QareData Mobile App Privacy Policy

This privacy policy describes how personal data is collected, used, stored and protected when using the QareData mobile application, available on Google Play (Android) and Apple's App Store (iOS).

The QareData application enables professionals to document their interventions, trace the actions carried out in the field and build a living technical memory of the sites, equipment, installations, dwellings and services they monitor.

In particular, it allows users to view and enter operational information, document interventions and share relevant information with authorized persons.

This policy applies to all users of the QareData mobile application, regardless of their operating system.

It is separate from the privacy policy of the qaredata.io website.

The application is published by:

QAREDATA
Simplified single-shareholder joint-stock company (SASU) with a share capital of €29,000.
Registered office: 39 rue Turgot, 59420 Mouvaux, France.
Registered with the Lille Métropole Trade and Companies Register (RCS) under number 932 696 321.

• Email: contact@qaredata.io
• Website: https://qaredata.io

For any question regarding the protection of personal data, users may contact QAREDATA at the address above.

Depending on the features used, the application may process the following categories of data.

3.1. Identification and Account Data

• User's first and last name.
• Professional email address.
• Organization or company the user belongs to.
• Account identifier and access rights.
• Information required for authentication and session management.

3.2. Intervention Data

• Date and time of the interventions or reported actions.
• Identification of the technician, where applicable.
• Site, equipment, installation, dwelling or service concerned.
• Type and status of the intervention.
• Observations, comments and information entered.
• Photos and documents added by the user.
• History of the actions performed.

This information is used to build an operational history and ensure the traceability of the services performed.

Users are asked not to include unnecessary personal information or sensitive data about third parties in photos, documents or comments.

3.3. Geolocation Data

When an intervention or action requires it, the QareData application may collect, on a one-time basis, the geographic coordinates provided by the user's phone.

This data consists of the GPS latitude and longitude coordinates returned by the device, with the level of accuracy provided by the device.

Collection takes place only at the moment the user performs the relevant action in the application.

The recorded coordinates may be associated with the intervention in order to document where it took place and contribute to the traceability of operations.

QareData does not perform any background location tracking, nor any continuous recording of users' movements.

The application is therefore not a tool for permanently tracking the movements of employees or contractors.

Access to the device's location depends on the permissions granted by the user and on the features used.

Geolocation data is not used for advertising purposes or for the commercial exploitation of movements.

3.4. Photos, Camera and Files

The application may request access to the device's camera or files in order to scan a code, photograph an intervention or attach a document.

Added photos are saved and associated with the corresponding interventions.

Photos are stored on OVHcloud infrastructure used by QAREDATA.

Users remain in control of the photos and documents they choose to submit when using the application.

3.5. Technical and Security Data

To enable the operation and security of the application, certain technical data may be processed:

• Technical session identifiers.
• Dates and times of logins or operations.
• Technical information about the device and the application version.
• Error logs and events required to diagnose incidents.

This data is used to ensure the proper functioning of the service, detect anomalies and contribute to its security.

Infrastructure providers may also process certain technical information required for routing communications and for the operation and security of their services, according to their own logging mechanisms.

The collected data is used to:

• Provide secure access to the application.
• Manage user accounts and permissions.
• Document the interventions and operations performed.
• Build an operational history of the monitored sites and equipment.
• Ensure the traceability of reported actions.
• Facilitate the monitoring and coordination of services.
• Make information available to authorized persons.
• Ensure the operation, maintenance and security of the service.
• Respond to support requests and resolve technical incidents.

Data collected in the application is not intended for behavioral advertising and is not sold to third parties.

QareData is a professional solution made available to client organizations.

For data relating to interventions and activities carried out on behalf of an organization, that organization generally determines the purposes and essential means of the processing and acts as the data controller within the meaning of the GDPR.

QAREDATA then acts as a data processor and processes the data in accordance with the agreements concluded with the organization concerned and the applicable instructions.

The legal bases for business processing are determined by the organization acting as data controller, in particular according to its legal and contractual obligations and its legitimate interests.

For the processing it determines itself, in particular that required for technical administration, securing the service and managing its contractual relationships, QAREDATA acts as data controller.

Depending on its nature, such processing is based on the performance of a contract, compliance with a legal obligation or the legitimate interest of QAREDATA.

Data is accessible within the limits of the rights granted to users.

Depending on how the service is organized, it may be disclosed to:

• Authorized users of the client organization.
• Authorized technicians and contractors.
• Principals or stakeholders granted access by the client organization.
• Authorized QAREDATA staff when their involvement is required for maintenance or support.
• Technical providers responsible for hosting and operating the solution, to the extent necessary for their tasks.

QAREDATA does not sell users' personal data and does not transfer it to third parties for their own marketing purposes.

Data processed in the QareData application relies on several specialized technical infrastructures.

Application database — MongoDB Atlas

Application data and intervention histories are stored in a MongoDB Atlas database, a managed service provided by MongoDB, Inc., deployed on Google Cloud Platform infrastructure in the europe-west9 region (Paris, France).

Database backups are performed using MongoDB Atlas's built-in backup service (Cloud Backup), and are stored in the same region (Paris, France).

Application services and API — Render

The API that runs the application and handles exchanges with the database is hosted on Render's infrastructure, in the Frankfurt region (Germany).

Only Render's native platform logs are used; no third-party logging or monitoring service is enabled.

Photos — OVHcloud

Photos associated with interventions are stored in OVHcloud's Object Storage service, in the Paris region (EU-WEST-PAR, spread across three availability zones).

This data is replicated to OVHcloud's Roubaix region (RBX, France) to ensure its availability and resilience.

QAREDATA relies on these technical providers to host, transmit and operate its service.

Transfers outside the European Economic Area

Data is hosted within the European Union. However, some providers, in particular Render and MongoDB, are companies based in the United States whose data processing agreements provide that certain operations (support, maintenance, security, operations) may be carried out from the United States or other third countries.

Any such access or transfers are subject to the safeguards provided for by the GDPR, in particular the Standard Contractual Clauses adopted by the European Commission and, where applicable, the EU–U.S. Data Privacy Framework, in accordance with the data processing agreements concluded with these providers.

QAREDATA applies the principle of storage limitation for personal data, in accordance with the GDPR, while allowing client organizations to preserve the technical and operational history of their interventions.

8.1. User Identification Data

Data required to identify a user and grant access is retained for as long as their account is active and their access is authorized by the organization concerned.

When an account is permanently deleted or deactivated, data that is no longer needed is deleted in accordance with the applicable procedures, subject to justified retention obligations.

8.2. Identification of Technicians in Histories

First names, last names and email addresses associated with interventions are intended to be removed from histories no later than three years after the date each intervention was performed, unless further retention is legally justified.

This removal must also prevent the intervention from being directly re-linked to the user through a retained technical identifier.

Active user accounts may retain the identification information required for their operation, regardless of the removal of personal names from older histories.

8.3. Retention of Technical Memory

Technical information relating to interventions, in particular their date, type, equipment concerned, observations, photos and location data, may be retained beyond the retention period for personal identification information where this remains necessary for equipment management, service continuity or proof of services performed.

The duration of this retention is determined according to the purposes pursued and the terms agreed with the organization acting as data controller.

This data may itself constitute personal data where it allows a person to be directly or indirectly identified. It then remains subject to the requirements of the GDPR.

8.4. Technical Data and Backups

API operating logs are retained for 7 days and then automatically deleted.

Database backups are retained for 7 days and then automatically deleted.

8.5. End of Contract

When a contract with a client organization ends, data is returned, deleted or retained in accordance with the applicable agreements, the instructions of the data controller and any legal obligations.

QAREDATA implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure.

These measures include, in particular, permission management, access restrictions and protection mechanisms for the infrastructures used.

Users are asked to protect their credentials and to report any suspicious use of their account.

In accordance with the GDPR and under the conditions provided for by law, users have, in particular, the rights of access, rectification, erasure, restriction of processing, objection and, where applicable, data portability.

Requests may be sent to: contact@qaredata.io

Where QAREDATA acts as a data processor, the request may be forwarded to the organization acting as data controller or handled in coordination with it.

Users may also lodge a complaint with the French Data Protection Authority (CNIL): https://www.cnil.fr/fr/plaintes.

Users may request the deletion of their account and associated personal data by contacting QAREDATA at: contact@qaredata.io

Where the account is administered by a client organization, the request is handled in coordination with that organization.

Deleting an account does not necessarily result in the deletion of all professional histories the user contributed to.

Information required for operational continuity or to justify interventions may be retained where its retention is based on a valid purpose and legal basis.

Information that personally identifies the former user is deleted or dissociated from histories once its retention is no longer necessary or legally justified.

Depending on the features used, the application may request permission to access:

• The camera, to scan a code or take a photo.
• Photos or files selected by the user.
• The device's location, only at the time of actions requiring this information.
• Notifications, where this feature is available.

Permissions can be viewed or changed in the phone's settings, according to the options offered by Android and iOS.

Refusing certain permissions may limit the corresponding features.

This policy may be amended to reflect changes to the application, the features offered, the processing carried out or applicable regulations.

The current version is available on the QareData website and in the mobile application.

The date of the last update is shown at the top of this document.