Personal data protection policy

The data controller is Muriel Blind, publisher of the Service, who may be contacted at the email address contact@feir.io. No data protection officer has been appointed, as the scale and nature of the processing do not require one.

Members' data: first name, last name, email address, LinkedIn profile if provided, chosen language; declared collaborations (company, period, description of the work); for each collaboration, the first name, last name, position and email address of the named Referee and the personal message addressed to them; share links created, Recipients' email addresses and the dates on which links were opened. This data is processed for the purpose of providing the Service, namely building the Member's references and disclosing them to the persons the Member designates.

Referees' data: answers to the questionnaire, name, email address, LinkedIn profile if provided. The email address is used to verify the origin of the Reference and to enable the Referee to request its correction or withdrawal. It is neither disclosed to Recipients nor used for any other purpose.

Measurement and security data: questionnaire steps reached and the corresponding timestamps; landing page and campaign of origin of a sign-up; IP address of sign-in requests, for the purpose of rate limiting; IP address of share-link openings; visit statistics containing no persistent identifier.

No data is sold, rented or disclosed to third parties for their own purposes, nor used for marketing. The Service carries out no profiling and no automated individual decision-making.

Processing is based on the following legal bases:

• performance of a contract (Article 6(1)(b) GDPR), for Members' data, the contract being constituted by the terms of use accepted when the space is created;
• consent (Article 6(1)(a)), for Referees' data, given when the questionnaire is submitted and withdrawable at any time by withdrawing the Reference, without affecting the lawfulness of prior processing;
• the legitimate interest of the Member and of the controller (Article 6(1)(f)), for sending a reference request to the named person, who is informed from the first email and may object, and for Recipients' data, visit statistics and security logs;
• compliance with legal obligations (Article 6(1)(c)), for handling requests to exercise rights and reports of content.

Data is retained for the following periods:

• the Member's space and the data attached to it: for the duration of use of the Service; after three years without a sign-in, the Member is informed by email and the space is deleted one month later if no sign-in has occurred;
• Reference: for the retention period of the space of the Member who collected it, unless withdrawn earlier by the Referee;
• contact details of a person named as Referee who has not answered: twelve months from the request; the collaboration declared by the Member is retained without those details;
• emails sent by the Service: twelve months at most in the sending mailbox;
• IP addresses of sign-in requests: thirty days; IP addresses of share-link openings: twelve months;
• visit statistics: no identifier is retained beyond the day.

Deletions are carried out by the controller on a monthly basis. Deletion requests made by data subjects are handled without waiting for that cycle.

The following have access to data, to the extent required: the controller, for the purpose of providing the Service and handling requests; the Member, for their own data and the References they have collected; the Recipients designated by the Member, for the References shared with them, excluding the Referee's email address.

The following processors process data on behalf of the controller, under a contract compliant with Article 28 GDPR:

• Vercel Inc. (United States): hosting of the Website and execution of server code;
• Supabase, Inc.: database and delivery of sign-in links; data is stored on servers located in the European Union;
• Google (Google Workspace): the contact@feir.io mailbox, used to send reference requests and to receive Users' messages;
• Resend, Inc. (United States): delivery of the sign-in emails issued by Supabase.

Data is disclosed to no other recipient, save where required by law, in particular upon a lawful request from a competent authority.

Some processors are established in the United States. The corresponding transfers are governed by the adequacy decision relating to the EU-US Data Privacy Framework, to which Vercel Inc. states that it adheres, and by the standard contractual clauses adopted by the European Commission.

The Website uses no tracker subject to the User's prior consent within the meaning of Article 82 of French Law No. 78-17 of 6 January 1978; accordingly, no consent banner is displayed. The following mechanisms are in place:

• a session cookie, set only upon signing in to the Member's space or to the administration interface, containing the sign-in token, inaccessible to scripts and retained until sign-out (four hours at most for the administration interface); this cookie is strictly necessary for the provision of the Service;
• a browser session storage item (sessionStorage) named feir_attribution, retaining the landing page and campaign of origin for the duration of the visit, solely for the purpose of attributing a sign-up to its origin, and deleted when the tab is closed;
• an audience measurement tool, Vercel Web Analytics, which uses no cookie; visits are counted from a hashed identifier renewed daily, allowing no tracking from one day to the next or across websites; the data collected is the page viewed, the referring website, the country and the device type.

The Website contains no advertising cookie, no social network module and no third-party browsing tracker.

In accordance with Articles 15 to 22 GDPR, every data subject has the following rights:

• the right of access to the data concerning them and to obtain a copy of it;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure, the Referee being able to withdraw their Reference, the Member to request the closure of their space and the named person to request the deletion of their contact details;
• the right to restriction of processing;
• the right to object to processing based on legitimate interest, in particular to receiving a reference request;
• the right to withdraw consent at any time, without affecting the lawfulness of prior processing;
• the right to portability of the data provided, in a structured, commonly used and machine-readable format.

These rights are exercised by email to contact@feir.io, from the address known to the controller or accompanied by any element establishing the identity of the applicant. A response is provided within one month of receipt of the request, extendable by two months for complex requests, in which case the applicant is informed.

Every data subject also has the right to lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr.

The controller implements appropriate technical and organisational measures to ensure the security of data: encryption of communications, session tokens inaccessible to scripts, segregation of each Member's data at database level, questionnaire and share links made of random tokens. In the event of a data breach likely to result in a high risk to the rights and freedoms of data subjects, they are informed under the conditions of Article 34 GDPR, and the CNIL within 72 hours.

This policy may be updated to reflect changes to the Service or to the applicable regulations. The date of the version in force appears at the top of this document.