1. Who are we?
- Name: ROADMAPHERO ("we", "our", "us")
- Registered Office: 58 rue de Monceau, 75008 Paris, France
- RCS: 924 910 391
- Software: Chamallo (the "Software")
- Service: The provision of the Software (the "Service")
- Website: roadmaphero.com (the "Website")
- Contact for data protection questions: privacy@roadmaphero.com
2. Who are the data subjects?
2.1. We process personal data concerning:
- our clients' representatives;
- users accessing the Software made available by our clients within the framework of the Service (the "Software Users");
- our suppliers' and service providers' representatives;
- applicants for employment within our company;
- visitors to our Website or premises; and
- other data subjects, as applicable
(collectively, the "data subjects", "you/your").
2.2. This privacy policy (the "Policy") applies to any processing of your personal data that we carry out.
3. What is our commitment regarding data protection?
3.1. We undertake to use our best efforts to ensure that our personal data processing activities comply with applicable data protection legislation, including notably Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the "GDPR"), as well as the French Act of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended, supplemented or replaced (the "Applicable Data Protection Legislation").
4. For what purposes do we process your personal data?
4.1. If you are a representative of one of our clients, we process:
- your personal identification data, professional identification data, and contact details in order to activate, manage, and continue the commercial relationship with our clients;
- your personal and professional identification data to ensure the follow-up of our clients' billing;
- where applicable, your bank details to ensure the follow-up of payment of invoices related to our Service;
- where applicable, your personal and professional identification data and contact details for sending communications for commercial prospecting purposes.
4.2. If you are a Software User, we process notably the following categories of data, for the purposes described below:
- your electronic identification data to authenticate you on the Software, for the activation, suspension, and deletion of user accounts, for the detection and prevention of fraud and IT security breaches, as well as for logging access to the Software;
- your contact details to allow our support team to contact you within the framework of assistance activities.
4.3. If you are a representative of one of our suppliers, we process your personal and professional identification data and contact details to manage the commercial relationship with our suppliers.
4.4. If you are an applicant for employment within our company, we process your personal and professional identification data, contact details, as well as data relating to your professional life (skills, qualifications, experience, etc.) and personal data contained in your curriculum vitae, to assess your profile regarding our recruitment needs.
4.5. If you visit our Website, we may process your electronic identification data, in aggregated form, to measure the attendance of our Website, improve your browsing experience, and detect and prevent fraud and IT security breaches.
4.6. If our premises are equipped with video surveillance devices, we may request access to images concerning you only when such access is necessary to pursue our legitimate interest in detecting offenses or incivilities, and to the extent permitted by applicable legislation.
4.7. We may also process certain of your personal data for the following purposes:
- conducting restructuring operations of our activities;
- conducting internal and external audits;
- managing disputes with data subjects and, where necessary, establishing, exercising, or defending legal claims.
4.8. We do not subject data subjects to decisions based exclusively on automated processing producing legal effects concerning them or significantly affecting them in a similar way.
4.9. If you are a Software User and you authenticate on the Software via your Google account, we will connect your Software account to your Google account, and you will authorize us to access certain of your Google data only to the extent necessary for the following operations:
- send emails on your behalf from your Software account, including attachments, metadata, headers, and your email signature;
- access documents from the Google Drive account linked to your Software account and store them.
4.10. We will not use any of your Google data for advertising purposes.
4.11. We adhere to the Google API Terms of Service, and RoadmapHero's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. In what capacity do we process your personal data?
5.1. We process your personal data as a data controller, with the exception of personal data that we process in the Software on behalf of our clients (such data is then treated as a processor on behalf of our clients).
5.2. However, we process the electronic identification data of Software Users as a data controller for the purposes of authenticating users on the Software, activating, suspending, and deleting their accounts, as well as detecting and preventing fraud and IT security breaches. We also process Software Users' contact details as a data controller for the purpose of carrying out our support activities.
6. On what basis do we process your personal data?
6.1. The communication of your personal data may be necessary:
- for the performance of a contract to which you are a party or for the performance of pre-contractual measures taken at your request (for example, in case of a request for collaboration with us);
- to comply with a legal obligation applicable to us (e.g., accounting, tax obligations, etc.);
- to pursue our legitimate interests (or those of a data recipient), provided that these interests do not override your fundamental rights and freedoms.
6.2. We request your prior, free, and informed consent before processing certain of your personal data (for example, when processing involves a transfer of image rights concerning you).
6.3. The provision of certain of your personal data (for example, your personal identification data, etc.) may be a necessary condition for the provision of our services or the carrying out of our activities.
6.4.Possible consequences of refusing to provide your personal data may include our inability to provide our services or carry out our activities, or result in a breach by us of one or more legal obligations incumbent upon us (e.g., accounting and tax obligations).
7. Where do your personal data come from?
7.1. The personal data we process comes from the following sources:
- directly from you, for example, during our first contact;
- from extensive public information (on the Internet), for example, when we consult the profile of applicants applying for a job within our company.
8. Who has access to your personal data?
8.1. The following recipients may receive or have access to certain of your personal data (only if necessary for the performance of their missions):
- members of our staff responsible for commercial and administrative follow-up have access to personal identification data, professional identification data, and contact details of our clients' representatives;
- members of our staff responsible for monitoring our suppliers have access to personal identification data, professional identification data, and contact details of our suppliers' representatives;
- our legal advisors and lawyers have access to certain personal data of data subjects in the context of restructuring operations of our activities or disputes;
- as in most software companies, a limited and named number of our technical staff must have access to certain personal data stored via the Software, solely on a strict need-to-know basis and only when required by law or when strictly necessary for correction and/or maintenance of the Software.
8.2. We entrust the processing of certain of your personal data to processors only to the extent necessary for the performance of their missions, in accordance with our written instructions and the Applicable Data Protection Legislation.
8.3. In the event of a restructuring of our activities (for example, a financing operation), we may transfer certain personal data concerning a limited number of data subjects to a third party involved in the operation (for example, a bank), in accordance with the Applicable Data Protection Legislation.
9. How do we manage our processors?
9.1. We take appropriate measures to ensure that our processors process your personal data in accordance with the Applicable Data Protection Legislation.
9.2. We ensure notably that our processors undertake to process personal data only on our instructions, not to recruit subsequent processors without our prior authorization, to implement appropriate technical and organizational measures to ensure the security of personal data, that persons authorized to access personal data are subject to adequate confidentiality obligations, to return and/or delete personal data they process at the end of their services, to submit to audits and to provide us with assistance for processing requests from data subjects regarding the exercise of their rights over their personal data.
List of processors :
Emailing and SMS (transactional and marketing) :
- Plunk | France / Deutschland | Privacy Policy
For CRM (incl. chat, phone & support) :
- Crisp | Netherlands / Deutschland | Privacy Policy
Hosting, Database & Gen IA
- Vercel (website and application hosting) | Data processing : Europe (chosen region) Entity : Vercel Inc. (USA) | Privacy Policy
- Google Cloud Platform (GCP) & Vertex AI | Data processing : Belgium Entity : Google Cloud EMEA Ltd (Irlande) | Privacy Policy
- Supabase (database) | Data storage and processing : Europe | Privacy Policy
Audience measurement :
- Umami (privacy-friendly analytics: no cookies, no identifying personal data) | Entity : Umami Software, Inc. (USA) | Privacy Policy
For payments :
- Stripe Payments Europe Limited | Irland | Privacy Policy
10. Where do we process your personal data?
10.1. We strive as much as possible, without harming the quality of the user experience, to favor European suppliers. In cases where this is not possible (notably in the absence of an equivalent service), certain recipients of personal data may be organizations whose headquarters are located in a country outside the European Economic Area ("EEA"), or may process certain personal data from a country located outside the EEA.
10.2. In the event that certain of your personal data are transferred to countries located outside the EEA, we will ensure to implement the following safeguards:
- the country to which the data is transferred benefits from an adequacy decision of the European Commission in accordance with Article 45 of the GDPR, and the transfer falls within the scope of this adequacy decision;
- we have concluded a contract with the data recipient containing the standard data protection clauses adopted by the European Commission in accordance with Article 47 of the GDPR.
11. What are the applicable retention periods?
11.1. We ensure that your personal data is only kept for the time necessary for the purposes for which it is processed.
11.2. We keep invoices and other accounting documents (which may contain certain of your personal data) for a period of seven (7) years from the end of the financial year in which they were issued, in accordance with accounting obligations. These accounting documents may, where applicable, contain certain personal identification data, professional identification data, and contact details.
11.3. We also use the following criteria to determine the retention periods for personal data depending on the context and purposes of each processing activity:
- the date of our last contact;
- security reasons (for example, the security of our information systems);
- any current or potential dispute with a data subject;
- any legal obligation to retain or delete personal data (for example, an obligation imposed by accounting or tax legislation).
11.4. Client data is retained for up to three (3) years after the end of the Contract.
11.5. The Client may request the deletion of their data via hello@chamallo.com.
11.6. The request is processed within a maximum period of one (1) month.
12. What are your rights regarding your personal data?
12.1. Subject to the Applicable Data Protection Legislation, you have the right to information, the rights of access, rectification, and erasure of your personal data, the right to object to or restrict the processing of your personal data, the right to the portability of your data, and the right to withdraw your consent.
12.2. Below is a table describing each of your rights in more detail:
Right to information: You have the right to obtain clear, transparent, and understandable information on how we process your personal data and on how to exercise your rights. This information is contained in the Policy.
Right of access: You have the right to obtain confirmation that we process your personal data and, where applicable, to access it. You have the right to obtain a copy of your data, unless the exercise of this right infringes the rights and freedoms of other data subjects.
Right to rectification: You have the right to have your data rectified if it is inaccurate. You also have the right to have your data completed if it is incomplete.
Right to erasure ("right to be forgotten"): You have the right to obtain the erasure of your data. However, this right is not absolute and is subject to certain conditions. We may retain certain of your data where the law allows, notably when their processing remains necessary to comply with a legal obligation applicable to us or for the establishment, exercise, or defense of legal claims.
Right to object: You have the right to object to certain processing (for example, where the processing is based on our legitimate interests and, given your particular situation, your fundamental interests or freedoms override).
Right to object to processing for prospecting purposes: You have the right to object at any time to the processing of your data when it is used for commercial prospecting purposes.
Right to restriction of processing: You have the right to obtain the restriction of processing in certain circumstances (for example, where we no longer need your data but it is still necessary for the establishment, exercise, or defense of legal claims).
Right to data portability: You have the right, in certain circumstances, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit this data to another controller.
Right to define post-mortem guidelines: You have the right to define general or specific guidelines concerning the retention, erasure, and communication of your data after your death.
Right to withdraw your consent: When you have given us your consent for a processing, you have the right to withdraw it at any time.
12.3. Any request relating to the exercise of your rights regarding the data we process as a data controller must be addressed to our contact dedicated to data protection, using the contact details mentioned in the Policy. We undertake to respond to your request as soon as possible and always within the time limits provided by the Applicable Data Protection Legislation. We may retain certain data where the law requires or allows it. In case of doubt about your identity, we may ask you for proof in order to prevent unauthorized access to your data.
12.4. You can only exercise your rights with respect to the Company to the extent that we process your data as a data controller. If your request concerns processing for which we act as a processor, we will forward your request to the relevant data controller.
13. What level of security do we guarantee?
13.1. We take appropriate technical and organizational measures to guarantee a level of security adapted to the risks associated with the processing of your personal data.
13.2. We follow industry best practices to prevent personal data from being accidentally or unlawfully destroyed, lost, altered, disclosed without authorization, or accessed without authorization.
14. Do you have questions or complaints?
14.1. If you have questions or complaints regarding the way we process your personal data, please contact our contact person dedicated to data protection questions as a priority using the contact details indicated in the Policy, namely: privacy@roadmaphero.com
15. Limitation of Use
The Client is prohibited from notably:
- any automated or massive extraction (scraping),
- any voluntary overload,
- any attempt at intrusion or unauthorized security analysis,
- any technical circumvention of the Service.
The Company may suspend access immediately in case of non-compliant use.
DPO / Privacy Contact
For any request regarding your personal data.
A question? Write to us at hello@chamallo.com