Privacy policy

Last updated: 14 July 2026

1. Data controller

PPWR Connect is a service operated by VEORIA, a French SAS with share capital of €3,000, registered office at 45 Grande Rue, 72450 Montfort-le-Gesnois, France, registered with the Le Mans Trade and Companies Register under no. 922 240 510 (ColorLoop is a product/brand operated by VEORIA).

Publication director: François-Xavier DAVID.
Privacy contact: privacy@veoria.fr

VEORIA develops and operates PPWR Connect and remains the sole data controller of the data processed through it. It belongs to a group held by the same shareholder (Rutherford and Studio de la Roche); their limited intra-group access is described in § 5.

2. What data we collect

When you create an account or use the application:

Identity and contact: email address, full name, company, preferred language.
Company (workspace) data: legal name, VAT number, billing address and billing email.
Product usage data: SKUs/packaging you enter, documents, Academy progress, quiz scores.
Technical security data: IP address and user-agent (audit log), sign-in history.

When you purchase a subscription:

Billing and payment data, processed by our provider Stripe (we do not store card numbers).

When you visit the site (without an account):

Audience measurement via PostHog (EU-hosted), only after your consent.
Questions submitted to the Vera assistant (chat).
An anonymous technical identifier (cookie vera-anon) to prevent abuse.

When you receive our emails:

Delivery events reported by our email provider (delivered, bounced, spam complaint) — used to protect deliverability and to stop emailing addresses that are invalid or have objected.
Clicks on the links in our emails: links are redirected through our domain links.ppwrconnect.com, which lets us measure whether a campaign was relevant. We do not use open-tracking pixels.

3. Why (purposes) and on which legal basis

Purpose	Legal basis (GDPR)
Create and manage your account, provide the service	Performance of contract (Art. 6.1.b)
Billing and subscriptions	Performance of contract / legal obligation
Security, abuse prevention, audit log	Legitimate interest (Art. 6.1.f)
Audience measurement (analytics) and session recordings	Consent (Art. 6.1.a)
AI assistant (Vera)	Performance of contract / legitimate interest
Service emails (confirmation, security)	Performance of contract
Marketing communications (newsletter)	Consent
Marketing emails to existing B2B customers (product news, regulatory deadlines), with frequency caps	Legitimate interest (Art. 6.1.f) — opt out at any time via the unsubscribe link in every email
Email deliverability and engagement measurement (delivery events, link clicks)	Legitimate interest (Art. 6.1.f)

4. Retention periods

Active account: for the duration of the relationship.
After account deletion: erased within 30 days, unless a legal obligation applies.
Billing data: 10 years (accounting obligation).
Audit log (IP/user-agent): 12 months, then anonymised.
Analytics data: 13 months maximum.
Inactive accounts: deleted/anonymised after 24 months of inactivity.
Email engagement events (delivery, clicks): 24 months maximum.
Do-not-email (opt-out) list: kept for as long as necessary to honour your objection.

5. Who we share your data with (processors)

Your application data (database, authentication, files) is hosted in France (EU). We use providers acting as processors, under contract (DPA):

Provider	Role	Location
Supabase	Database, authentication, storage	EU — France (AWS eu-west-3, Paris)
Vercel	Site hosting / CDN	EU — Paris (serverless functions); global CDN
Stripe	Payments and subscriptions	USA (covered by Standard Contractual Clauses / DPF)
Resend	Email sending and delivery/engagement events	USA (covered by Standard Contractual Clauses / DPF)
PostHog	Audience measurement	EU (Frankfurt)
Groq	AI assistant (processing of chat questions)	USA (covered by Standard Contractual Clauses)

Sharing within our group

VEORIA develops and operates PPWR Connect and is the sole data controller. It belongs to a group held by the same shareholder whose other entities may access your personal data for defined purposes: Rutherford (SAS, SIREN 938 980 877) for commercial and sales activities, and Studio de la Roche (SASU, SIREN 919 095 364) for marketing. Both are established at 45 Grande Rue, 72450 Montfort-le-Gesnois, France. Marketing communications are sent only with your consent; commercial use relies on our legitimate interest in managing the customer relationship (see the legal bases in § 3). Access is granted under confidentiality commitments, and all group entities are located in the European Union, so this involves no transfer outside the EU.

We never sell your data.

6. Transfers outside the European Union

Some providers (Stripe, Groq, Resend) are located in the United States. These transfers are covered by the European Commission's Standard Contractual Clauses and/or membership of the Data Privacy Framework.

Important: do not enter personal or confidential data into the Vera assistant, as your messages are transmitted to our AI provider.

7. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability.

Delete your account and data: directly from My account → Security → Delete account.
Export your data: from My account → Security → Export my data.
For any other request: privacy@veoria.fr.

You can withdraw your consent to analytics at any time in Settings → Privacy.
You have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

8. Cookies

See our Cookie Policy for details of the cookies used and how to manage your consent.

9. Security

We implement technical and organisational measures: encryption in transit, access partitioning via database row-level security (RLS), available two-factor authentication, access logging.

10. Changes

We may update this policy. The last-updated date appears at the top of the page.