Privacy Policy How we collect, use and protect your personal data.

1. Introduction

The protection of your personal data is important to us.

We are committed to collecting only the data we need to provide you with an optimal service, to ensuring its confidentiality and security — including when we engage service providers — and to facilitating the exercise of your rights over your data.

Our primary commitment is to comply with applicable data protection legislation.

We comply with the obligations arising from the General Data Protection Regulation (also known as the "GDPR") and all national laws implementing it in the countries in which we operate. In particular, we take care to respect the French "Informatique et Libertés" Law of 6 January 1978 as amended.

This policy describes the personal data we collect, how it is used and, where applicable, shared, and your rights in this regard. It applies to all users of Labsquare services.

If you would like clarification or have a question, you can contact our DPO team at: privacy@labsquare.eu.

Effective date: The updated Data Protection Charter will automatically take effect for all active users from 1 January 2023. We reserve the right to modify this Charter at any time. The most current version governs our use of your data.

2. Data controller: LabSquare

LabSquare SASU, registered with the Strasbourg Trade and Companies Register under number 917764417, with its registered office at 17, rue de Rosheim – 67000 STRASBOURG, France.

3. Data Protection Officer

You may address any question relating to the protection of personal data at Labsquare, or submit a request to exercise your rights of access, rectification, objection, erasure, restriction, portability, or post-mortem data management, to our Data Protection Officer:

  • By email: privacy@labsquare.eu
  • By post: DPO, LabSquare SASU, 17, rue de Rosheim – 67000 STRASBOURG, France

4. Data we process

In connection with your use of our services and your browsing on our website, Labsquare processes several categories of data. This data comes from:

  • Information you provide when creating your account, updating your profile, or when communicating with our team (identification data, email address, photo, professional data, bank details, etc.).
  • Information resulting from your use of our services (integrated messaging, browsing, activity on the Marketplace, information relating to transactions linked to your account).

We do not process special categories of data (sensitive data) such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, biometric data, or data concerning health or sexual life.

4.1 Data relating to service providers

Personal information

  • Last name, first name
  • Place and date of birth
  • Gender, nationality
  • Email address
  • Professional category
  • Geolocation at the time of connection
  • Profile picture
  • Address
  • Where applicable, official national identification number

Professional information

  • Professional experience
  • Skills
  • Portfolio
  • Service preference(s)
  • Certifications, accreditations and training
  • Languages

Legal structure

  • Company name and legal form
  • Identity of the legal representative
  • Legal documents (company registration extract, compliance certificate, etc.)
  • Bank account details

Data generated by your use of the platform

  • Necessary cookies and other cookies (subject to your consent) and IP address
  • Transaction details (e.g. payment for your services)
  • Comments and reviews left by your clients
  • User identification, dates and contents of the secure messaging system (where necessary for fraud prevention)

4.2 Data relating to client representatives

Personal information

  • Last name, first name, date of birth, gender
  • Email address
  • Profile picture

General company information

  • Industry, number of employees, company logo
  • Billing details, accounting contact

Data generated by your use of the Marketplace

  • Reviews received and comments left by providers
  • Necessary cookies and IP address
  • Transaction details
  • Secure messaging data (identification, date, time, content where necessary)

4.3 Statistical information relating to your use of our services

We collect statistics such as:

  • Secure messaging usage (percentage of messages answered, response times)
  • End-of-mission evaluations (comments, average ratings)
  • Based on user login and browsing data
  • Use of the search engine and service provider contact form
  • Your use of various modules (quote tool, contract module, payment, reporting)
  • Commercial data such as the number of services completed and business volumes by category

5. Cookies

We use authentication, security and site integrity cookies, location cookies, cookies related to site and service functionality, analytics and research cookies, and cookies to serve advertising messages. You can accept, refuse or configure your cookie preferences when you first log on to the Marketplace and change your choices at any time by visiting the cookies section of our data protection centre.

6. Legal bases and purposes

Labsquare processes most of your personal data within the framework of the service contract you entered into when registering on the site by accepting our general terms of use. However, we may process certain data about you on the basis of your consent, due to legal obligations, or to serve our legitimate interest.

6.1 Processing on the basis of the service contract

On the basis of the service contract, we process your data to:

  • Create and manage your account
  • Verify your company on the basis of your legal documents
  • Optimise your search engine ranking (providers) or suggest relevant search results (clients)
  • Ensure that the services offered are relevant (lead moderation, anti-spam policy)
  • Enable communication between users via an integrated secure instant messaging system
  • Send you communications related to your actions on the Marketplace (transactional emails)
  • Make your documents available to you (invoices, contracts, etc.)
  • Enable payment for your missions directly through the Marketplace and our partner Mangopay
  • Suggest a provider's profile in response to a specific client search
  • Allow the Client to centralise ongoing missions with providers in a dedicated interface
  • Assist you in using the platform

6.2 Processing on the basis of Labsquare's legitimate interest

On the basis of our legitimate interest, we process your data to:

  • Fulfil our clients' due diligence obligations under French law and allow providers to indicate that your company is compliant with its legal obligations ("verified company")
  • Accelerate payment for services by having previously transmitted the verification details of your legal structure to our partner MangoPay
  • Protect our providers against spam
  • Carry out personalised follow-up to send you only relevant communications tailored to your needs
  • Secure the labsquare.eu website and its variations, and the data exchanged on the site
  • Develop our services to offer you new features and adapt them to your needs (usage statistics, audience analysis, commercial tracking)
  • Assess your satisfaction and, if you agree, contact you to discuss it
  • Guarantee profile quality and combat fraud
  • Combat fraud in your message submissions and detect unsolicited content
  • Calculate your average message response time and display it to your contacts
  • Assist you in the event of difficulties using the platform or a dispute with another user
  • Communicate with you about products, services, promotions and news

6.3 Processing on the basis of your consent

We may collect your prior consent to process certain data, for example for the reuse of your profile picture on commercial materials, or when you have not created an account on the Marketplace but wish to receive our commercial offers or newsletter.

6.4 Processing on the basis of our legal obligations

We process certain data due to the legal obligations imposed on us in the context of managing payments made via the Marketplace, including anti-terrorism financing and anti-money laundering measures.

7. Recipients and transfers to countries outside the EEA

Labsquare is the recipient of personal data collected through the Site. Certain services and features require that we share information with other users or with our business partners. We may also share this information for legal reasons or in the event of a dispute.

We share your personal data with companies, organisations or individuals only in the following circumstances:

7.1 Sharing with clients

Sharing with clients of the provider's identification information and, where applicable, company information when the provider sends them a commercial proposal, and the legal documents relating to their services when a mission begins.

7.2 Sharing with trusted partners and service providers

Where necessary for external processing purposes, we transmit this data to our trusted partners and service providers. They process your data on our behalf, according to our instructions and in accordance with this Charter.

a) Data location

All our servers on which your data is stored are located in Europe. In exceptional cases, certain service providers may transfer your data to a country outside the EU. In such cases, we put in place a "transfer tool" such as standard contractual clauses to guarantee an equivalent level of protection.

b) Our service providers

  • MangoPay SA — Luxembourg (EU) — Payment management and anti-money laundering. Contact: legal@mangopay.com
  • Finexkap SAS — France (EU) — Provision of a cash advance service for providers.
  • Google Analytics / Chartio — United States (standard contractual clauses) — Statistical reporting.
  • Mandrill / Mailchimp — United States (standard contractual clauses) — Sending emails to site users.
  • MongoDB — United States (standard contractual clauses) — Database backups.
  • Google Cloud Platform — Belgium / United States (standard contractual clauses) — Hosting of data processed by Labsquare.
  • Calendly — United States (standard contractual clauses) — Scheduling appointments with client and provider managers.
  • Trust Pilot — EU / United States (standard contractual clauses) — Collection of user reviews.
  • Customer.io / Hubspot — United States (standard contractual clauses) — Marketing and email campaigns.

7.3 Sharing with our investors, accountants and auditors

Labsquare may share information relating to users registered on the Marketplace in order to respond to information requests from our investors, accountants and any auditors, in particular in connection with potential fundraising rounds.

7.4 With authorised third parties

We retain or disclose your information if we believe it is reasonably necessary to comply with any legal or regulatory obligation, any legal proceedings, to protect the safety of a person, or to address any fraudulent or security-related issue.

Labsquare does not sell your data to third parties and does not disclose personal information outside the situations described in this Charter.

8. Retention period

As a general rule, we retain your information during the following periods:

  • If you have completed missions, Labsquare retains your billing details for a period of 10 years from the closure/deletion of your user account in order to comply with our accounting and tax obligations.
  • For providers only, Labsquare also retains for a period of 10 years the legal documentation used to verify your company in order to meet the due diligence obligations of client buyers.

Depending on the specific situation, we may retain your personal data for longer periods, including for as long as necessary for the relevant activity, for any retention period required by law, or for the applicable limitation period.

9. Data security

We implement appropriate technical and organisational measures to ensure the ongoing security, confidentiality, integrity, availability and resilience of our information system and your data.

In particular, we are committed to:

  • Encrypting most of our services using SSL technology
  • Verifying your email address when you create your account
  • Conducting internal audits on the collection, storage and processing of data, including physical security measures
  • Restricting access to personal data to only those Labsquare employees and service providers who need it, subject to strict confidentiality obligations

10. Your rights

In accordance with the GDPR and the "Informatique et Libertés" Law, you have the right to object to the use of personal data concerning you, as well as rights of access, rectification, erasure, restriction, objection and portability. You also have the right to designate an administrator for your data in the event of your death.

10.1 Right of access

You have the right to access the data concerning you processed by Labsquare, enabling you to learn about the data we hold on you and to request a copy.

10.2 Right to rectification

You may request the correction of inaccurate personal data concerning you, or request that incomplete data be completed. We invite you to make these changes directly on your profile, or to write to us at privacy@labsquare.eu.

10.3 Right to erasure

You have the right to obtain the erasure, without undue delay, of personal data concerning you, subject to our legitimate interest or any legal obligation requiring us to retain it. For security reasons, we invite you to make this request from your logged-in account.

10.4 Right to restriction of processing

You may request the restriction of the processing of your data when one of the following applies:

  • You contest the accuracy of the data (restriction pending verification)
  • You consider the processing unlawful and oppose erasure
  • The data is still needed to establish, exercise or defend legal claims
  • You have exercised your right to object pending verification

10.5 Right to object

You may object to receiving communications, in particular commercial communications, from Labsquare via the unsubscribe link in all our emails. You may also object, on legitimate grounds, to any processing based on our legitimate interest.

10.6 Right to data portability

You may request the portability of your Labsquare data at any time. We undertake to transmit, within a reasonable timeframe and in a machine-readable format, the data you have provided to us.

10.7 Right to withdraw consent

To the extent that the processing of your data is based on your consent, you have the right to withdraw it at any time, without affecting the validity of prior processing.

10.8 Organising your data after your death

In accordance with Article 40-1 of the French Data Protection Act, you may give instructions regarding the retention, deletion and communication of your data after your death (general or specific directives). In the absence of such instructions, your heirs may in particular exercise the right of access (for estate settlement purposes) and the right to object (account closure).

10.9 Right to lodge a complaint with a supervisory authority

The competent supervisory authority in France is the Commission Nationale de l'Informatique et des Libertés (CNIL). You may also contact any data protection authority in your country of residence.

CNIL — Commission Nationale de l'Informatique et des Libertés

3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, France

Tel.: 01 53 73 22 22 (Mon–Thu 9am–6:30pm / Fri 9am–6pm)

Fax: 01 53 73 22 00

Online complaint: www.cnil.fr/fr/plaintes

Exercising your rights

For any question or to exercise your rights, contact our DPO:

  • By email: privacy@labsquare.eu
  • By post: DPO, Labsquare SASU, 17, rue de Rosheim – 67000 STRASBOURG, France

Glossary

Due diligence
When a French company engages a service provider, it must verify that the provider is a registered company that is up to date with its tax and social security obligations. This is the due diligence obligation as provided for under French law.
Provider
Any natural or legal person holding a SIRET number and registered with the Trade and Companies Register, the Trades Directory, or operating as an independent in legal conditions from France or abroad, who offers their services to Clients/Project Owners through the Site.
Cash advance (factoring)
Service offered by Labsquare allowing a Provider to be paid within 5 days of completing their mission, even if the client has payment terms of up to 60 days.