In force as of 12 November 2026.
Courtesy translation. If there is any difference, the French version prevails.
1. Who is responsible for your data?
For the management of company accounts, subscriptions and invoicing, the controller is Leo Grosso, trading as FlokyEntreprise, 24 bis rue de Creil, 62640 Montigny-en-Gohelle (the "Publisher"), who can be reached at flokyentreprise@gmail.com.
For employees' data (name, email address, hours, absences, handover messages), the customer company using Pointage is the controller, and the Publisher acts as processor on its behalf. Employees can exercise their rights with their employer or, failing that, with the Publisher, who will pass the request on.
2. What data is processed?
- Company account manager: name, email address, company name, SIRET number, password (stored only in a transformed, irreversible form), recovery code (stored in the same form).
- Employees: last name, first name, email address, password (stored only in a transformed, irreversible form), membership of handover sessions.
- Working hours: for each shift, the date, times, site and any "worked public holiday" mention; the month's remarks entered by the employee; the status of the month (sent, validated, correction requested) and the manager's comment, if any.
- Absences and leave: type, dates, the employee's comment if any and the manager's reply. No supporting document is stored.
- Handover messages: date, time, text, photo if any and the author's name.
- Documents: payslips and schedules placed by the employer for an employee (file, title, month, date sent, read or not). Only the employer and the employee concerned can access them; they are kept until the employer deletes them or the employee's account is deleted.
- Notifications: if you turn them on, your browser's technical subscription address, its encryption keys, your language and your evening-reminder preference.
- Referral: the company's referral code and, where applicable, the company that referred it.
- Subscription: chosen plan, subscription status, customer and subscription identifiers at Stripe. Bank card data, billing address and VAT number are collected and kept directly by Stripe: the Publisher never has access to card numbers.
- Technical data: IP address and connection information processed by the host to route requests and protect the service.
The working hours entered are stored on our servers and are visible to the employee and to the manager of their company. No geolocation is collected. The country is inferred from the IP address to display emergency numbers, without being stored.
Handover messages, photos and absence comments must not contain health data or other sensitive data: the service is not a certified health data host.
3. Why, and on what legal basis?
- Providing the service (accounts, hours, validation, absences, handover messages, employee management): performance of the contract.
- Sending notifications and the evening reminder: your consent, which you can withdraw at any time in Settings.
- Managing subscriptions, payments and invoices: performance of the contract and legal accounting obligations.
- Ensuring security (protection against repeated sign-in attempts, abuse prevention): the Publisher's legitimate interest.
No data is used for advertising, resold or used for profiling.
4. How long is it kept?
- Accounts, employees, hours, absences, handover messages and photos: for as long as the service is used, then deleted at the latest 3 months after the end of the subscription or trial, or earlier on request.
- An employee removed by the manager is deleted immediately, together with their hours, absences and notification subscriptions; their past handover messages remain visible to the session members with their name.
- Billing data: 10 years, in line with accounting obligations.
- Technical connection data: a limited period set by the host for the security of the service.
5. Who has access?
Handover messages are visible only to the members of the session concerned. The data is accessible to the Publisher for administering the service, and to its technical providers, within the limits of their tasks:
- Cloudflare, Inc. (hosting of the application and of the database, located in Western Europe);
- Stripe Payments Europe, Limited (payments and invoicing);
- the French government's public business directory ("Recherche d'entreprises" API), which receives only the SIRET number entered, to check that it exists;
- browser notification services (Google, Apple, Mozilla, Microsoft), which deliver your encrypted notifications without being able to read their content.
These providers belong to US groups. Any transfers outside the European Union are covered by the EU-US Data Privacy Framework and by the European Commission's standard contractual clauses.
6. Storage on your device
The application stores on your device, in the browser's local storage, what it needs to work: sign-in token, name, entered hours and subscription status. These items are strictly necessary for the service you asked for and do not require consent. No advertising cookies or audience-measurement tools are used.
7. Security
Exchanges are encrypted (HTTPS). Passwords and recovery codes are never stored in clear. Repeated sign-in attempts lead to a temporary lock. Access to handover messages is limited to the members of each session.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection regarding your data, as well as the right to set instructions on what happens to it after your death. To exercise them, write to flokyentreprise@gmail.com. You will receive a reply within one month.
You can lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).
9. Changes
This policy may change. The date of the update appears at the top of the page. In the event of a significant change, account managers are informed.