Privacy Policy

Preamble

Bivariant, a French simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 1,036.22, registered with the Paris Trade and Companies Register under number 978 682 565, having its registered office at 9 rue des Colonnes, 75002 Paris, France ("Bivariant", "we", "us" or "our"), provides Presence, a collaborative workspace with integrated artificial intelligence agents.

This Privacy Policy (the "Policy") is intended to inform data subjects, in a clear and transparent manner, of the conditions under which Bivariant processes their personal data, in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data (the "GDPR") and French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties (the "French Data Protection Act").

This Policy should be read together with the Terms of Service and the Data Processing Agreement, which govern the contractual relationship between Bivariant and its Customers.

In the event of any discrepancy between the French and English versions of this Policy, the French version shall prevail.

1. Definitions

Capitalized terms used in this Policy have the meanings set out below, whether used in the singular or plural. Terms not defined herein have the meaning given to them in the GDPR.

"Services" means the Presence platform, accessible through web browsers, mobile and desktop applications, application programming interfaces and widgets, together with the related support and assistance services.

"Customer" means the legal entity or professional that has subscribed to the Services, including under a free plan.

"Workspace" means the environment dedicated to a Customer within the Services.

"User" means any natural person authorized by a Customer to access its Workspace.

"Correspondent" means any natural person, other than a User, who communicates with a Customer through the Services, in particular via instant messaging, SMS, email, telephone or widget.

"Customer Data" means all content and data, including personal data, submitted to the Services by a Customer, its Users or its Correspondents, or generated by the Services on behalf of the Customer, including conversations, notes, collections, files, transcripts and outputs produced by Agents.

"Agent" means an artificial intelligence system configured by a Customer within its Workspace and capable of interacting with individuals and performing actions.

"Blueprint" means an application template that can be installed in a Workspace, published by Bivariant or by a third-party publisher.

"Integration" means any connection between the Services and a third-party service enabled by a Customer.

2. Scope

This Policy applies to the processing of personal data carried out in connection with the provision of the Services and the operation of the Presence website. It concerns Users, representatives and contacts of Customers and prospects, website visitors and, within the limits set out in Section 3, Correspondents.

This Policy does not apply to third-party services accessible from the Services, including Integrations and Blueprints published by third-party publishers, whose processing activities are governed by their own policies.

Where the Services are deployed on a Customer's own infrastructure, the Customer alone operates the data processed. Bivariant accesses such data only under the conditions set out in the applicable agreement.

3. Bivariant's Role

Bivariant's role under the GDPR depends on the nature of the data processed. This distinction determines who decides on the purposes and means of processing and, consequently, to whom data subjects should address their requests.

Bivariant acts as a controller with respect to data relating to the management of the contractual and commercial relationship, account administration, billing, the security of the Services and the operation of its website. These processing activities are described in Sections 4 and 5.

Bivariant acts as a processor, within the meaning of Article 28 of the GDPR, with respect to Customer Data. Each Customer is the controller of its Customer Data and determines the purposes for which it uses the Services. The Customer is responsible for informing data subjects, relying on an appropriate legal basis and responding to their requests. Bivariant processes Customer Data solely on the documented instructions of the Customer, in accordance with the Data Processing Agreement. Bivariant's commitments regarding Customer Data are set out in Section 6.

Users and Correspondents are invited to direct any question relating to Customer Data to the relevant Customer. Bivariant will forward to the Customer any such request it receives directly.

4. Data Processed by Bivariant as Controller

Bivariant collects only data that is adequate, relevant and limited to what is necessary for the purposes pursued. Such data is provided directly by data subjects or by the Customer, obtained from third parties or collected automatically when the Services are used.

Data provided by data subjects or by the Customer includes identification and contact data (last name, first name, business email address, telephone number, job title, organization), account data (login credentials, preferences, profile picture), billing data (company name, address, VAT number, transaction history) and the content of communications with our teams.

Data obtained from third parties includes information provided by an identity provider where the User chooses to sign in through it, payment information provided by our payment service provider, which never transmits full payment card numbers to us, and, where applicable, publicly available professional information about prospects.

Data collected automatically includes connection and device data (IP address, session identifiers, browser and operating system type), event and security logs, and data relating to the use of the Services, including the features used and related consumption.

5. Purposes and Legal Bases

Each processing activity carried out by Bivariant as controller serves a specified, explicit and legitimate purpose and relies on one of the legal bases set out in Article 6 of the GDPR. The table below provides an overview.

Upon expiry of the periods indicated, data is deleted or irreversibly anonymized. Data may be retained in intermediate archives, with restricted access, for as long as necessary to comply with a legal obligation or to handle litigation.

6. Customer Data

Customer Data belongs to the Customer, which retains control over it throughout the contractual relationship. Bivariant processes Customer Data for the sole purpose of providing the Services, under the conditions set out in the Data Processing Agreement.

Bivariant undertakes to process Customer Data only on the documented instructions of the Customer, not to sell, rent or use it for advertising purposes, not to use it to train or improve artificial intelligence models without the Customer's prior express consent, to ensure that persons authorized to access it are bound by confidentiality, and to assist the Customer in meeting its own obligations, in particular with respect to data subject requests, impact assessments and personal data breach notifications.

Bivariant personnel access the content of a Workspace only at the Customer's request, where such access is strictly necessary to resolve an incident or ensure the security of the Services, or where required by law. All such access is logged.

Administrators designated by the Customer may, depending on Workspace settings, view, export, modify and delete Customer Data, and define retention rules. Users are informed that the Customer may access the content they post in the Workspace.

Where the Services are used to communicate with Correspondents, in particular by telephone, the Customer is solely responsible for informing them and, where applicable, for obtaining their consent to the recording or transcription of communications.

7. Artificial Intelligence Features

The Services include artificial intelligence features, first and foremost Agents. Bivariant designs these features in accordance with the principles of data protection by design and by default, and with the requirements of Regulation (EU) 2024/1689 on artificial intelligence.

Data submitted to Agents is processed solely to produce the requested response or action. By default, such processing is carried out using models operated by Bivariant. Where the Customer chooses to use a model provided by a third party, including by means of its own access credentials, the necessary data is transmitted to that third party under the terms agreed between the Customer and that third party.

Agents are identified as such within the Services. The Customer is responsible for informing Correspondents that they are interacting with an artificial intelligence system where Agents communicate with them through a channel external to the Services.

The Customer determines the scope of action of its Agents and remains responsible for their configuration. The Customer shall ensure that no decision based solely on automated processing and producing legal effects concerning, or similarly significantly affecting, an individual is made without the safeguards provided for in Article 22 of the GDPR.

Content generated by artificial intelligence may be inaccurate or incomplete and should be reviewed in a manner appropriate to its intended use.

8. Blueprints and Integrations

The Services allow Customers to install Blueprints and enable Integrations, which may involve data exchanges with third parties. Such exchanges take place solely at the Customer's initiative.

A Blueprint contains no Customer Data. Each installation creates an application whose data is isolated within the Workspace. The third-party publisher of a Blueprint does not access Customer Data, except where the Blueprint includes an Integration with the publisher's own services and the Customer has authorized it. The permissions required are disclosed to the Customer prior to installation.

When an Integration is enabled, Bivariant accesses only the data covered by the permissions granted and processes it to provide the corresponding functionality. The processing of such data by the third-party service is the responsibility of that service. The Customer may disable an Integration at any time.

Bivariant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Recipients of Personal Data

Personal data is disclosed only to persons who need to know it in order to perform their duties. Bivariant does not sell personal data.

Personal data may be disclosed to authorized Bivariant personnel, within the limits of their duties; to the processors engaged by Bivariant for hosting, authentication, message routing, payment, support and audience measurement, bound by an agreement compliant with Article 28 of the GDPR; to Bivariant's professional advisers, who are bound by professional secrecy; to any acquirer or successor in connection with a restructuring, merger or sale, subject to prior notice to data subjects; and to administrative or judicial authorities where required by law.

The list of sub-processors involved in the processing of Customer Data is kept up to date and available at [●]. Bivariant notifies its Customers of any intended addition or replacement of a sub-processor under the conditions set out in the Data Processing Agreement.

Bivariant reviews each request from a public authority, verifies its lawfulness, limits disclosure to what is strictly necessary and informs the relevant Customer, unless prohibited by law.

10. Hosting and Transfers Outside the European Union

Bivariant attaches particular importance to the location of the data it processes. This Section describes where data is hosted and how any transfers are safeguarded.

Customer Data is hosted within the European Union by service providers subject to European law.

Certain processing activities may involve transfers of personal data outside the European Economic Area, in particular where the Customer enables an Integration or a model provided by a third party established outside that area, or where a sub-processor or a member of Bivariant's team operates from a third country. Any such transfer is governed by an adequacy decision adopted by the European Commission or, failing that, by appropriate safeguards within the meaning of Article 46 of the GDPR, such as the European Commission's standard contractual clauses, supplemented where necessary by additional measures. A copy of these safeguards may be obtained upon request.

11. Retention of Customer Data

Retention periods for data processed by Bivariant as controller are set out in Section 5. This Section addresses the retention of Customer Data.

Customer Data is retained for the duration of the contractual relationship, subject to the retention rules defined by the Customer. Upon termination of the agreement, the Customer has sixty (60) days to export its data. Customer Data is then deleted from production systems, and subsequently from backups at the end of their rotation cycle, within a maximum of ninety (90) days, unless retention is required by law.

12. Security

In accordance with Article 32 of the GDPR, Bivariant implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature of the processing.

These measures include encryption of data in transit and at rest, logical segregation of Workspaces, access management based on the principle of least privilege, strong authentication, access logging, regular data backups, audits and penetration testing, and staff awareness training. A more detailed description is made available to Customers upon request, subject to confidentiality.

In the event of a personal data breach affecting Customer Data, Bivariant notifies the Customer without undue delay after becoming aware of it. Where acting as controller, Bivariant notifies the breach to the French data protection authority (Commission nationale de l'informatique et des libertés) in accordance with Article 33 of the GDPR and informs the data subjects concerned where required by Article 34 of the GDPR.

13. Data Subject Rights

The GDPR and the French Data Protection Act grant data subjects rights over their personal data. This Section describes those rights and how to exercise them.

Data subjects have the right to access, rectify and erase their personal data, the right to restrict its processing, the right to data portability and the right to object to its processing, in particular for marketing purposes. Where processing is based on consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. Data subjects may also set out instructions regarding the retention, erasure and disclosure of their personal data after their death.

These rights may be exercised with Bivariant, for processing activities for which it is the controller, by email at privacy@bivariant.com or by post at its registered office. Bivariant responds within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case the data subject will be informed. Where there is reasonable doubt as to the identity of the requester, additional information may be requested.

With respect to Customer Data, rights should be exercised with the relevant Customer, which Bivariant assists in handling the request.

Data subjects also have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr) or with any other competent supervisory authority.

14. Cookies and Other Trackers

The website and the Services use cookies and other trackers in accordance with Article 82 of the French Data Protection Act and the recommendations of the Commission nationale de l'informatique et des libertés.

Trackers that are strictly necessary for the operation of the Services, their security and User authentication are placed without prior consent. Any other tracker, including non-exempt audience measurement or advertising trackers, is placed only after the user's consent has been obtained. Users may accept or refuse with equal ease and change their choices at any time through the preference management tool available on the website. Details of the trackers used are set out in the cookie policy, available at [●].

15. Minors

The Services are intended for professional use and are not directed at persons under the age of fifteen.

Bivariant does not knowingly collect, as controller, personal data relating to children under the age of fifteen. Anyone who becomes aware that such data has been collected is invited to inform Bivariant, which will delete the data concerned. Customers using the Services to communicate with minors are responsible for complying with the rules applicable to them.

16. Changes to this Policy

Bivariant may amend this Policy to reflect changes to the Services, to the applicable legal and regulatory framework or to the recommendations of supervisory authorities.

The date of the last update appears at the top of this Policy. Customers will be notified of any material change by email or through a notification within the Services within a reasonable period before it takes effect.

17. Contact

For any question regarding this Policy or the processing of your personal data, you may contact Bivariant, or its data protection officer where one has been appointed, by any of the following means.

By email: privacy@bivariant.com

By post: Bivariant, Attn: Data Protection Officer, 9 rue des Colonnes, 75002 Paris, France