Privacy Policy

Data controller

The data controller is the company MERKUTIO, a simplified joint-stock company (SAS) with a share capital of €125,000, registered with the Paris Trade and Companies Register under number 535 048 359 R.C.S. Paris (SIRET 535 048 359 00025), with its registered office located at 22 rue Hector Malot, 75012 Paris.

Contact: hello@merkutio.fr

Data Protection Officer

Merkutio has not appointed a Data Protection Officer (DPO), as this designation is not required by regulation given the nature and volume of the processing activities implemented. For any questions regarding personal data protection, the user may contact Merkutio at hello@merkutio.fr.

Collected data

Depending on the services used, Merkutio may collect your name, first name, email address, telephone number, job title, company, business address, billing data, data necessary for the organization and monitoring of training, connection data, evaluations, complaints, and professional correspondence.

Purposes and legal bases for processing

The personal data collected is used for the following purposes, each based on the legal basis specified below:

• Responding to requests and preparing quotes : Pre-contractual measures taken at the request of the data subject
• Managing orders, services, and training progress tracking : performance of the contract
• Issuing training certificates : performance of the contract and legal obligation (quality and Qualiopi obligations)
• Managing billing and accounting : legal obligation
• Complying with legal and regulatory obligations (tax, social, quality) : legal obligation
• Handling complaints and managing business relationships : Merkutio's legitimate interest in ensuring the quality of its customer relationships
• Improving the services offered and ensuring the security of information systems : Merkutio's legitimate interest in developing and securing its business
• Placing non-essential cookies (audience measurement, third-party) : user consent

When processing is based on the consent of the data subject, they may withdraw this consent at any time, as easily as it was given, without affecting the lawfulness of processing carried out before such withdrawal. Withdrawal requests can be sent to hello@merkutio.fr.

Data recipients

Data may be accessible to authorized Merkutio employees, trainers, contributors, necessary technical service providers, relevant funding bodies, and competent authorities when required by law. Data is not sold to third parties.

Transfers outside the European Union

Merkutio prefers to use service providers located within the European Union. When a transfer outside the European Union is necessary, it is strictly governed by the safeguards recognized by the GDPR, such as an adequacy decision from the European Commission (notably the EU-U.S. Data Privacy Framework / DPF), the signing of Standard Contractual Clauses (SCCs), or any other appropriate protective measure.

Retention period

Data is kept for the time necessary to fulfill its purpose. Prospect data is kept for up to three years after the last contact; customer data is kept for the duration of the business relationship and then archived according to legal timeframes (5 years); accounting documents are kept according to applicable legal retention periods (10 years); training records are kept in accordance with current regulatory and quality obligations (notably Qualiopi).

Data security

Merkutio implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, destruction, and unauthorized disclosure.

Rights of data subjects

Under the conditions provided by applicable regulations, every individual has the right to access, rectify, erase, limit, object to, and, where applicable, port their data, as well as the right to withdraw their consent at any time (see Article 4).

These requests can be sent to hello@merkutio.fr, accompanied by proof of identity if there is reasonable doubt regarding the requester's identity. Merkutio commits to responding within one month of receiving the request; this period may be extended by two additional months for complex requests or a high volume of requests, in which case the user will be informed.
You also have the right to define directives regarding the storage, deletion, and communication of your data after your death.

Automated decision-making and profiling

Merkutio does not use any fully automated decision-making processes that produce legal effects or significantly affect the individuals concerned, nor does it engage in profiling as part of the processing described in this policy.

Complaints to the CNIL

Anyone who believes their rights are not being respected may file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the competent supervisory authority in France (https://www.cnil.fr/fr/plaintes).

Cookies

The site may use cookies that are strictly necessary for its operation, as well as cookies subject to the user's prior consent (audience measurement, third-party content, etc.). A banner displayed during the first visit allows the user to accept or refuse these non-essential cookies, with refusal being as simple as acceptance, and to modify their choices at any time. The purposes, nature, and retention periods of the cookies used are specified in the site's cookie management module.

Policy updates

This policy may be updated at any time to reflect changes in regulations, the services offered, or Merkutio's practices. The version published on the site is the version currently in effect.