For those who fight. #OctobreRose

elloha

Privacy policy

Last updated: October 2025

This privacy policy explains how elloha SAS collects, stores and protects your personal data when you use www.elloha.com and all its subdomains (e.g. https://app.elloha.com, or any subdomain of the form https://pagename.elloha.com), hereafter the “Site”. It also sets out your rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, as well as our cookie rules.

This policy may be amended to reflect legal or technical changes; the update date above certifies this. By continuing to use the Site after a new version is published, you accept its terms; we invite you to review it regularly.

1) Data controller & DPO

elloha SAS – 2 bis, rue Fabrique de l’Abbé, 66000 Perpignan, France.

Privacy contact/DPO: privacy@elloha.com (or by post at the address above, “for the attention of the DPO”).

2) Data we collect

  • Identification and contact data: first name, surname, email, phone, company, job title.
  • Navigation/technical data: logs, device identifiers, pages viewed, application events, preferences.
  • Contract and support data: information relating to your subscriptions/orders, exchanges with our support team.
  • Marketing data: communication preferences, attendance at our events, responses to our forms (newsletter, white papers, etc.).

    • Whether each field is mandatory or optional is specified at the point of collection. If mandatory fields are not provided, certain services cannot be delivered.

    3) Purposes & legal bases (GDPR Art. 6)

  • Provision of the Site, applications and support (account creation/management, assistance, security, invoicing, fraud prevention) — performance of a contract and/or legitimate interest (security, service improvement).
  • Prospecting/Newsletter (news, professional content, offers) — consent (opt-in, withdrawable at any time).
  • Audience measurement & improvement of the Site/product — consent via our cookie banner (except strictly necessary cookies).
  • Legal obligations (accounting, tax, responses to authorities) — legal obligation.

    • When we rely on legitimate interest, we ensure your interests and fundamental rights prevail (documented balancing tests).

    4) Recipients & processors

    Your data is processed by our authorised teams and by providers (hosting, email, analytics, support, payments) acting on elloha's instructions, bound by contract (DPA) and subject to our security and confidentiality obligations. We do not sell your data.

    5) Transfers outside the EU

    Where our processing involves a transfer to a third country, we use the following mechanisms:

  • Adequacy decision (e.g. EU-US Data Privacy Framework – DPF) of 10 July 2023, upheld by the EU Court of Justice on 3 September 2025.
  • Standard Contractual Clauses (SCCs) + supplements/additional safeguards where necessary.

    • 6) Retention periods

    We keep your data only as long as necessary for the stated purposes, then archive/delete it in line with legal obligations:

  • Prospects: 3 years after the last active contact (email opened/clicked, form, meeting).
  • Customers/contracts: duration of the relationship, then statutory archiving (up to 10 years for accounting).
  • Technical logs: up to 6 months, except security imperatives.
  • Cookies: see §10 (specified durations).

    • 7) Security

    We implement appropriate technical and organisational measures: access control, encryption in transit/at rest where applicable, logging, regular testing, permission management and an incident response plan.

    8) Your rights

    Under the GDPR and French data protection law, you have the following rights, subject to conditions:

  • Access to your data; rectification; erasure (“right to be forgotten”); restriction; portability (structured format); objection (in particular to prospecting); withdrawal of consent at any time; the right not to be subject to a fully automated decision.

    • To exercise your rights: privacy@elloha.com or by post (see §1). We may ask for proof of identity in case of doubt. Response time: 1 month (extendable by 2 months for complex/voluminous requests). You may also lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes.

    9) Children

    Our services are aimed at professionals/adults. We do not knowingly collect children's data; if a parent or guardian believes a child's data has been sent to us, they may contact us to have it deleted.

    10) Cookies & similar technologies

    10.1 Principles

    Non-essential cookies (audience measurement, personalisation, etc.) are only set/read with your consent, which you can accept, refuse or customise at any time. Refusal does not block access to the Site, but may limit certain features.

    Cookies strictly necessary for operation (e.g. authentication, load balancing, security, language preference) are set without consent.

    Recommended durations: lifetime of a non-essential cookie ≤ 13 months; retention of the choice (consent/refusal) ≤ 6 months before a new request.

    10.2 Cookie categories

  • Essential (exempt from consent): session authentication, anti-fraud security, load balancing, interface preference.
  • Audience measurement (subject to consent): traffic and performance statistics. Note: in France, audience measurement tools must comply with CNIL guidelines; certain transfers to third countries require additional safeguards.
  • Personalisation (consent).
  • Social networks / sharing (consent): buttons and embedded content.

    • 11) Cookie durations

    Full details (name, purpose, duration) are available in our Preferences Centre, via the dedicated link in the footer.

    12) How to contact us

    For any question or request regarding your rights: privacy@elloha.com. The competent authority in France is the CNIL: https://www.cnil.fr/fr/plaintes.