Privacy policy
Simundia application

This privacy policy applies to the Simundia application and all related products and services.

Personal data protection policy

1. Definitions

Customer: means the company that has signed a contract with SIMUNDIA to allow one or more of its employees to register on the Site in order to benefit from a defined number of Sessions.

Personal data: means any information relating to a natural person who may be identified, directly or indirectly, such as, but not limited to, a name, postal address, e-mail address, telephone number, IP address, etc.

Expert(s): means the psychologist, health professional or coach, using the Site to provide Users with psychological and/or coaching services.

Data Subjects: means the natural persons whose Personal Information is collected by SIMUNDIA in connection with the operation of the Site, in accordance with this Agreement.

Sessions: means the support service provided to the User by the Expert on the Site.

Site: means the app.simundia.com platform

Third-party employee: means an employee of the Customer (HR, manager, colleague) from whom the User requests feedback on his or her training program.

User(s): means the natural person with a Simundia account (coachee or HR administrator).

2. Identity of the data controller

The data controller is SIMUNDIA SAS, whose registered office is located at 15, rue Ancelle, 92200 Neuilly-sur-Seine, registered in the Nanterre Trade and Companies Register under the number 827 580 242 (hereinafter referred to as " SIMUNDIA ").

SIMUNDIA operates the www.simundia.com and https://app.simundia.com/ platforms . The Site puts Users who wish to benefit from a training course in contact with Experts.

SIMUNDIA attaches particular importance to respecting the privacy of Data Subjects and the confidentiality of their Personal Data. SIMUNDIA thus undertakes to process data in compliance with applicable laws and regulations, and in particular Law n°78-17 of January 6, 1978 relating to information technology, files and freedoms as amended by Law 2018-493 of June 20, 2018, and Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter collectively referred to as " the Regulation ").

This privacy policy, established by SIMUNDIA, is intended to provide the above-mentioned Data Subjects with summary and global information on the processing of their personal data by SIMUNDIA through the Site.

3. Origin of personal data

The term "personal data" means any information relating to a natural person who can be identified, directly or indirectly, such as, but not limited to, a name, a postal address, an e-mail address, a telephone number, an IP address...

As a matter of principle, we only collect the data necessary to enable us to deliver the best possible experience on our Site as well as the best coaching experience.

3.1 The data transmitted by the Customer

When a customer enters into a contract with SIMUNDIA to allow one or more of its employees or agents to benefit from a defined number of sessions, it transmits, under its responsibility, to SIMUNDIA, the email addresses of the employees or agents concerned.

SIMUNDIA will also collect from the customer the email address of employees authorized to access the customer area of the site. The Customer has consented to the use of this Personal Data as part of the contract between them and SIMUNDIA.

3.2 Data transmitted by the User

When the User opens an account on the Site, SIMUNDIA collects on the Site his/her name, first name, email, telephone number. The User can also choose to send a photo (optional field).

Secondly, during the orientation meeting between the User and the Expert via videoconference, the User may provide additional information on their professional situation, to enable SIMUNDIA to define a suitable training course and improve their experience. Subject to the User's prior acceptance, SIMUNDIA collects recordings of the Sessions. No screenshots will be taken in this context.

Once the training course has been completed, the User will be asked to answer a series of questions as part of an impact and satisfaction survey, with the aim of continuously improving our service. The report is sent out immediately after the last session and 3 months afterwards. A roadmap can also be completed by the User for personal use, to help anchor their learning over time.

SIMUNDIA does not require any personal data during these exchanges and in these questionnaires, but the User may mention them in the free text fields to answer the questions asked.

SIMUNDIA retains all the above-mentioned data relating to the User and his/her training course under the conditions defined below.

SIMUNDIA also keeps a history of the Sessions attended by the User.

The Client has no knowledge of the content of the Sessions and has no right of access to the Sessions provided by the Expert to the User in order to strictly respect the principle of confidentiality.

No health data about the User is collected on the Site.

3.3 Data transmitted by salaried third parties

The User may optionally request feedback from a Third-Party Employee when creating an account on the Site. In this case, the User sends SIMUNDIA the surname, first name, email address and type of professional relationship (manager, HR, colleague) of the Third-Party Employee concerned, as well as an additional message if necessary.

The feedback request will contain 3 free fields on what the User should continue (asset), stop or start doing (axis of progression) in the context of his professional activity.

SIMUNDIA emails the feedback request to the Third Party employee.

The Third Party employee will be able to:

(i) return the completed feedback request by logging on to the Site and accepting the Site's Privacy Policy or

(ii) request by return mail to SIMUNDIA the deletion of personal data concerning him.

If the Third Party Employee does not return within 15 days of the feedback request, the Third Party Employee's Personal Data will be deleted by SIMUNDIA.

Following the return of the Third Party Employee, SIMUNDIA will retain the Third Party Employee's data and the completed feedback request as defined below.

3.4 Data provided by the Experts

When the Expert registers on the Site and opens his account, SIMUNDIA collects on the Site his name, first name, email, telephone number, his diplomas and qualifications, his experience and professional background.

Subject to prior acceptance by the Expert, SIMUNDIA collects recordings of the Sessions. No screenshots will be taken in this context.

3.5 Data provided by experts

SIMUNDIA provides the User and the Expert with a messaging system on the Site that allows them to exchange information on the organization of the Sessions, between themselves or with SIMUNDIA.

This messaging is exclusively intended to improve the organization of the Sessions (postponement, cancellation, ...) or to share resources (sending documentation). As part of the management of the Site, SIMUNDIA will have access to this messaging.

This messaging system is not intended to be used by the User and the Expert to share individual or personal information about the content of the Sessions.

4. Purpose and processing of personal data

SIMUNDIA collects and processes the Personal Data of the Persons concerned in order to be able to provide, in the best possible conditions, the services of putting Users in contact with Experts.

The Expert and the User consent to the use of their personal Data when opening an account on the Site by ticking the dedicated box after having read the present confidentiality policy.

The Third-Party Employee consents to the use of his/her Personal Data by logging on to the Site in the context of sending the completed feedback request.

The Customer has consented to the use of the Personal Data of its employees authorized to access the Customer Area on the Site in the contract between the Customer and SIMUNDIA.

SIMUNDIA does not use the Personal Data of Data Subjects for commercial prospecting purposes.

Table detailing purposes, data processed and legal basis for processing :

5. How long data collected by SIMUNDIA is kept

Personal Data relating to the User and the Third Party employee will be deleted 5 years after the last connection to the Site of the User.

The personal data relating to the Expert will be deleted 5 years after the last Session he/she provided to a User.

Personal Data relating to the Customer will be deleted 5 years after the last connection to the Site of a User.

E-mail content will be deleted 5 years after the User's last connection to the Site.

Personal Data collected during audio recordings of Sessions are kept for a period of 12 months from the date of collection. User and/or Expert consent may be withdrawn at any time. Session content analysis documents are kept for 13 months from the date of recording.

As an exception, some of this Personal Data may be archived with restricted access to manage ongoing claims and litigation as well as to meet legal and/or regulatory obligations and/or to respond to requests from authorities authorized to make such requests for a maximum period of 10 years. The data is then permanently deleted.

6.Sub-contractors and recipients of personal data collected

The Personal Data of the Data Subjects will only be transmitted :

  • if required by current regulations;
  • if such transmission is necessary to comply with applicable law or regulation, legal process and/or administrative or judicial order;
  • more generally, to act in urgent circumstances to protect the personal safety of the Persons concerned.

Apart from these regulatory situations :

  • SIMUNDIA may transmit to the Customer data on the use of the Site by Users. Under no circumstances may this data concern the content of the Sessions attended by Users.
  • SIMUNDIA does not transfer the Personal Data of Data Subjects to third parties. SIMUNDIA nevertheless reserves the right to use technical subcontractors, for example to host and maintain personal data or to offer innovative features.

6.1 Data hosting

The Personal Data are hosted by :

  • by AWS for object storage, i.e. User photos (optional field) and personality assessment results files. The AWS servers used by SIMUNDIA are located in France;
  • by Scalingo for the application and database. The Scalingo servers used by SIMUNDIA are also located in France (via subcontractor 3DS Outscale).

SIMUNDIA does not transfer Personal Data outside the European Union and the Personal Data of Data Subjects is not transferred to any SIMUNDIA business partner.

6.2 Subcontractors

Simundia uses the services of several specialized service providers, listed in Appendix 1, as well as their personal data management policies, to which reference should be made.

Experts may also be required to collect and process User personal data during exchanges with Users. Under the terms of the contracts concluded between them and Simundia, they undertake to collect, process and store exclusively the Personal Data of the Persons concerned in accordance with the Regulations and SIMUNDIA's instructions for the purposes of complying with this privacy policy.

7. Rights of persons concerned

Data subjects have the following rights:

Right of access: Data subjects have the right to ask what data SIMUNDIA holds and to have it communicated to them.

Right of rectification: Data subjects have the right to request the rectification of inaccurate data concerning them held by SIMUNDIA.

Right to erasure ("right to be forgotten"): Data Subjects have the right to obtain from SIMUNDIA the deletion of data concerning them, under the conditions provided for by the Regulations.

Right to restrict processing: Data Subjects have the right to request SIMUNDIA to suspend the processing of their data while an audit can take place (to verify in particular the accuracy and relevance of the Personal Data processed by SIMUNDIA).

Right of portability: Data Subjects may have their Personal Data transmitted to them in a structured format and have the right to transmit it to another data controller.

Right to object: Data subjects have the right to object, at any time, to being included in a file for legitimate reasons.

Right to define directives relating to the fate of personal data post-mortem: In the absence of directives or mentions to the contrary in such directives, the heirs of Data Subjects may, after their death, exercise their rights over their Personal Data.

Right to lodge a complaint with a supervisory authority

For more information about exercising your rights:

https://www.cnil.fr/fr/comprendre-vos-droits

These rights may be exercised by sending a request to SIMUNDIA at contact@simundia.com. SIMUNDIA will make every effort to respond to requests within a reasonable time, and in any event within the time limits set by the Regulations.

8. Securing Personal Data

SIMUNDIA maintains adequate technical and organizational measures to protect Personal Data from accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access.

SIMUNDIA ensures the security of Personal Data against unauthorized access, use or disclosure by implementing enhanced data protection through the use of appropriate physical and logical security measures to ensure data integrity and confidential and secure processing.

Thus, among the measures taken by SIMUNDIA to secure all Personal Information

  • Data encryption: The URLs of the Site are encrypted thanks to the use of token ;
  • Videoconferencing: Sessions between Users and Experts can be conducted by videoconferencing, using the tool integrated into the Site and developed by Microsoft's Azure Communication Services. This tool is based on webrtc technology. For more details on the security of this tool:https://privacy.microsoft.com/fr-fr/privacystatement
  • All Experts selected by SIMUNDIA are subject to strict confidentiality commitments: therefore, they may not disclose to SIMUNDIA or any third party the information given by the User in the context of the Sessions. Both the Expert and the User agree not to film or record the Session. He also agrees to isolate himself from any third party likely to hear the conversation during the session.

Appendix 1

List of subcontractors

  • Front: The User may use the Front chat service to ask questions and receive assistance in navigating the site. This messaging service is not intended to be used to share individual or personal information. Nevertheless, if the User uses the Front chat service, he/she consents to the collection and processing of his/her personal data in accordance with Front's general terms and conditions. In this case, the User should refer to the legal notice, general terms of use and data protection policies available at https://front.com/legal/privacy-notice.
  • Azure Communication Services: we use Azure Communication Services for videoconferencing, SMS and phone calls. Their privacy policy is available at https://privacy.microsoft.com/fr-fr/privacystatement
  • Customer.io Customer.io: we use this tool to send e-mails to Users as part of the coaching process. Customer.io has access to users' first and last names and e-mail addresses. Their privacy policy is available at https://customer.io/legal/privacy-policy/
  • Make (Integromat): in order to automate certain data processing processes (in particular the connection between our various databases), certain data temporarily transit through Make servers. Make is a European company whose data processing policy can be accessed via this link: https: //www.make.com/en/privacy-notice
  • Auth0 (SSO option): we use this tool to set up SSO (Single Sign On) for our customers. Auth0 then has access to users' email addresses. Their data privacy policy is available on this link: https://auth0.com/docs/secure/data-privacy-and-compliance

Technical service providers are required to comply with the Regulations. These service providers may only use Personal Information about Data Subjects on behalf of SIMUNDIA.