Privacy policy

The controller of the processing operations described below is T2ND SAAS, a SASU (simplified joint-stock company with a sole shareholder) with a share capital of €1,000, registered in the Lille Métropole Trade and Companies Register (RCS Lille Métropole 107 995 631), 34 place du Général de Gaulle, Bureau 3, 59800 Lille (“cocoPIM”, “we”, “us”), reachable at contact@cocopim.fr. For any question relating to personal data, a data protection contact can be reached at the dedicated address rgpd@cocopim.fr.

Special case: for the personal data that our customers import into their catalog (the PIM service), the customer remains the controller and cocoPIM acts as a processor (Art. 28 of the General Data Protection Regulation, GDPR). See the Terms of Use and Sale and the data processing agreement (DPA).

• Account and organization (email address, first and last name, company, role). Legal basis: performance of the contract. Purposes: provision of the service, authentication by a sign-in code sent by email, management of workspaces and access rights.
• Single sign-on (enterprise SSO), when your organization enables it (stable identifier provided by its identity provider, last email address received, date of last sign-in). Legal basis: performance of the contract. The identity provider is chosen and administered by your organization, which is responsible for it. Retention: the lifetime of the account (erased along with it); sign-in events follow the audit log (§5).
• Verification of your email address at sign-up (email address, one-time code stored as a hash, number of attempts). Legal bases: pre-contractual measures taken at your request, and legitimate interest (security, prevention of abusive sign-ups). Anti-abuse counters keep, for 24 hours, a non-reversible hash of the address, of its domain and of the IP address used.
• Subscription and billing (email address, first and last name, company, organization identifier, then billing details, VAT number and payment history; card data is processed directly by Stripe and is never stored by cocoPIM). Legal bases: performance of the contract and legal obligations (accounting and tax). An account is created with our service provider Stripe as soon as your free trial starts, including when no payment method is saved and no payment is made.
• Contact form and email exchanges with our teams (name, email address, company, message, including demo requests). Legal basis: pre-contractual measures / legitimate interest in responding to requests.
• CoCo assistant in the application (questions asked and answers given; when a request is forwarded to support, email address and conversation with the assistant). Legal basis: performance of the contract (help with using the service). Answers are generated by our AI provider (Mistral AI, §3).
• Per-user activity statistics (actions performed in the application, linked to the user's identifier). Purpose: usage analytics dashboards for the organization's administrators. Legal basis: the customer's legitimate interest in monitoring the activity on its catalog. The organization owner can disable this collection in the settings.
• Technical logs (connection and usage logs, IP addresses). Legal basis: legitimate interest (security, fraud prevention, evidence). The service's audit logs record the actions performed in the customer's organization.
• Transactional emails (sign-in and sign-up codes, service notifications). Legal basis: performance of the contract. No direct marketing without consent.
• End-of-trial notices and proof that they were sent (cryptographic hash and masked form of the recipient address, subject, sending date and status). Legal bases: performance of the contract for sending the notices (Terms of Use and Sale, Art. 5.8), and legitimate interest for retaining proof of them, since no account can be closed unless we are able to demonstrate that we informed the customer beforehand (Art. 5.2 GDPR).

No data is sold or rented to third parties. No advertising profiling.

The service and its data are hosted in France (OVHcloud). Your Customer Data (catalog) is stored there and is processed exclusively within the European Economic Area (EEA). Data flows that you trigger yourself to recipients of your choice (connectors, webhooks, API, exports, identity provider) fall under your instructions and do not constitute transfers made by us.

Our generative AI processing relies on a European provider (Mistral AI, France). Your content is not used to train its models and is not retained beyond the time needed to generate the response: we have disabled the use of our calls for training purposes and obtained the activation of the “zero data retention” option on our account. This processing is hosted in the European Economic Area (France, Sweden, Norway); any transfers by Mistral AI's own sub-processors outside the EEA are governed by standard contractual clauses of the European Commission.

Two exceptions, neither of which concerns Customer Data:

• Payments: our service provider Stripe (Stripe Payments Europe Ltd, Ireland) may transfer certain data related to billing and fraud prevention to Stripe, Inc. (United States), under Stripe's standard safeguards: the European Commission's standard contractual clauses incorporated into its data processing agreement, Stripe, Inc. being furthermore certified under the EU-U.S. Data Privacy Framework.
• Email: our @cocopim.fr addresses (contact form, support, sales correspondence) are hosted by Google Workspace, with data stored in the European Union; any transfers to Google LLC (United States) are governed by the European Commission's standard contractual clauses and by Google LLC's Data Privacy Framework certification.

• OVHcloud (France): hosting of the site and of the service.
• Stripe: payment processing and subscription management. Stripe acts as a processor for the execution of payments, and as an independent controller for its own obligations (fraud prevention, regulatory obligations of payment institutions). The contracting entity is Stripe Payments Europe, Ltd (Ireland); any transfers outside the EEA are governed by the safeguards of Article 46 GDPR (standard contractual clauses incorporated into its data processing agreement, Data Privacy Framework certification of Stripe, Inc.).
• Mistral AI (France): generation of AI content (at the user's request or according to the AI field rules the user has configured) and answers from the CoCo assistant; hosting in the EEA.
• Brevo (France): sending of transactional emails (sign-in and sign-up codes, service notifications).
• Google (Google Cloud EMEA Ltd, Ireland): business email for the @cocopim.fr addresses (Google Workspace), data stored in the European Union, any transfers subject to safeguards (§3).

The up-to-date list of processors is available on request at contact@cocopim.fr; any substantial change is notified to customers.

Each category of data is retained for the period strictly necessary for the purposes described in §2. The triggering event for the deletion of the account and its data is the closure of the account, which occurs: at your request; at the end of your paid subscription; or, when your free trial ends without a subscription or a choice of the free Discovery plan, 15 days after the end of that trial, after five notices sent by email (Terms of Use and Sale, Art. 5.8).

• Account and organization data (including the catalog): for the entire period of use of the service, then until the closure of the account; permanent deletion at the end of the 30-day restoration window that follows closure (that is, for an unconverted trial, no more than 45 days after its end).
• Billing documents: 10 years (accounting obligation).
• Audit log of the actions performed in the organization, including sign-in events (sign-ins, failed attempts, sign-outs, password changes): rolling 12 months (automatic purge).
• Usage statistics feeding the analytics dashboards: 90 days.
• Logs of calls to AI features (traceability and quotas): 90 days.
• Requests made to the assistant and forwarded to support (email address and conversation with the assistant): 90 days.
• AI credit consumption ledger (quota statistics for the organization owner): 12 months, with the user's identity erased after 90 days.
• Logs of our administrators' access to customer workspaces (traceability of what was viewed and of support and maintenance actions): 13 months.
• Verification codes sent by email: the sign-in code (valid for 10 minutes) is erased within the hour following its use or expiry; the sign-up code and the associated address are erased 24 hours after the code expires.
• Technical and connection logs (IP addresses, security): 12 months maximum.
• Proof that end-of-trial and closure notices were sent: 5 years from sending. This proof does not keep your email address in plain text: it records a cryptographic hash (SHA-256) of the address and a masked form (for example t***@example.com), which are enough to demonstrate that the notice was sent without keeping the data itself.
• Contact requests: 3 years after the last exchange.
• Stripe billing account: created as soon as the free trial starts (even without payment); deleted along with the account, at the end of the 30-day window that follows closure, if it carries no invoice; otherwise retained for 10 years with the billing documents (accounting obligation).
• Backups: deleted data disappears from backup copies at the end of their rotation cycle, which does not exceed 30 days (OVHcloud managed PostgreSQL offering: automatic, daily and encrypted backups, current retention of 2 days, which may be extended to 14 or 30 days depending on the plan subscribed). A backup is never restored for the purpose of reintroducing deleted data.

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the rights of access, rectification, erasure, restriction, objection and portability regarding your personal data. To exercise them: contact@cocopim.fr (response within one month). You may lodge a complaint with the CNIL (the French data protection authority, cnil.fr).

Right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, in particular to follow-up and reactivation messages sent to an account that has not converted or has become inactive. This objection has no effect on the messages necessary for the performance of the contract and for informing the customer in advance, namely end-of-trial and closure notices (Terms of Use and Sale, Art. 5.8) and security and billing messages, nor on the retention of proof that they were sent (§5), which we must be able to produce.

The cocopim.fr site sets no audience measurement or advertising cookies. Only strictly necessary cookies are used:

• Theme preference (light/dark): local storage, kept for the lifetime of the browser.
• cocoPIM application (app.cocopim.fr and subdomains): secure session cookie (authentication) and language preference, strictly necessary for operation, exempt from consent (CNIL deliberation).
• List display preferences (cocoPIM application): sort column, number of rows per page and display mode, stored in the browser's local storage, per account and per workspace, never sent to the server; no typed text or filter is kept there. Duration: until you erase them yourself.

As these cookies are essential, they do not require a consent banner; a notice is nevertheless displayed on the first visit to the application.

The technical and organizational measures protecting your data (encryption in transit, per-customer isolation, access control, daily database backups) are described on the Security page.

This policy may change as the service evolves; the date of the last update appears at the top of the page and any substantial change is notified to the users concerned.