PRIVACY POLICY

1. Purpose

This policy explains how personal data are processed in connection with the DB2 professional platform. It concerns in particular the people who create an account, manage a subscription, use the platform or request support.

2. Identity and role of IXO ELECTRONIQUE SAS

IXO ELECTRONIQUE, ZAT de Marticot, 33610 Cestas, France, RCS Bordeaux 401 566 617, is the controller of the processing needed to manage the platform, accounts, subscriptions, payments, support requests and security.

For the data contained in the test results that its professional customers choose to have processed in DB2, IXO ELECTRONIQUE acts, where such data are personal, in principle as a processor on behalf of the customer, who determines their purposes and uses. The obligations of the parties in this respect are set out in their contractual data processing provisions.

Data protection contact: info@ixoelectronique.fr.

3. Categories of data processed

Depending on the features used, DB2 may process:

• user data: identity, business contact details, company, account credentials, access rights and related settings;
• commercial management data: chosen plan, number of testers, subscription dates, order, invoicing and payment information;
• technical data: IP addresses, login information, security events and logs needed to administer the platform;
• battery test results: tester identification, dates, measurements, reports and additional information entered by users, which may include vehicle identifiers or other information likely to be personal.

The results come in particular from the messages transmitted by the Midtronics BMIS service or from information added by users. Midtronics remains responsible for its own processing, under the conditions that apply to it.

4. Purposes and legal bases

The data are used to:

• create and manage accounts, provide the subscribed features and administer subscriptions (performance of the contract, or legitimate interest of IXO ELECTRONIQUE where the user acts on behalf of a company);
• issue invoicing documents and comply with accounting and tax obligations (legal obligation);
• respond to support requests and ensure the continuity of the customer relationship (performance of the contract or legitimate interest);
• secure access, prevent abuse and diagnose incidents (legitimate interest in protecting the service and its users);
• host, organise and make available the test results in accordance with the instructions and authorisations of the professional customer (processing carried out on behalf of the customer as controller, where such data are personal).

DB2 is not intended to use customers’ test data for advertising purposes or to sell them.

5. Access and recipients

The information is accessible, according to the applicable authorisations, to the customer’s authorised users and to the people in charge of operating and supporting DB2, within the limits of their duties. Supervision features only give access to the data within the authorised scope. Test results produced by a user remain accessible to the owner of their group and to the higher-level administrators, including after their account has been deleted.

The data may also be processed by the technical service providers needed for the service, in particular Infomaniak Network SA for hosting, as well as by accounting service providers or by authorities where required by law. Such access is governed by the applicable obligations.

6. Hosting and international transfers

DB2 is hosted by Infomaniak Network SA, a company established in Switzerland. Switzerland benefits from an adequacy decision of the European Commission on data protection.

The location of technical processing, backups and any additional services depends on the services actually used. Any other transfer of personal data outside the European Economic Area is subject, where applicable, to a protection mechanism compliant with the GDPR.

7. Retention periods

Account and subscription information is kept for the duration of the contractual relationship, and then for the time needed to handle requests, comply with legal obligations and defend the rights of IXO ELECTRONIQUE. Accounting records are kept for the applicable legal period, in principle ten years.

Test results are kept in DB2, including after deletion of the account that produced them, and remain accessible according to the rights of authorised accounts, in particular the group owner and the higher-level administrators. Their deletion is organised in accordance with the contractual conditions and the applicable legal obligations.

An account deleted by its user is kept for 8 days so that it can be recovered. At the end of this period, the account is closed for good: the password, photo, sessions, access tokens and associated devices are deleted. The name and email address remain linked to the test results submitted by the account to ensure their traceability, on the basis of the legitimate interest of the client company and of IXO ELECTRONIQUE; billing information is kept for the legal period.

Technical logs and backups are kept for limited periods, determined according to security, maintenance and restoration needs, and then deleted according to the applicable technical procedures.

8. Security

IXO ELECTRONIQUE SAS implements technical and organisational measures appropriate to the risks to protect the data, in particular through the management of authorisations, secure access and maintenance operations. In the event of an incident involving personal data, the notification and information obligations provided for by the GDPR are applied where required.

9. Rights of data subjects

Under the conditions provided for by the GDPR, data subjects may request access to their data, its rectification or erasure, the restriction of its processing and, as the case may be, object to the processing or exercise their right to data portability.

Deleting the account from the profile amounts to a request for erasure of the account’s personal data. It is carried out at the end of the 8-day recovery period, under the conditions described in section 7; test results, together with the name and email address showing their origin, are kept on the basis of legitimate interest.

For the processing for which IXO ELECTRONIQUE is the controller, requests may be sent to info@ixoelectronique.fr or by post to the registered office. A reply is given within the legal time limits. Where there is reasonable doubt about the identity of the requester, a proportionate verification may be requested.

Where the information concerns test results processed on behalf of a customer company, data subjects are invited to contact that company, as controller, first. IXO ELECTRONIQUE assists it under the conditions provided for by the GDPR.

Anyone may also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), in particular at https://www.cnil.fr.

10. Cookies

DB2 only uses cookies that are strictly necessary for the platform to work and to provide the service requested by the user. These cookies make it possible to:

• keep the user’s session after login (session cookie);
• keep the user logged in when they tick the “Remember me” option;
• protect forms against fraudulent requests (security token);
• keep operating choices, such as the display language, for the duration of the session.

These cookies are set by DB2 itself. DB2 does not use any cookies or trackers for advertising, audience measurement, statistics, profiling or social media. The information contained in these cookies is not sold, rented or transferred to third parties.

In accordance with Article 82 of French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, these cookies, being strictly necessary for the service expressly requested by the user, do not require their prior consent. The session cookie expires after a period of inactivity; the “Remember me” cookie is deleted on logout and, in any event, when its validity period ends.

The user may delete or block these cookies at any time through their browser settings. In that case, logging in to DB2 and some features may no longer work properly.

Should DB2 use other cookies or trackers that are not strictly necessary, they would only be set after informing the user and obtaining their prior consent, and this policy would be updated accordingly.

11. Updates to the policy

This policy may be amended to take account of changes to the service or to the regulations. The current version is available on DB2. Any substantial change concerning the processing is brought to the attention of the data subjects under the applicable conditions.