Contents
1. Data controller
The controller for the personal data collected via the website signersynthese.fr is:
2. Personal data collected
As part of the use of the Service, we collect the following categories of data:
2.1 Data provided by the user
- Signatory's identity: first name, full name
- Contact details: email address, mobile phone number (E.164 format)
- Document to be signed: PDF file (INPI summary) uploaded voluntarily by the Customer. This file may contain personal data (civil status, address, SIREN number, amounts, etc.). The Customer is solely responsible for the content of their document.
2.2 Data collected automatically
- IP address (anonymised immediately by SHA-256 hashing + cryptographic salt before any storage — the clear IP address is never retained)
- User-Agent (browser and operating system, truncated to 200 characters)
- Technical session identifier (generated client-side, to track the journey without authentication)
- Timestamp of the actions performed (upload, form submission, payment, etc.)
2.3 Payment data
Bank card data never passes through the Seller's servers. It is collected and processed directly by our payment provider Stripe Payments Europe Ltd, PCI-DSS Level 1 certified. Securit Expert receives only a transaction identifier and the payment status.
2.4 Data collected by our qualified signature provider (Universign)
For the PVID-compliant identity verification required for the eIDAS qualified signature, the provider Universign collects directly, during the signing step on a smartphone:
- Front-and-back photograph of the signatory's identity document
- Selfie (photograph of the face) for biometric recognition
- SMS authentication code
- Technical data related to the signing session
This data is collected, processed and retained exclusively by Universign in its capacity as a Qualified Trust Service Provider (TSP), in accordance with the eIDAS regulation. It does not pass through our servers. See Universign's privacy policy.
3. Purposes and legal bases
4. Sub-processors and recipients
Your personal data is accessible only to authorised Securit Expert staff and to our technical sub-processors, selected for their GDPR guarantees:
No personal data is transferred, sold or passed on to third parties for commercial or marketing purposes.
The main hosting infrastructure (Railway servers hosting the website and the database) is physically located in Amsterdam (Netherlands), therefore within the European Union. As Railway Corp. and Cloudflare, Inc. are established in the United States, any transfer or indirect access to the data is covered by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), ensuring a level of protection equivalent to the GDPR.
5. Retention periods
6. Data security
Securit Expert implements appropriate technical and organisational measures to ensure the security and confidentiality of your personal data:
- Encryption in transit: all communications with the website use the HTTPS / TLS 1.3 protocol (256-bit SSL encryption)
- IP hashing: visitors' IP addresses are never stored in clear — only their SHA-256 hash with cryptographic salt
- Conversion to PDF/A before transmission to Universign (document integrity)
- Immediate local deletion of the uploaded PDF after transmission to the signature provider
- Strengthened authentication for access to the administrator back-office (HMAC-signed session cookies, rate-limiting)
- Certified sub-processors: Stripe (PCI-DSS Level 1), Universign (qualified eIDAS TSP, ANSSI-certified)
7. Cookies and trackers
The website signersynthese.fr uses a minimal number of cookies, exclusively technical and functional:
The website uses Cloudflare Web Analytics, a privacy-friendly, GDPR-compliant audience measurement service: no cookie is set on your device, and no IP address, unique identifier or personal data is stored. The service counts only aggregated and anonymous visits (page viewed, traffic source, device type, country). In accordance with CNIL recommendations, no prior consent is required for this type of anonymised audience measurement.
The website uses no advertising cookies or user-tracking audience measurement tools (Google Analytics, Facebook Pixel, etc.).
8. Your GDPR rights
In accordance with the GDPR and the French Data Protection Act, you have the following rights:
- Right of access (Art. 15 GDPR): to obtain confirmation that data concerning you is being processed and to obtain a copy of it
- Right to rectification (Art. 16): to have inaccurate or incomplete data corrected
- Right to erasure / "right to be forgotten" (Art. 17): to have your data deleted, except where legal retention obligations apply
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20): to receive your data in a structured, commonly used and machine-readable format
- Right to object (Art. 21): to object to processing on legitimate grounds
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand
- Right to define post-mortem instructions on the fate of your data (Art. 85 of the French Data Protection Act)
To exercise any of these rights, contact us at [email protected] stating "GDPR request" in the subject line, together with proof of identity (a copy of an identity document). We undertake to respond within a maximum of 1 month, extendable by 2 months for complex requests (Art. 12 GDPR).
9. Changes to the policy
This Privacy Policy may be amended at any time, in particular to take account of legal, case-law, technical or organisational developments. The applicable version is the one in force on the date of your order, available on the website with its update date.
In the event of a substantial change, users who have provided their email will be informed by email.