

3. Purposes and legal bases

Enquiries and quotations: pre-contractual steps. Orders, billing, support and handover: contract performance. Accounting and legal records: legal obligation. Security, abuse prevention and legal claims: legitimate interests. Relevant B2B outreach: legitimate interests with a free right to object.

The website does not make solely automated decisions producing legal effects.

4. Required data

Required data is identified when collected. Without it, BBX MEDIA may be unable to reply, quote or perform a service.

5. Recipients and providers

Authorised BBX MEDIA personnel and necessary hosting, CDN/security, email and backup providers may access data. The website and portal are hosted by Hetzner Online GmbH in Germany and protected/distributed by Cloudflare. Bookings are processed by Cal.com and the selected conferencing service under their own policies. Initially, quotations and billing are handled manually outside the portal. Prospect files are not sold.

6. International transfers

Some providers, including Cloudflare, may process data outside the EEA. BBX MEDIA relies on an adequacy decision or appropriate safeguards such as standard contractual clauses, with further information available on request.

7. Retention

Diagnostics and unconverted prospects: twelve months after the last contact, unless deleted earlier on request or a specific justified need applies. Active customer files: for the relationship; contracts and correspondence needed as evidence are then retained for five years. Invoices and accounting records: ten years after financial year-end. Support tickets and operational audit: normally twelve months unless an incident or duty applies. Pseudonymised abuse-limit keys: about one hour. Portal backups: thirty days. Objection records: at least three years.

8. Your rights

You may request access, correction, deletion, restriction, applicable portability, or object to legitimate-interest processing. Consent may be withdrawn without retroactive effect. Contact [email protected]. Identity evidence is requested only where there is reasonable doubt.

9. Complaint and security

You may complain to the French CNIL at cnil.fr. BBX MEDIA applies proportionate access control, permission limits, backups and updates, though no system is risk-free.

10. Customer data

When BBX MEDIA accesses personal data in a customer environment to configure agents, the customer is generally controller and BBX MEDIA processor. A GDPR Article 28 agreement must be signed before access; this policy does not replace it.

11. Changes

The version date appears above. Material changes are communicated appropriately.