Privacy policy

Data controller

NUMISCLANE SAS — contact : mail@numisclane.fr — telephone: 09 77 33 68 84.

Data categories and purposes

• Account and authentication: email address, session and technical data necessary for security and access.
• Commercial access requests: work email, organization and optional message, to process the request.
• Invoicing and subscription evidence: Stripe customer and subscription identifiers, plan, billing status, linked email address, professional declaration and pseudonymized proof of acceptance of the terms of sale. Card numbers and sensitive payment data are entered into and processed directly by Stripe and are not received by MONIFACT.
• Abuse prevention: sign-in attempts, rate limits and pseudonymized IP address fingerprint where needed.
• Monitoring and market intelligence: professional information from registers, institutional websites, corporate documents, reputable media and other relevant public sources; collection is limited to data needed to document organizations, roles, relationships and events.
• Evidence and history: excerpts, metadata, access dates and fingerprints used to establish provenance and changes.

Legal bases

Performance of requested steps or of a contract is the legal basis for processing necessary to accounts and subscribed services. Depending on the processing operation, service security, abuse prevention and market intelligence rely on the publisher's legitimate interest in providing, securing and documenting the service, after balancing that interest against individuals' rights. Legal obligations are processed under their own legal basis.

Publicly accessible data

Source categories include official registers, institutional publications, company documents, public procurement records and publicly disseminated professional information. Individuals potentially mentioned include directors, representatives, professionals and organizational officers. Public availability of data does not remove GDPR requirements. MONIFACT does not publish structured profiles of natural persons; however, individuals' names may appear in information relating to companies, associations and official acts. Such mentions remain subject to necessity, accuracy and objection requirements. MONIFACT limits collection to information relevant to economic or professional analysis, prioritizes institutional sources and operating companies, does not collect explicit media and submits ambiguous matches to review. The right to information where data is collected indirectly (GDPR Article 14) is assessed according to the type of data and potentially applicable statutory exceptions: publication of this policy alone does not automatically establish that individual notice is unnecessary. Requests for correction, objection or erasure may be submitted via Report an issue.

Recipients and service providers

Data is accessible to authorized publisher personnel and providers strictly necessary for service operation. The infrastructure is hosted by OVHcloud in the European Union. Stripe processes payments, invoicing, fraud prevention and the subscription management portal under its own terms and data protection commitments. Card data remains on Stripe interfaces. MONIFACT currently uses Resend (smtp.resend.com) for transactional emails, including recipient addresses, messages and delivery logs. Resend states that it stores this data in the United States, even when a sending domain uses a European region. Its contractual documents provide safeguards for international transfers; see its data processing agreement and its list of subprocessors. OVHcloud acts as host; Stripe may act as payment provider and, depending on the operation, as independent controller or processor. Location and transfer safeguards must be assessed separately for each provider and service. OVHcloud publishes its data protection information and Stripe its data processing agreement.

Retention periods

Active commercial requests are retained for up to 180 days in the active database. Account data is retained throughout the relationship and subsequently for periods necessary to manage rights and obligations. Contract records are retained for periods necessary to evidence contracts and comply with legal obligations, subject to regular necessity reviews. Historical evidence is retained for as long as required for dataset traceability, subject to data subject rights, licenses, relevance and deletion obligations; full snapshots are retained only where a license or permission allows it.

Cookies and trackers

The current version uses neither behavioral advertising nor third-party audience analytics. Session, CSRF and language-preference cookies are used where strictly necessary for operation and security. Introducing non-essential trackers in future would require information and, where required by law, prior consent.

Your rights

Depending on the processing: access, rectification, erasure, restriction, objection and portability. You may request information about the sources and categories of data concerning you, object on grounds relating to your particular situation and request correction of an inaccurate match. A copy of an identity document is not routinely required; additional verification may be requested where reasonable doubt exists about a requester's identity. Requests are generally answered within one month, subject to lawful extensions and related notification requirements. You may also lodge a complaint with the CNIL, the French data protection authority. For indirectly collected data, include the relevant URL or organization to facilitate prompt identification.

Security and breaches

MONIFACT uses HTTPS, service separation, access controls, CSRF/session protection, attempt rate-limiting, private storage of permitted snapshots and backups, among other measures. Data breaches are assessed and, where required by the GDPR, notified to the competent authority and the individuals concerned.