Privacy policy

Ascory attaches great importance to the protection of your personal data. This policy describes the processing carried out on the ascory.fr website and its associated services, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Data controller

The data controller for personal data collected on this website is the site publisher, whose full details are listed in the legal notice. For any request regarding your data: legal@ascory.fr.

Data collected

Depending on how you interact with the website, the following personal data may be collected:

Contact form: full name, company or organisation, email address, phone number and the content of your message (optional).
OSCA® diagnostic: first name, last name, email address, affiliated organisation (where applicable) and questionnaire answers, used to produce your individual report.
Client space / members' space: email address and the account data required for secure magic-link authentication and access to reserved content.
Technical data: connection logs and browsing data collected in aggregated form for security and audience measurement purposes (see the Cookies section).

Purposes of processing

Data is processed solely for the following purposes:

to respond to your contact and information requests regarding the services offered by Ascory;
to deliver the OSCA® diagnostic and produce the associated individual report;
to provide access to the client space / members' space and reserved content;
to ensure the security, proper operation and improvement of the website.

Legal basis

Depending on the processing concerned, the legal basis is:

your consent, for the contact form and for audience measurement (analytics cookies);
the performance of a contract or pre-contractual measures, for the OSCA® diagnostic and access to the client space;
Ascory's legitimate interest in ensuring the security and proper operation of the website.

Recipients and processors

Your data is processed by Ascory and is never sold to third parties. It may be shared, strictly within the limits of their assignment, with the following technical providers acting as processors:

o2switch (website and database hosting, email delivery — France, European Union);
OpenAI, used to generate the OSCA® diagnostic report from your answers. The data transmitted is limited to what is necessary for that generation;
Google Analytics (audience measurement), only after your consent.

Some of these providers may process data outside the European Union; in that case, such transfers are governed by appropriate safeguards, in particular the European Commission's standard contractual clauses or an equivalent mechanism.

Retention period

Retention periods are as follows:

Contact requests: 3 years from the last contact, unless a legal obligation requires otherwise.
OSCA® diagnostic and report: 3 years from the end of the engagement, unless a legal obligation requires otherwise.
Client-space member accounts: 3 years from the account's last activity, then deletion or anonymisation.

Security

Ascory implements appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access. Individual OSCA® diagnostic reports are strictly confidential and accessible only to the participant concerned and the Ascory consultant. Neither the employer, nor the HR function, nor the manager who initiated the assessment has access to a participant's individual report; no named synthesis is shared with the organisation. Only aggregated and anonymised information may, where applicable and within the agreed contractual framework, be provided to it.

Your rights

In accordance with the GDPR, you have the following rights over your data: access, rectification, erasure, restriction of processing, objection and portability. You may also withdraw, at any time, a consent already given.

To exercise these rights, write to: legal@ascory.fr. You will receive a response within a maximum of one month. If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority — www.cnil.fr).

Cookies

This website uses two categories of cookies:

Strictly necessary cookies required for the website to function properly (navigation, members' space authentication, storing your consent preferences). They do not require your consent.
Audience measurement cookies set by Google Analytics, in order to understand, in an aggregated and anonymised way, how visitors use the site and to improve its content. These cookies are only set after your explicit consent via the dedicated banner.

No advertising cookies are used.

You may withdraw your consent or change your preferences at any time via the cookie management banner. Refusing has no impact on your access to the website or its features.

Changes to this policy

This policy may evolve to reflect legal, regulatory or technical developments. The applicable version is the one published on this page.