Orinexis

Who is responsible for your data?

Appolo (EURL)
151 rue du Poumet
64170 Artix
SIRET: 508 275 567 00032
VAT: FR02508275567

For any question about your personal data or to exercise your rights: contact to be provided by the platform administrator.

The application is operated and hosted by INFONEXIS, which acts on behalf of the data controller (processor).

Which data, why and for how long?

User accounts

Why (purpose)

Create and manage your account, identify you, give you the rights linked to your role and send you the application's notifications

Data concerned

identity (first name, surname), email address, photo (optional), language and display preferences, access profile, groups and entities, notifications received

Legal basis

Exécution du contrat

Who has access

Instance administrators, Authentication console

Retention period

anonymisation after 5 years of the person leaving (account deactivated)

Logins, sessions and devices

Why (purpose)

Keep you signed in, protect your account (two-factor authentication, remote sign-out) and detect abnormal access

Data concerned

IP address, browser, dates of login and last activity, identifier at the identity provider

Legal basis

Intérêt légitime

Who has access

Yourself (My profile > Security), Instance administrators, Authentication console

Retention period

suppression after 1 months of the device's last activity (30 days by default)

Activity logs

Why (purpose)

Security, action traceability and usage analysis

Data concerned

identity, IP address, completed actions

Legal basis

Intérêt légitime

Who has access

Instance administrators

Retention period

suppression after 1 year since the event

Application firewall log

Why (purpose)

Service security: detecting intrusion attempts and blocking bots

Data concerned

IP address, browser, fingerprint of the username tried (never in clear text), domain of the address tried

Legal basis

Intérêt légitime

Who has access

Instance administrators, Hosting provider (server firewall)

Retention period

suppression after 3 months since the event

Tray receipts

Why (purpose)

Keep dropped receipts and invoices until they are reused in an expense report or a document

Data concerned

identity, expenses, photos of receipts

Legal basis

Intérêt légitime

Who has access

The user, Accounting (shared trays)

Retention period

suppression after 1 year from the drop of a receipt never reused (a reused receipt follows the document that uses it)

Emails sent by the application

Why (purpose)

Notifications, documents and messages sent to users and third parties

Data concerned

identity, email address, message content

Legal basis

Intérêt légitime

Who has access

Sending provider (SMTP)

Retention period

beyond the number of messages kept (10,000 by default), 30-day bin

Depending on the modules enabled in your organisation, other processing may concern you (human resources, time tracking, expense reports, etc.): it is described in the notice given by your employer and in the record of processing activities.

Cookies and trackers

These cookies are essential for the service to work: they are not used for advertising or audience measurement, and no third-party tracker is used. Your display preferences (theme, table columns, etc.) are stored in your account, not in your browser.

Who else is involved in processing your data?

To run the service, the data controller uses the following providers (processors):

• Hébergeur de l'instance (INFONEXIS) : Hébergement et exploitation de la plateforme (France)
• Console d'authentification Orinexis : Authentification, mots de passe et double authentification (France)
• Prestataire d'envoi d'e-mails (SMTP) : Envoi des e-mails de l'application (notifications, documents, messages) (Selon le prestataire choisi)
• Géoplateforme de l'IGN : Recherche d'adresses, itinéraires et distances (France)

Transfers outside the European Union: Prestataire d'envoi d'e-mails (SMTP) (Selon le prestataire choisi). These transfers are covered by the following safeguards: Contrat de sous-traitance du prestataire.

How your data is protected

• Encrypted connections (TLS); API keys, bank details (IBAN) and bin snapshots encrypted with a key specific to the instance
• Delegated authentication (passwords never stored by the application); two-factor authentication required for administrators; time-limited sessions and remote sign-out
• Permissions by profile and by user group; sensitive personal data protected by a specific permission; partitioning by entity
• Activity log (logins, creations, modifications, deletions, exports) and data modification history
• Bin of 30 days before permanent deletion; archiving, anonymization and deletion when retention periods expire
• Erasure at a person's request: immediate, bin included; access keys and recalculated data never kept in the bin
• Backups: retention period to be specified by the instance host

Your rights

You may at any time, under the conditions laid down by the General Data Protection Regulation (GDPR):

• obtain access to your data and receive a copy;
• request their rectification if they are inaccurate or incomplete;
• request their erasure, where no legal obligation or legitimate purpose justifies keeping them;
• request the restriction of processing;
• object to processing based on legitimate interest, or withdraw your consent where it is the basis of the processing;
• request the portability of the data you have provided, where the processing is based on your consent or on a contract.

To exercise these rights, write to the contact given above; you will receive a reply within one month. Proof of identity may be requested. If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

You can also, without writing to us, correct your surname, first name and e-mail address, your photo and your preferences in “My profile”, view the devices connected to your account and sign them out remotely (My profile > Security).