Usedge
Legal

Privacy policy

Last updated

1. Preamble

This Privacy Policy aims to inform, in a clear, fair and transparent manner, any person concerned by the processing of personal data carried out by Usedge, a simplified joint-stock company, with a share capital of EUR 94 545, whose registered office is located at 129 rue Servient, 69003 Lyon, France, registered with the Lyon Trade and Companies Register under number 898 564 810, of the methods for collecting, using, storing and protecting their personal data.

We endeavor to process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), as well as with the French Data Protection Act of 6 January 1978, as amended (the “Informatique et Libertés” Act).

“Personal data” means any information relating to an identified or identifiable natural person.

When using the platform, the Client may collect certain personal data from consumer users or individuals invited to participate in studies, user tests, interviews, or research sessions who do not have a direct contractual relationship with Usedge.

In this context:

  • the Customer using the platform acts as the data controller within the meaning of the GDPR;
  • Usedge acts exclusively as a processor, within the meaning of Article 28 of the GDPR;
  • The Customer determines the purposes of the processing, the categories of data collected, and the applicable legal bases.

The Customer undertakes to:

  • inform participants of the processing of their personal data;
  • have a valid legal basis for the collection and processing of such data (in particular consent where required);
  • comply with all applicable data protection regulations
  • have a valid legal basis for collecting and processing this data (including consent where required);
  • comply with all applicable regulations on personal data protection.

2. Personal data collected

2.1 Data collected by Usedge as Data Controller

  • Identification data: first name, last name, company, job title, professional and personal contact details.
  • Financial data: information required for invoicing and payments.
  • Technical data: IP address, technical logs, cookies, login information.
  • Browsing and usage data of the Usedge website.

2.2 Data processed by Usedge as Data Processor (on behalf of the Client)

  • Responses to questionnaires and forms.
  • Verbatim feedback and comments.
  • Audio and video recordings from sessions.
  • Transcriptions, notes and metadata generated by the platform.
  • Any other content generated within SaaS projects.

The Client acts as data controller for such data and determines the purposes and legal bases of processing.

The Customer undertakes not to collect or process via the Platform any data falling within the special categories of data within the meaning of Article 9 of the GDPR, unless:

  • the collection is strictly necessary for the study carried out;
  • an appropriate legal basis is identified;
  • the explicit consent of the persons concerned has been obtained.

The Customer assumes full responsibility for the collection of such data.

3. Methods of data collection

Personal data are collected:

  • directly from the data subjects;
  • via website forms;
  • within the framework of the contractual relationship;
  • when creating and using an account;
  • from publicly available professional sources (e.g. LinkedIn), in compliance with GDPR.

Certain data are mandatory for:

  • account creation;
  • performance of the contract;
  • order management;
  • invoicing;
  • compliance with legal obligations.

Failure to provide such data may prevent Usedge from delivering all or part of the services.

Other data are optional and their absence does not prevent access to the website but may limit certain functionalities.

4. Purpose and legal bases of processing

4.1 Usedge acting as Data Controller

Your personal data are collected and processed:

  • On the basis of contract performance for the following purposes:customer account manage ment; order management and invoicing; access to services.
  • On the basis of legal obligations for: payment and complaint management; compliance with accounting and tax obligations.
  • On the basis of our legitimate interest in providing and operating a research operations management platform for businesses, for: user account creation and administration; customer relationship management; maintenance, security and technical support; professional marketing communications, subject to the right to object; production of anonymous statistics; satisfaction surveys; analysis of application usage; user preferences, continuity, and data synchronization between site and app.
  • On the basis of your consent, where required by applicable regulations.

4.2 Usedge acting as Data Processor

  • On the basis of the Client’s documented instructions: data collection and processing via the platform, hosting, analysis, transcription and generation of insights.

5. Data recipients

5.1 Usedge acting as Data Controller

Your data may be transmitted to:

  • IT and technical service providers;
  • hosting providers;
  • payment service providers;
  • legal and accounting advisors;
  • administrative and judicial authorities.

All processors are contractually bound to strict confidentiality and security obligations, in accordance with Article 28 GDPR.

Usedge does not transfer personal data outside the European Economic Area (EEA).

Should such a transfer occur, it will be governed by appropriate safeguards in accordance with GDPR, including Standard Contractual Clauses (SCCs), supplementary measures and, where necessary, a transfer impact assessment.

If a transfer of personal data to a country outside the European Union (outside the EEA) were to be implemented, Usedge undertakes to comply with the following legal requirements:

  • The transfer may only take place if the third country ensures an adequate level of protection as recognized by the European Commission, or if appropriate safeguards are implemented, such as:
  • Standard Contractual Clauses (SCCs) adopted by the European Commission;
  • Binding Corporate Rules (BCRs), where applicable;
  • Any other mechanism recognized as compliant with the GDPR.
  • A transfer impact assessment shall be carried out in order to assess the risks to the rights and freedoms of the data subjects, in particular in the event of potential access by local authorities.
  • The transfer shall be strictly regulated:
  • For data processed by Usedge in its capacity as data controller, the explicit consent of the data subjects may be required;
  • For data processed by Usedge in its capacity as data processor, the transfer may only be carried out upon the documented instructions of the Client.
  • Users shall be informed of the transfer and of the safeguards implemented in this Privacy Policy.

5.2 Usedge acting as Data Processor

Recipients are determined solely by the Client.

6. Data retention

We retain personal data only for the period necessary to achieve the purposes for which they were collected, in particular:

  • Customer data: during the contractual relationship and for up to 5 years after its termination;
  • Supplier data: during the contractual relationship and for up to 5 years after its termination;
  • Marketing data: until the end of a 3-year period of inactivity;
  • Technical data: 12 months;
  • Cookies: no longer than 13 months, in compliance with applicable regulations.

After these periods, data are deleted or anonymized.

7. Data hosting

The data is hosted by the Company: AWS FRANCE, a simplified single-shareholder company with a share capital of €100,000, registered with the Nanterre Trade and Companies Register under SIREN number 487 482 143, whose registered office is located at 52 rue du Port, 92000 Nanterre.

The servers are located within the European Union in Paris.

When additional technical service providers are involved (subcontractors), they are selected in accordance with the requirements of Article 28 of the GDPR and are contractually bound to guarantee an appropriate level of security and confidentiality.

In the event of recourse to a service provider located outside the European Economic Area, transfers are governed by the mechanisms provided for in Articles 44 et seq. of the GDPR (in particular standard contractual clauses and additional measures).

8. Data controller

8.1 General Principle

Usedge operates under two legal regimes pursuant to GDPR:

  • as data controller for processing related to website management, prospects, customers, partners and legal obligations;
  • as data processor for personal data processed via the SaaS platform on behalf of its clients.

8.2 Usedge as Data Controller

Usedge acts as data controller for the following processing activities:

  • management of the website;
  • management of customer accounts;
  • commercial and contractual management;
  • invoicing and accounting;
  • customer support management;
  • professional communication and marketing;
  • management of cookies and tracking technologies;
  • compliance with legal and regulatory obligations.

In this capacity, Usedge determines the purposes and means of the processing operations.

The data concerned include in particular:

  • identification and contact data;
  • professional data;
  • billing and payment data;
  • browsing and usage data.

8.3 Usedge as Data Processor

In the context of the use of the SaaS platform, Usedge acts exclusively as a data processor within the meaning of Article 28 of the GDPR, on behalf of its clients, who act as data controllers.

The data concerned include in particular:

  • responses to questionnaires;
  • verbatim responses and comments;
  • audio and video recordings;
  • transcripts;
  • feedback;
  • research metadata;
  • any personal data integrated or generated as part of projects conducted through the platform.

In this context:

  • the Client alone determines the purposes and legal bases of the processing;
  • Usedge processes the data solely on the documented instructions of the Client;
  • the respective obligations of the parties are defined in the Data Processing Agreement (DPA) entered into between Usedge and the Client

8.4 Contact Details of the Data Controller (Usedge)

When Usedge acts as data controller:

Usedge

Société par Actions Simplifiée Unipersonnelle

Capital social : 94 545 €

Siège social : 129 rue Servient, 69003 Lyon, France

RCS Lyon n° 898 564 810
TVA intracommunautaire : FR34898564810

[email protected]

8.5 Data Protection Officer (DPO)

Usedge has not appointed a Data Protection Officer (DPO), as no legal obligation applies given the nature of its activities.

Any question relating to the processing of personal data may be addressed using the contact details above.

9. Data subject rights

In accordance with GDPR, you have the following rights:

  • right of access (Article 15);
  • right to rectification (Article 16);
  • right to erasure (Article 17);
  • right to restriction (Article 18);
  • right to data portability (Article 20);
  • right to object (Article 21);
  • right to withdraw consent at any time;
  • right not to be subject to automated decision-making (Article 22);
  • right to determine the fate of your data after death (French law);
  • right to lodge a complaint with a supervisory authority (Article 77).

To exercise your rights:

[email protected]

or by post:

Usedge
129 rue Servient
69003 Lyon
France

In order for the data controller to process your request, you may be required to provide certain information such as your first and last name, your email address, and your account, personal space, or subscriber number.

In the event of reasonable doubt as to your identity, we reserve the right to request proof of identity.

You have the right to lodge a complaint with the competent supervisory authority (in France, the CNIL – Commission Nationale de l’Informatique et des Libertés). If you intend to file a complaint, we encourage you to contact us first in order to seek an amicable resolution.

Please visit cnil.fr for more information about your rights.

10. Minors

The Platform is intended for professional use.

Within the scope of studies conducted by Clients, minor Users may be invited to take part in tests or questionnaires.

In such cases, the Client agrees to:

  • verify that the minor's participation is permitted under applicable law;
  • obtain prior consent from the legal guardian when required, particularly for minors under 15 years old;
  • provide legal guardians with information regarding the processing of personal data.

Usedge does not verify the age of Users and disclaims any liability in the event of a minor participating without proper authorization.

However, Usedge reserves the right to suspend or remove any study that is clearly in violation of applicable regulations.

11. Security

The security of your data is important to us. We regularly monitor our systems in order to identify potential vulnerabilities and attacks. However, we cannot guarantee the absolute security of the information you transmit to us. No guarantee is given that data will not be accessed, disclosed, altered, or destroyed in the event of a breach of any of our physical, technical, or organizational security measures.

In accordance with applicable legal requirements, we have implemented appropriate measures to protect your personal data. These measures include the technical and organizational safeguards necessary to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure.

Nevertheless, no security system can guarantee 100% protection. You also play an important role in ensuring the security of your personal data by keeping your login credentials confidential and choosing a strong password.

We remain at your disposal for any questions relating to the confidentiality and security of your personal data.

In the event of a personal data breach that may pose a risk to the rights and freedoms of the individuals concerned, Usedge undertakes to:

  • notify the competent supervisory authority (in France, the CNIL) within a maximum of 72 hours after becoming aware of it, when required by law;
  • inform the individuals concerned as soon as possible when the breach is likely to pose a high risk to their rights and freedoms;
  • document any data breach in accordance with Article 33 of GDPR

When Usedge acts as a processor, any personal data breach is notified to the Customer as soon as possible after becoming aware of it, in order to enable the Customer to comply with its own regulatory obligations.

12. Absence of automated decision-making

No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out.

The platform may use automated processing to:

  • generate transcripts,
  • produce summaries or insights,
  • facilitate the analysis of data from studies.

Certain features of the platform rely on automated analysis tools, including artificial intelligence technologies that automatically generate summaries or analyses based on data collected during test sessions.

The purpose of this processing is to facilitate the analysis of results by platform users.

The results generated by these tools are indicative and must be interpreted by users.

It has no legal effect on the individuals concerned and does not give rise to any automated decision-making within the meaning of Article 22 of the GDPR.

The data processed via these tools is not used to train external models, unless expressly indicated to the Customer.

When third-party providers of artificial intelligence services are involved, they are contractually bound in accordance with the requirements of the GDPR.

13. Amendments

The website publisher reserves the right to modify this Privacy Policy at any time in order to ensure its compliance with applicable laws and regulations.

Where applicable, we will inform you of such changes by email.

This policy will be updated as necessary to reflect any changes we make to our services. When this policy is updated, the “last updated” date at the bottom of this statement will be revised accordingly. We encourage you to review our Privacy Policy regularly in order to stay informed about how we use your data.

This policy was last updated on 10/03/2026.

Questions about this document?

Write to us at [email protected]