Privacy policy
Last updated: July 2026.
1 • Our commitment to compliance
The protection of your personal data is a priority for ChapsVision. We respect the right to privacy of all persons whose data we process and we undertake to process them lawfully, fairly, transparently and securely, in accordance with the applicable regulations on the protection of personal data, in particular Regulation (EU) 2016/679 of 27 April 2016 (GDPR) as well as any applicable national legislation.
This Privacy Policy explains, in its capacity as data controller, which personal data ChapsVision collects and processes, the purposes of such processing, the recipients of the data, the applicable storage periods, as well as the rights you have regarding your personal data.
This Privacy Policy applies to any person whose personal data is processed by ChapsVision : providers, subcontractors, visitors, partners, customers, prospects, suppliers, representatives of legal entities, as well as any natural person interacting with ChapsVision or using its products, services, websites or applications.
2 • Fundamental
All definitions are provided in Article 4 of the GDPR, the main ones are listed below to facilitate the understanding of this document.
2.1 Personal data
‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’); ‘Identifiable natural person’ means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more elements specific to his or her physical, physiological, genetic, psychological, economic, cultural or social identity;
That is to say that any data allowing to identify a natural person, if necessary by using additional information obtained from a third party is a personal data.
2.2 Processing
‘Processing’ means any operation or set of operations carried out or not carried out using automated processes and applied to personal data or sets of data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, reconciliation or interconnection, limitation, erasure or destruction;
That is, any manipulation of personal data is a processing, including when it comes to paper documents.
2.3 Person concerned
The person concerned by the processing of personal data is the person to whom the data that are the subject of the processing relate.
This is necessarily a natural person whose data is collected and processed. Data specific to legal entities does not fall within the scope of the GDPR and therefore is not covered by this personal data management policy.
2.4 Data controller
The controller is the natural or legal person, public authority, service or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
In other words, the controller is the entity that decides:
- Why the data is processed (the purposes);
- How they are processed (essential means of processing, such as categories of data collected, data subjects, recipients, storage periods, etc.).
3 • Why do we process personal data?
The processing of personal data implemented by ChapsVision pursues clearly defined purposes, in accordance with the requirements of the GDPR. As such, our aims are:
- Determined: your data is collected for a specific and well-defined use;
- Legitimate: the purposes are in line with standards and regulations. We never violate your rights or fundamental freedoms;
- Explicit: the purposes are stated in a way that is understandable to the persons whose data will be processed.
If you are a prospect, a representative of a prospect or a user wishing to discover our solutions, we process personal data about you in order to manage our commercial prospecting activities, the monitoring of commercial opportunities, demonstration requests, free trials as well as all exchanges occurring in the context of the pre-sale phase.
If you are a customer, prospect, partner or representative of a legal entity, we process your personal data for the purpose of managing pre-contractual business relationships, administering customer accounts, as well as managing the life cycle of contracts, from their negotiation to their execution, renewal or termination.
If you are a customer, supplier, service provider, partner or representative of a legal entity, we process your personal data in order to ensure the administrative, accounting and financial management of our contractual relations, including the establishment, monitoring and payment of quotations, orders, invoices, payments and collection operations.
If you are a prospect, customer, partner, event or webinar participant, user of our services or visitor to our websites, we process personal data about you to manage our marketing CRM, online forms, event and webinar organization, as well as our marketing communications, including sending invitations, newsletters, information about our products and services, functional updates and any other communication related to our activities.
If you are a customer, prospect, supplier, partner, service provider, representative of a legal person or any other person affected by our regulatory obligations, we process your personal data in order to comply with our legal and regulatory obligations, in particular in the context of due diligence procedures, the prevention and management of conflicts of interest, the processing of requests to exercise personal data protection rights, as well as the management of pre-litigation, litigation and legal proceedings.
3.1 Prospecting and Pre-sales
The table below shows the processing of personal data carried out in the context of the management of prospecting.
| Treatment | Detail of the purpose | Legal basis |
| Management of B2B commercial prospecting | Identification of incoming prospects and leads; Telephone call management and exchange tracking; Social selling and Event Invitations. | Legitimate interest (Article 6(1)(f) GDPR) |
| Management of business opportunities | Analysis and qualification of customer needs; Management of appointments and workshops; Preparation of a technical and financial response | Pre-contractual measures (Article 6, §1, b. GDPR) |
| Management of Free Trials and Demo Request | Creation of test accounts and management of licenses; Monitoring of usage; Contact with users, | Pre-contractual measures (Article 6, §1, b. GDPR) & Legitimate interest (Article 6, §1, f. GDPR) |
3.2 Business relationship
The table below shows the processing of personal data carried out in the context of the commercial relationship
| Treatment | Detail of the purpose | Legal basis |
| Pre-contractual management of commercial relations | Offer customization; Discussion workshops; Negotiation management; Follow-up management | Pre-contractual measures (Article 6, §1, b. GDPR) |
| Receivables Management | Tracking the business relationship; Order history and interactions | Performance of the contract (Article 6, §1, b. GDPR) |
| Contract lifecycle management | Drafting, negotiation, validation, signature; Electronic signature of contracts; Contract database management (CLM); | Performance of the contract (Article 6, §1, b. GDPR) |
3.3 Operational Marketing
The table below shows the processing of personal data carried out in the context of operational marketing.
| Treatment | Detail of the purpose | Legal basis |
| Management of CRM Marketing | Enrichment of BtoB databases; Identification of prospects | Legitimate interest (Article 6(1)(f) GDPR) |
| Management of online forms | Collection of requests via forms (contact, content download, newsletter registration); Lead generation; Registration for B2B email campaigns | Pre-contractual measures (Article 6, §1, b. GDPR) & Legitimate interest (Article 6, §1, f. GDPR) |
| Event Management &Webinar | Organization and management of events/ Webinar; Sending invitations; Management of registrations | Pre-contractual measures (Article 6, §1, b. GDPR) & Legitimate interest (Article 6, §1, f. GDPR) |
| Marketing Communication | Invitations to events and webinars; Sending marketing communications; Dissemination of marketing and institutional information; Communication of new products and functional updates; Sending customer newsletters; Tracking interactions with communications (openings, clicks, responses, unsubscriptions), pixel tracking management; | Legitimate interest (Art. 6(1)(f) GDPR) & consent (Art. 6(1)(a) GDPR) for pixel tracking |
| Management of opposition lists | Registration of unsubscribe and opposition requests; Update of lists; Automatic exclusion of future marketing campaigns; | Compliance with a legal obligation (Article 6(1)(c)) |
3.4 Billing
The table below shows the processing of personal data carried out in the context of billing management.
| Treatment | Detail of the purpose | Legal basis |
| Billing management providers, suppliers, partners | Order management and tracking; Billing tracking; Management and tracking of unpaid reminders | Performance of the contract (Article 6, §1, b. GDPR) & Compliance with a legal obligation (Article 6, §1, c)) |
| Customer billing management | Billing management, project monitoring, management and follow-up of unpaid reminders | Performance of the contract (Article 6, §1, b. GDPR) & Compliance with a legal obligation (Article 6, §1, c)) |
3.5 Compliance and litigation
The table below shows the processing of personal data carried out in the context of compliance and litigation management
| Treatment | Detail of the purpose | Legal basis |
| Due Diligence | Management of the due diligence of partners and suppliers; Analysis of the information communicated via the KYP questionnaire; Additional verifications of key persons | Compliance with a legal obligation (Article 6, §1, c)) & Legitimate interest (Article 6, §1, f. GDPR) |
| Conflict of interest | Collection and recording of declarations of conflicts of interest; Identification and assessment of situations of real, potential or apparent conflicts of interest; | Compliance with a legal obligation (Article 6, §1, c)) & Legitimate interest (Article 6, §1, f. GDPR) |
| Management of GDPR law requests | Investigation and response to requests received; Follow-up of the actions carried out and response to the persons concerned; | Compliance with a legal obligation (Article 6(1)(c)) |
| Litigation management | Investigation and follow-up of pre-litigation and litigation files; Constitution, collection and preservation of documents and evidence; | Compliance with a legal obligation (Article 6, §1, c)) & Legitimate interest (Article 6, §1, f. GDPR) |
4 • Personal data we process
We collect, use and store different types of personal data about you in the course of our activities.
Only data that is adequate, relevant and strictly necessary to achieve the purpose will be collected and processed. We make sure to update the data throughout the processing to maintain their validity.
The personal data we process may include, among other things:
| Category | Personal data collected |
| Identification data | Name, first name, civility, |
| Professional life | Business email address, landline or mobile phone number, business mailing address, country, Job, position, department, company, group of membership, industry, company size, role in the project, hierarchical level, |
| Business Data | Status (prospect, customer, partner, supplier), prospect origin, trade history, appointment reports, expressed needs, trade history |
| Marketing Data | Communication preferences, subscriptions to newsletters, consents, date and source of consent, opposition/unsubscription, |
| Marketing Interaction Data | Opening of the email, date and time of opening, number of openings. Email history sent; Clicks, IP address, User-agent, |
| Data on regulatory obligations | Declarations of conflicts of interest, information necessary for due diligence procedures |
| Data relating to GDPR requests | Identity of the applicant, proof of identity (if necessary), content of the application, exchanges, decision taken, history of applications |
| Data relating to litigation | Legal correspondence, evidence, supporting documents, court decisions, history of proceedings |
5 • Sources of personal data
Where we do not directly collect your personal data, it may be obtained from B2B data providers, such as Cognism, as well as from professional social networks, including LinkedIn Sales Navigator, corporate websites, business directories or other publicly available sources. This data is used to identify business contacts, to develop our business activities and to offer you products or services that may be of interest to your organization.
6 • Retention of personal data
We store personal data in accordance with applicable laws and regulations. The storage period of the data does not exceed the period necessary for the purposes.
If you are a customer, partner or service provider, the data is kept for the duration of the commercial or contractual relationship. At the end of this, certain data may be kept for up to ten (10) years in order to comply with our legal, accounting and tax obligations or to allow the exercise or defense of our rights.
The documents necessary for administrative, accounting and financial management, such as quotations, orders, invoices and supporting documents, are then kept for ten (10) years, in accordance with the applicable regulations.
If you are a prospect, customer, partner, event or webinar participant, a user of our services or a visitor to our websites, your personal data is kept for the period necessary to manage our relationship with you. Lead data is retained for three (3) years from your last contact. Customer data used for commercial prospecting purposes is retained for the duration of the business relationship and then, unless you object, for three (3) years after the end of that relationship. Information about your objection to receiving commercial communications is kept for the period necessary to ensure that your choice is taken into account.
If your personal data is processed in order to comply with our legal or regulatory obligations, in particular in the context of compliance procedures, due diligence, prevention and management of conflicts of interest, the processing of requests for the exercise of rights or the management of pre-litigation and litigation, they are kept for the period necessary for such processing. When necessary for the exercise or defense of our rights, they may be retained for up to five (5) years after the closing of the file, except when a longer retention period is imposed by the regulations.
7 • Security of your data
We implement a set of technical, organizational and procedural measures to ensure the confidentiality, integrity and availability of your personal data. These measures shall include in particular:
- Encryption of data in transit and at rest to prevent unauthorized access.
- Anonymization or pseudonymization where possible, in order to reduce the risks in the event of unauthorized access.
- The implementation of strict access controls, based on the principle of « least privilege » and enhanced authentication.
- Physical security procedures to protect our infrastructure, including monitoring, control of access to premises and protection of server environments.
- Continuous oversight of our systems, including incident detection, logging, and threat prevention and response mechanisms.
- Recurring security tests, such as audits, vulnerability scans, and intrusion tests.
All of these measures aim to ensure that your data is protected throughout its lifecycle and that any processing is carried out in optimal conditions of security and compliance.
8 • Location of data hosting
The personal data processed by ChapsVision is stored either in our databases or in those of our hosting providers. The servers on which ChapsVision processes data are exclusively located in the European Economic Area (EEA).
9 • Recipients of data
For the purposes described above, ChapsVision may transfer your data to different recipients, strictly to the extent necessary to achieve these purposes and in compliance with applicable legal and contractual requirements:
| Category | Recipient | Type of operation | Location |
| Group entity | ChapsVision Morocco | Carrying out marketing communication operations, billing management | Morocco |
| CRM and marketing tool | HubSpot | CRM hosting, lead management, email campaigns, form management, interaction tracking, event management and webinars | European Union |
| Accounting Management Tool | Sage | Accounting management, invoicing, payment monitoring | European Union |
| Business Tools | Adequacy | Management of requests to exercise GDPR rights | European Union |
| Collaborative and office tools | Microsoft 365 | Manage email, calendars, documents, collaborative spaces, video conferencing, file storage and sharing | European Union |
As part of the processing described above, your personal data may be transferred to ChapsVision Morocco, a company of the ChapsVision group located in Morocco, in order to carry out marketing communication and billing management operations. This transfer is carried out in strict compliance with the applicable laws and regulations regarding the protection of personal data. ChapsVision relies exclusively on the appropriate safeguards provided by the GDPR, including the Model Contractual Clauses adopted by the European Commission. We are committed to processing your personal data securely and to implementing appropriate technical and organizational measures to ensure its confidentiality, integrity and availability.
10 • Your rights
You have rights to the personal data concerning you:
- right of access;
- right of rectification;
- right of opposition;
- right to erasure « right to be forgotten »;
- the right to define guidelines concerning the fate of his or her data after death;
- right to withdraw consent at any time;
- right to request a restriction of processing;
- right to data portability;
- right to lodge a complaint with the CNIL.
These rights can be exercised with ChapsVision by email: dpo@chapsvision.com
ChapsVision implements the necessary means to ensure the effectiveness of their rights to data subjects. If, for any reason, you consider that ChapsVision’s response is not satisfactory, you have the possibility to lodge a complaint with a supervisory authority.
11 • Data protection stakeholders
11.1 Data Protection Officer (DPO)
Since 01/01/2026, ChapsVision has appointed a Data Protection Officer (DPO), attached to the data controller.
The tasks of the DPO are to inform, advise, ensure the compliance of the processing of personal data and to be the contact point of the data subjects and the supervisory authorities.
11.2 GDPR Referents
Their missions consist first of all in identifying the new treatments within the business projects so that they can be qualified by the Data Protection Officer, and then in gathering the information allowing to follow up the treatments.
They are also a relay between their perimeter and the DPO:
- Downlink: they disseminate in their perimeter the best practices IT and Freedoms as well as the procedures to be respected.
- Bottom-up relay: they report to the DPO the questions, the difficulties encountered (example: regulation specific to a business or a country, business constraints in conflict with IT and Freedom requirements, etc.).
Their strategic positions and missions are formalized in its mission letter, which is communicated to all of our staff.
12 • Update of the data protection policy
To ensure the sustainability of its personal data management policy, ChapsVision regularly (at least annually) ensures that the principles that compose it are in line with the changes in technology, law and the needs of customers and third parties.