Your data is protected

1. Who is the data controller?

The controller of your data is:

Important note on Pactolane's role

When our customers use the Pactolane platform to manage their contracts, they are the data controllers as customers. Pactolane acts as a processor (Article 4(8) of the GDPR), processing data according to our customers' instructions and in compliance with the data processing clauses of our service contracts.

2. What data do we collect?

We collect different types of data depending on your interaction with the Site:

Identification and contact data

• First and last name
• Professional or personal email address
• Phone number (optional)
• Company name and industry
• Role or position held

Data relating to your use of the Site

• Content of completed contact forms
• Product demo requests
• Newsletter sign-up
• Comments or feedback provided

Connection and browsing data

• IP address
• Unique browser identifier
• Browser type and version
• Operating system used
• Pages viewed and visit duration
• Access timestamps

Data collected via cookies

• Audience analytics data (Google Analytics)
• Cookie consent preferences
• Session data

3. How do we collect the data?

Direct collection

• Contact forms on the Site
• Product demo requests
• Newsletter sign-up
• Email communications

Indirect collection

• Analytics cookies (with your consent)
• Business partners or referrals
• Server log data

Newsletter sign-up · Double opt-in process

Sign-up to our newsletter follows a process of double opt-in (DOI) compliant with GDPR requirements:

• Step 1: You enter your email address (and, where applicable, your first name, department and role) via one of our sign-up forms
• Step 2: A confirmation email is sent to the address provided, containing a validation link
• Step 3: Your sign-up is only effective after clicking this confirmation link

This process ensures that only the holder of the email address can sign up. The collected data is transmitted to our processor Brevo (formerly Sendinblue) to manage delivery. You can unsubscribe at any time via the link in each email, or by writing to privacy@pactolane.com.

4. On what legal bases, for what purposes and for how long?

Here is the detail of our data processing:

Purpose of processing	Legal basis (GDPR Art. 6)	Retention period
Respond to your contact or demo requests	Legitimate interest (Art. 6.1.f)	3 years from the last contact
Sending the newsletter and marketing communications	Consent (Art. 6.1.a)	Until unsubscription + 3 years
Audience measurement (Google Analytics)	Consent (Art. 6.1.a)	13 months maximum
Improvement and optimization of services	Legitimate interest (Art. 6.1.f)	25 months
Compliance with legal and tax obligations	Legal obligation (Art. 6.1.c)	According to the applicable legal periods
Handling rights-exercise requests	Legitimate interest (Art. 6.1.f)	3 years from the request

5. Who are the recipients of your data?

Your data is processed by the following entities:

Internal staff

• Sales team (handling demo requests)
• Customer support team
• Product team (continuous improvement)
• Compliance team and DPO

Processors

• Google Analytics: for audience measurement and user behavior analysis
• Google Cloud Platform (GCP): for secure hosting in Europe (europe-west1 region, Belgium)
• Brevo (formerly Sendinblue): for sending newsletters and transactional emails (sign-up confirmation). Brevo is a French company whose servers are located in the European Union. Data transmitted: email address, first name (if provided), department and role (if provided), sign-up source. Brevo privacy policy

Public authorities

• Upon legal request or court order
• To comply with legal obligations

6. Is your data transferred outside the European Union?

Most of your data is processed within the European Union. However:

Hosting

• Our host Google Cloud Platform uses the region europe-west1 (Belgium, EU)
• Your data therefore remains on European territory
• No transfer outside the EU for hosting

Google Analytics

• Google Analytics may transfer certain data to the United States
• These transfers are governed by the standard contractual clauses (SCC) of the European Commission
• Google LLC accepts the SCCs and provides equivalent security guarantees

You can request a copy of the safeguards and transfer mechanisms by contacting our DPO at privacy@pactolane.com.

7. What are your rights over your data?

The GDPR grants you the following rights. You can exercise one or more of these rights by writing to us at privacy@pactolane.com :

Right to information

GDPR Articles 13 and 14 : Right to be informed about how your data is processed. We provide this information through this policy.

Right of access

GDPR Article 15 : Right to obtain a full copy of the personal data we process about you, within 30 days.

Right to rectification

GDPR Article 16 : Right to correct or complete your personal data if it is inaccurate or incomplete.

Right to erasure ("right to be forgotten")

GDPR Article 17 : Under certain conditions, the right to request the deletion of your data (e.g. if it is no longer necessary).

Right to restriction of processing

GDPR Article 18 : Right to request that processing of your data be paused pending clarification.

Right to data portability

GDPR Article 20 : Right to receive your data in a structured, machine-readable format, and to transmit it to a third party.

Right to object

GDPR Article 21 : Right to object to the processing of your data on grounds relating to your particular situation.

Right to withdraw consent

GDPR Article 7 : If you have consented to processing, you can withdraw your consent at any time, without retroactive effect.

Right to set post-mortem directives

French law : You can indicate your wishes regarding the processing of your data after your death.

Right to lodge a complaint with the supervisory authority

GDPR Article 77 : You can lodge a complaint with the French Data Protection Authority (CNIL) if you believe Pactolane is violating your rights.

8. What cookies do we use?

For a detailed and complete list of cookies used on the Site, please see our Cookie policy.

9. Contact point to exercise your rights

10. Changes to this policy

Last updated: 24 April 2026

We reserve the right to modify this privacy policy at any time. Changes will be published on this page with the update date. We will inform you by email of any significant change. Your continued use of the Site after the changes are published implies your acceptance of the new policy.