Bilanlytics
Privacy policy
Last updated: 6 November 2026. In case of discrepancy, the French version prevails.
This page explains which personal data Bilanlytics processes, why, for how long, and how to exercise your rights (General Data Protection Regulation — GDPR — and the French Data Protection Act).
1. Data controller
Traikia Foudil, saint julien en genevois. Contact: foudil.34@gmx.fr.
For the content of audit files (answers, findings, evidence), the company or person holding the account decides what is entered and who can access it: they are responsible for that data, and Bilanlytics acts on their behalf (processor under Article 28 GDPR).
2. Data, purposes and legal bases
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Account: name, email address, job title, language, password (hashed, never in clear text), two-factor authentication secret, date terms were accepted | Identify you, secure access, send you the service emails | Performance of the contract (terms of use) | As long as the account exists; accounts never confirmed are deleted after 30 days |
| Audit file: answers, findings, actions, comments, attached evidence, history | Provide the self-assessment service | Performance of the contract | As long as the account exists; permanently erased when the account is deleted |
| Security logs: logins, failures, IP address, browser | Protect accounts, detect abuse | Legitimate interest (security of the service) | 12 months |
| Contact form: name, email address, subject, message (no IP address kept) | Reply to your request | Legitimate interest / pre-contractual measures | 12 months |
| Password reset links and invitations | Reset a password, join an account | Performance of the contract | Deleted 30 days after expiry or use |
Retention periods are applied automatically by a daily purge task. No automated decision-making or profiling takes place. The service shows no advertising and never sells any data.
3. Confidentiality of your answers
Your answers, findings, actions, comments and evidence are encrypted with a key specific to your account (AES-256). The platform administrator only manages user accounts and has no access to the content of audit files. Emails sent by the service never contain your answers. Hashed passwords (Argon2id), two-factor authentication, login attempt limits and logging complete these measures.
4. Recipients and processors
- The people the account owner invites, limited to the chapters and questions assigned to them.
- The platform administrator, for account data, security logs and contact messages only.
- Hosting provider: Hostinger International Ltd (European Union).
- Email delivery: Brevo (Sendinblue SAS, France).
No data is transferred outside the European Union. Data may be disclosed to the authorities upon legal request.
5. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set instructions regarding your data after your death. Directly in the application:
- Access and portability: “My profile” → “Download my personal data”; an account owner can also export the whole audit file (Report page).
- Rectification: “My profile”.
- Erasure: “My profile” → “Delete my account”; the owner can delete the whole audit file (Settings).
For any other request: foudil.34@gmx.fr or the contact form. We reply within one month. You may lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.
6. Cookies and local storage
The service only uses:
- a session cookie, strictly necessary for signing in and for form security (it also remembers your language choice);
- the browser's local storage for your display preferences (light or dark theme, collapsed menu).
These are exempt from consent. No advertising, social network or audience measurement cookies.
7. Changes
This policy may change; the date of the last update is shown at the top of the page. Users are informed of any significant change.