1. Data Controller

Electro Renew SAS acts as data controller for all data processed through the ElectroRenew platform under the General Data Protection Regulation (GDPR) and applicable French data protection law.

2. Data We Collect

We collect only data that is strictly necessary for the operation of the enterprise platform:

2.1 Technician Account Data

• Name and email address of registered technicians and administrators
• Role assignments (technician, supervisor, admin)
• Account creation date and last login timestamp
• Organization/enterprise partner association

2.2 Operational Logs

• Timestamped records of diagnostic sessions linked to technician credentials
• Device identifiers processed (IMEI, serial number) — for audit trail only
• Test results and certification outcomes
• Erasure verification records with compliance certificate references

2.3 Technical Data

• Authentication tokens (session management only)
• Browser/OS type and version for compatibility purposes
• Error logs for platform diagnostics and support

2.4 ERenew Device Test (Android mobile app)

Our Android application ERenew Device Test runs hardware self-tests on the device it is installed on. It uses the camera and microphone solely to render live previews for the camera and audio tests; no photo, video or audio recording is stored or transmitted. It uses location solely to verify that the GPS receiver can obtain a fix; coordinates are displayed on screen and are never transmitted or stored. The biometric test invokes the device's own system prompt; no biometric data is read, stored or transmitted.

Used on its own, the app transmits nothing. When a technician starts a session from the ERenew desktop software, the app transmits only the test pass/fail summary, the resulting grade and the session number. It does not collect your IMEI, phone number, contacts, messages, photos or advertising identifiers. To request deletion of a test result, contact the shop that performed the test or write to the address in Section 1.

2.5 Telegram broadcast subscribers

If you start a conversation with our Telegram bot and tap “Confirm subscription”, we record your Telegram chat ID, the display name shown on your Telegram profile, your language code, and the link you arrived from, together with a timestamped copy of the exact wording you agreed to. We keep that record so that we can demonstrate your consent, as GDPR Art. 7(1) requires.

This data is used for one purpose only: sending you the product announcements you asked for. It is never sold, rented, or used to build a profile, and it is never combined with your ERenew account or with any diagnostic data. You can withdraw at any time by sending /stop to the bot or by blocking it — withdrawal is as easy as subscribing, is acted on immediately, and has no effect on your licence or on anything else we provide. Following our public Telegram channel instead subscribes you to nothing: channel followers are anonymous to us and we hold no record of them.

3. Data We Do NOT Collect

• Consumer personal data (end-customers, device owners)
• Payment card numbers or financial account information
• Advertising identifiers, cross-site tracking, or marketing profiles built about you
• Biometric data
• Location data beyond country-level (for compliance jurisdictions)
• Third-party login tokens, or social media identifiers other than the Telegram chat ID you give us by subscribing to our broadcast bot (Section 2.5)

4. Legal Basis for Processing

Data Category	Legal Basis (GDPR Art.)	Purpose
Technician accounts	Art. 6(1)(b) — Contract performance	Authentication and access control
Operational logs	Art. 6(1)(c) — Legal obligation	Compliance audit trail (ADISA / NIST)
Technical error logs	Art. 6(1)(f) — Legitimate interests	Platform reliability and security
Telegram broadcast subscribers	Art. 6(1)(a) — Consent	Sending the product announcements you subscribed to

5. Data Retention

• Active accounts: Retained for the duration of the enterprise agreement
• Operational logs: Retained for a minimum of 5 years for compliance purposes, or longer where required by applicable law
• Session tokens: Expire after 24 hours of inactivity
• Terminated accounts: Deleted within 90 days of enterprise agreement termination, unless legal retention obligations apply
• Telegram subscribers: Retained until you unsubscribe; the consent record is kept for 3 years afterwards as proof that consent was given and withdrawn

6. Data Sharing & Sub-Processors

We share data only with the following sub-processors, each bound by GDPR-compliant data processing agreements:

Sub-Processor	Role	Data Center Location
Supabase Inc.	Database and authentication	EU (Frankfurt)
Netlify Inc.	Web application hosting	EU / US (with SCCs)
Telegram FZ-LLC / Telegram Messenger Inc.	Delivery of broadcast messages to subscribers only (Section 2.5)	Outside the EEA, under Telegram's own privacy policy

We do not share data with advertising networks, analytics platforms (e.g., Google Analytics), payment processors (e.g., Stripe), or any other third parties beyond those listed above. Telegram receives only what is inherent in sending you a message you asked for — your Telegram chat ID and the message itself — and only if you have subscribed; it receives no ERenew account or diagnostic data.

7. Your Rights Under GDPR

Technicians and administrators have the following rights regarding their personal data:

• Right of access (Art. 15): Request a copy of your personal data
• Right to rectification (Art. 16): Correct inaccurate personal data
• Right to erasure (Art. 17): Request deletion, subject to legal retention requirements
• Right to restriction (Art. 18): Limit processing in certain circumstances
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests

To exercise any of these rights, contact: halas@electrorenew.fr

You also have the right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr

8. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access control limiting data access to authorized personnel
• Row-level security in database layer
• Regular security reviews and access log auditing

9. Updates to This Policy

This Privacy Policy may be updated periodically. Enterprise partners will be notified of material changes via the contact email associated with their account. The date at the top of this policy reflects the most recent revision.

Questions: halas@electrorenew.fr