Privacy policy

Data controller

For account, prospecting and connection data, the data controller is TierSafe, reachable via the contact page.

Uploaded files: TierSafe acts as a processor

For the third-party files you entrust to us (customers, suppliers, and the details they contain: company name, addresses, and where applicable banking identifiers such as the IBAN), TierSafe is not the data controller: you act in that capacity. We process this data on your behalf, as a processor (Art. 28 GDPR), following your instructions and solely to improve the file's quality. We neither reuse nor cross-reference this data for any other purpose.

A data processing agreement (Art. 28 GDPR), specifying the duration, object, nature, purposes, types of personal data and downstream sub-processors, is available on request via the contact page.

The data is encrypted on our servers and backed up at least once a day. Access to it is restricted to authorised teams, sensitive actions (verification decisions, payments) are recorded in an activity log, and retention is limited to the duration of the contractual relationship: files are erased when the account is deleted or at the end of the 24-month inactivity purge.

Data collected and purposes

TierSafe processes the following data:

• uploaded third-party files (customers, suppliers) and the details they contain (company name, postal addresses and, where applicable, banking identifiers such as the IBAN) for analysis and data quality;
• business email address, to follow up on the request;
• connection data, for the security and proper operation of the service.
• monitoring portfolio (Sentinelle offer): references, company names, identifiers (SIREN, SIRET, VAT, platform, routing identifier) and, if you provide them, addresses, bank details (IBAN, BIC) and contact e-mail address of the monitored third parties, the SIREN of your own company if you have it monitored, their known status in public sources and the history of their changes, plus the email addresses of the alert recipients you designate. The IBAN is never logged and appears in full only on the third party's record and in your exports.

Legal bases

For account, prospecting and connection data, processing is based on the performance of the contract, compliance with legal obligations and the publisher's legitimate interest. For the files you entrust to us, the legal basis is determined by you, as data controller; we act only on your instructions (Art. 28 GDPR).

Retention periods

Analysed files are kept for the duration of the contractual relationship, then erased when the account is deleted or at the end of the 24-month inactivity purge. Account data is anonymised under the same conditions. Visitor-identification data is kept for a maximum of thirteen months.

The monitoring portfolio is kept for as long as the account exists. Your own company and the first ten records, monitored for free, stay for as long as they are monitored; the other records are deleted 90 days after the subscription end date or, without a subscription, 90 days after they were added. Files uploaded to feed it are deleted as soon as the import is approved or cancelled, and at the latest two days after upload. Webhooks carry only the identifier and type of each event and your client reference, never its details; their log (date, type, answer code, without the answer content) is kept for 30 days.

Recipients and sub-processors

The data is accessible to authorised TierSafe teams and to the sub-processors below, strictly necessary to the service and hosting data within the European Union:

• ARDNTECH: hosting of the service and storage of the processed data;
• OVH SAS: hosting of the service and storage of the processed data;
• Stancer: payment collection via a hosted page; no banking data transits through or is stored by TierSafe;
• Brevo (Sendinblue SAS): routing of transactional and commercial emails;
• Public reference databases (INSEE/SIRENE, RNE, BODACC, the DGFiP lists of active VAT numbers and approved platforms, the IGN National Address Base, the European Commission's VIES, the Peppol directory, and the public DNS of the domain of a monitored third party's contact e-mail address) queried for verification and monitoring, without building a commercial profile.

Identification of business visitors

We seek to identify the companies that visit the site, for business development purposes. From the connection IP address we determine the network organisation and, where possible, the corresponding company (name, SIRET and address from the public SIRENE registry). This processing relies on our legitimate interest in developing our business. It concerns legal entities only: no natural person is identified, and the IP address is never retained beyond this identification. You may object to this processing at any time by contacting us.

We also measure the site's audience, server-side and without cookies: each page viewed is counted per day, with the site the visitor came from (search engine, social network). Only these counters are kept, with no IP address nor any data that could identify a person or follow their browsing.

Commercial prospecting (professionals)

We send commercial prospecting emails to professionals concerned by our services, under the following conditions:

• purpose: to present our services to professionals whose activity is directly concerned;
• legal basis: our legitimate interest in promoting our business, balanced against your rights;
• data processed: last name, first name, role, company and professional email address;
• source of the data: professional contact details published publicly by your organisation (website) and the public SIRENE register (INSEE);
• recipients: our teams and our email provider Brevo (Sendinblue SAS), a processor whose data is hosted within the European Union; no transfer outside the EU;
• retention period: three years from the last contact left unanswered, then deletion;
• you may object to this prospecting at any time, without reason, via the unsubscribe link in each email or by writing to us.

Your rights

You have a right of access, rectification, erasure, restriction and objection. To exercise them, contact contact@tiersafe.eu. If your data appears in a file uploaded by one of our clients, please send your request to that client, as data controller; we assist them in accordance with Article 28.3.e of the GDPR. You may also lodge a complaint with the CNIL.