Our privacy policy.

Winaity, a simplified joint-stock company (société par actions simplifiée, SAS) registered under SIREN 992 181 230, with its registered office at 16 avenue Louison Bobet, 94120 Fontenay-sous-Bois, France, is the controller of the personal data processing carried out as part of its services.

For any question about the protection of your data, you can contact us at contact@winaity.com.

This policy applies to the winaity.com website and to the Winaity Connect application (connect.winaity.com).

We only collect the data needed for the purposes described below, in particular:

Identification data

surname, first name, company, job title

Contact data

email address, phone number

Data about your request

content of your messages, solution concerned

Guides, quiz and pop-ups

email address, tools you are interested in, quiz answers and your website's address if you give it, and your consents (offers by email, measurement of opens and clicks) with their date

Your Winaity account data

the identifier, surname, first name and email address of your account, as provided by Winaity's identification service

Order and billing data

company, SIREN and VAT number where applicable, billing address, subscribed plans, invoices and payments, date and version of the terms and conditions accepted, any waiver of the withdrawal period. Winaity never knows your bank card number: you enter it in our payment provider's form.

Data of your sends (Winaity Connect)

your contacts, audiences, templates and campaigns, the history and statistics of your sends, your organisation's activity log

Technical data

IP address, connection and browsing data

Your data is processed for the following purposes:

• Answering your contact and demonstration requests (steps taken prior to entering into a contract, or legitimate interest)
• Managing the customer relationship and providing the services (performance of the contract)
• Sending your messages and measuring their results, for Winaity Connect (performance of the contract)
• Processing your orders, invoicing you and collecting your payments (performance of the contract)
• Sending you communications about our offers (consent or legitimate interest)
• Keeping the website secure and working properly (legitimate interest)
• Preventing payment fraud (legitimate interest)
• Measuring the website's audience, with your consent (consent)
• Complying with our legal and regulatory obligations (legal obligation)

Your data is intended for Winaity's authorised teams (sales, support, development) and for its processors, each for the part of the service it provides, on Winaity's instructions and in compliance with the regulations:

Amazon Web Services

sending e-mails (Amazon SES, Paris region); tracking opens and clicks of Winaity Connect campaigns (Amazon SES and Amazon CloudFront); hosting the Winaity Connect sign-in server (Paris region)

Cloudflare

network, DNS and protection of the website and the application (United States)

Google (Google Tag Manager, Google Analytics)

audience measurement of the website, only with your consent (Google Ireland Limited; data may be processed in the United States)

Microsoft (Microsoft 365)

mailbox of the contact@winaity.com address

Twilio

sending Winaity Connect's SMS, WhatsApp and RCS messages (United States)

Meta

delivering Winaity Connect's WhatsApp messages

Bitly

shortening links in SMS and WhatsApp messages, and counting their clicks (United States)

Online payment is provided by Stripe Payments Europe, Ltd (Ireland). Stripe processes payment data as Winaity's processor to carry out the payment, and as a separate controller for fraud prevention and for complying with its own legal obligations. Its processing is described in its privacy policy.

The payment page requests the typeface of its form from Google Fonts: Google then receives your IP address.

Your data may also be disclosed to the competent authorities where the law requires it.

Your data is never sold to third parties.

Your data is kept only for as long as strictly necessary for the purposes pursued:

Prospects

up to 3 years from the last contact

Customers

for the duration of the contractual relationship, then for the applicable legal periods

Accounting data

kept in accordance with legal obligations (up to 10 years)

Winaity Connect

Public API call log

30 days at most (7 days for successful calls)

Organisation activity log

90 days

Hour-by-hour statistics

90 days

Reports of rows rejected on import

30 days

Request to join an organisation

e-mail address deleted 90 days after the answer

Account, contacts, audiences, templates, campaigns, history and statistics

until the account is deleted, on simple request to contact@winaity.com; nothing is deleted automatically on termination

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

• Right of access to your data
• Right to have inaccurate data rectified
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to object, in particular to prospecting
• Right to data portability
• Right to give instructions (post-mortem directives) on what happens to your data after your death

You can exercise these rights at any time by writing to contact@winaity.com or by post to our registered office, with proof of your identity. We answer within one month of receiving your request.

Winaity implements technical and organisational measures appropriate to the risk (Article 32 GDPR), in particular:

• Encrypted exchanges: the website and the Winaity Connect application are only used over HTTPS, with TLS 1.2 and TLS 1.3 only and HSTS enabled; an http:// address is redirected to https://
• Passwords never stored in clear: accounts are managed by Keycloak, authentication software that Winaity runs itself
• An activity log for each Winaity Connect organisation, available to its administrators and kept for 90 days
• Access to data restricted to Winaity's authorised staff

In the event of a personal data breach likely to result in a risk to your rights and freedoms, Winaity notifies the CNIL within 72 hours of becoming aware of it (Article 33 GDPR) and informs you where the law requires it (Article 34).

For any security question or report: contact@winaity.com.

The data of the website, of your Winaity account and of Winaity Connect is hosted in France, in the European Union. Some providers, including Stripe, Cloudflare, Google, Twilio and Bitly, may however process data outside the European Union, in particular in the United States. Such transfers then rely on the European Commission's adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) for certified entities, or on standard contractual clauses. Winaity ensures that appropriate safeguards compliant with the GDPR are in place.

The website sets a few cookies strictly necessary for signing in to your account and for payment, stores your cart in your browser and, only with your consent, sets the audience measurement cookies. They are all described in our Cookie policy.

For any question or complaint about the processing of your data, you can contact us at contact@winaity.com.

You also have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France, www.cnil.fr.