OAuth2 Privacy Policy

1. General Information

Yamana RSE ("we", "our", "us") is committed to protecting your privacy. This privacy policy explains how we collect, use and protect your personal information when you use our Tracepartner service.

Data Controller:

Name: Yamana RSE
Address: 88 Rue St Luc
Email: [email protected]
Phone: +33 06 27 89 51 99

2. Data Collected via Google OAuth2

2.1 Types of Data Collected

When you log in with your Google account, we only access the following information via OAuth2, after your explicit consent:

• • Full name (profile)
• • Email address (email)
• • Profile picture (profile)
• • Unique Google identifier (openid)

No other access is made to your Google account.

2.2 Collection Method

This data is collected only through Google's OAuth2 authentication process, after your explicit consent.

3. Data Usage

3.1 Processing Purposes

We use your data to:

• • Identify and authenticate you on our platform
• • Manage your user session
• • Associate your account with your client organization
• • Contact you for account or subscription management
• • Ensure platform security

3.2 Legal Basis

The processing of your data is based on:

• • Your explicit consent (GDPR Art. 6.1.a)
• • Contract performance (GDPR Art. 6.1.b)
• • Our legitimate interests in securing and improving our services (GDPR Art. 6.1.f)

4. Data Sharing and Transmission

4.1 Third-Party Sharing

We never sell your personal data. It may only be shared with:

• • Our technical service providers (hosting, analytics, emailing)
• • Competent authorities, if required by law

4.2 International Transfers

Some data may be hosted or processed outside the EU (e.g., SendGrid in the US). We ensure that these transfers comply with the European Commission's standard contractual clauses.

5. Data Security

We implement the following measures:

• • HTTPS (TLS) encryption of all communications
• • AES-256 encryption of sensitive data at rest
• • Strict server-side authentication
• • Internal access limitation by role

6. Data Retention

6.1 Retention Period

• • Profile data: retained as long as your account is active
• • Security logs: 24 months

7. Your Rights

In accordance with GDPR, you have the following rights:

• • Right of access to your data
• • Right to rectification of incorrect data
• • Right to erasure of your data
• • Right to restriction of processing
• • Right to data portability
• • Right to object to processing

Exercising your rights: Contact us at [email protected] Response within 30 days.

8. Consent Revocation

8.1 Revoking Google Access

At any time, you can withdraw our access to your Google account:

1. Go to https://myaccount.google.com/permissions
2. Select Tracepartner
3. Click "Remove access"

8.2 Account Deletion

You can delete your account via your profile or by sending an email to [email protected]

9. Cookies and Similar Technologies

We use:

• • Essential technical cookies (authentication, security)
• • No tracking or advertising cookies

10. Protection of Minors

Our service is reserved for persons aged 16 or older. We do not intentionally collect data from minors.

11. Modifications to This Policy

We reserve the right to modify this policy. You will be informed of any important updates via our platform or by email.

Last updated: May 28, 2025

12. Contact and Complaints

12.1 Contact

Email: [email protected]
Address: 88 rue St Luc
Phone: +33 6 27 89 51 99

12.2 CNIL

In case of disagreement, you can contact the CNIL:

Website: www.cnil.fr
Address: 3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07
Phone: 01 53 73 22 22

This privacy policy is effective from May 28, 2025.