Privacy policy
Last updated: 30 October 2026
Template to be reviewed by a lawyer before any contractual use.
Items marked “To complete” must be filled in before going live.
This policy explains how ESERENIT (“we”) processes the personal data of visitors to https://okgrc.com, of prospects and of customers of the OK-GRC platform, as controller.
For the data our customers put into the platform (registers, risks, evidence, incidents…), we act as processor: that processing is governed by the data processing agreement concluded with each customer, who remains the controller.
Who to contact
Controller: ESERENIT, 16 rue Cuvier, 69006 Lyon, France.
For any question or to exercise your rights: [[To complete: contact email address]]. Data protection officer: [[To complete: DPO designation and contact details, or a statement that none is designated]].
What data we process, why and on what basis
| Processing | Data | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, pages requested, browser (server logs) | Security, abuse prevention, error diagnosis | Legitimate interest (securing the website) | 12 months at most |
| Form abuse limiting | Non-reversible fingerprint (hash) of the IP address and email | Prevent mass form submissions | Legitimate interest | 24 hours at most |
| Contact form and demo request | Name, work email, company, phone, company size, message | Answer your request, organise a demo, prepare a quote | Pre-contractual steps / legitimate interest | 3 years after the last exchange |
| Newsletter | Email, language, date and proof of subscription (double opt-in) | Send the newsletter | Consent | Until you unsubscribe, then suppression list |
| Marketing (if you ticked the box) | Name, email, company, date and source of consent | Send you our news | Consent | 3 years after the last contact |
| Customer account and users | Name, email, language, role, sign-in logs, security settings | Provide the service, secure access | Performance of the contract | Contract term, then 90 days |
| Billing | Company name, address, VAT number, billing email, payment history | Invoice and collect | Legal obligation / contract | 10 years (accounting records) |
| Support | Exchanges with support | Answer requests | Performance of the contract | 3 years after closure |
We never sell your data and do not use it for targeted advertising. The website uses no third-party analytics, advertising network or social network button.
Who has access to your data
Our authorised staff, and our sub-processors for the sole purpose of the service:
- IONOS: hosting of the website and the platform, in the European Union;
- Brevo: sending emails (answers, confirmations, newsletter), in the European Union;
- Stripe: subscription payments and invoicing;
- Anthropic (only for customers who chose the Claude AI): generating the drafts requested from the assistant.
The detailed list is on the Sub-processors page.
Transfers outside the European Union
Some sub-processors (Stripe, Anthropic) may process data outside the European Union, in particular in the United States. These transfers rely on the European Commission’s standard contractual clauses or, where applicable, an adequacy decision. [[To complete: check each provider’s exact mechanism at signature]].
Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing and, where applicable, to data portability, as well as the right to withdraw your consent at any time (unsubscribe link in every newsletter). You can also give instructions about your data after your death.
Write to [[To complete: contact email address]]; we answer within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or the supervisory authority of your country.
Security
We apply to our own processing the measures described on the Security and trust page: hosting in the European Union, encrypted connections, access control, logging and data minimisation.
Cookies
The website sets no non-essential cookies. See the cookie policy.
Changes
We may update this policy; the date of the last update is shown at the top of the page. In case of discrepancy, the French version prevails.