Privacy and Cookie Policy
Last updated: August 2026
This privacy policy informs you of the considerations and security measures that govern and protect the information you provide to us when using our services, hardware and software.
In order to keep you informed of developments in the processing of this data, this policy may be amended from time to time. Accordingly, you will be notified of any update where applicable, and we invite you to note the date of the most recent update, which always accompanies it.
Protection of personal data
For information, within the meaning of the GDPR, “personal data” means any data relating to a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, psychological, economic, cultural or social identity.
As a general rule, we collect the information necessary for the performance of the contracts between us, on the basis of Article 6(1)(b) of the GDPR, namely: your last name, first name, position within the company, contact details and affiliation with your company.
Each processing activity rests on a distinct legal basis: performance of the contract for the provision of the Service and support; our legitimate interest for the improvement of our products and for statistical and comparative analyses; and your consent for direct marketing, geolocation and non-essential cookies, which you may withdraw at any time. The applicable retention periods are set out in Section 4.
In accordance with the General Data Protection Regulation adopted by the European Parliament on April 14, 2016, and with French Act No. 78-17 of January 6, 1978 on Information Technology, Data Files and Civil Liberties, as amended, WeSteer.biz SAS informs you of the following:
1. Identity and contact details of the data controller
In the course of its activities, WeSteer.biz SAS may collect and process data in various ways.
We act as data controller for the data we collect and use for our own purposes, in particular those described in Section 2. We act, by contrast, as processor for the data that our business customers process by means of the Service: in that case, the data controller is the customer concerned, and the respective responsibilities are governed by the contract entered into with that customer.
The data controller is WeSteer.biz SAS (NACR), a simplified joint-stock company with share capital of EUR 1,000, 14 avenue de l'Opéra, 75001 Paris, France, registered with the Paris Trade and Companies Register under number 948 909 502. Contact: hello@westeer.io
In addition, for all practical purposes, we inform you that a Data Protection Officer (DPO) has been appointed. hello@westeer.io
2. Purposes of processing
In accordance with the GDPR, WeSteer.biz SAS may process your Personal Information for the following purposes:
(a) to provide you with information or services relating to the services and contracts between us (including: newsletter mailings, commercial offers, IT support, helpdesk, managed services, hosting, training, development, supply of software and hardware, and provision of telecommunication lines); and/or
(b) to collect information enabling us to improve our offering, products and services (including through the cookies used on our websites); and/or
(c) to be able to contact you about various events relating to WeSteer.biz SAS, including in particular product updates and customer support.
(d) to use the data generated during use of the Service for research and development, statistical and comparative analyses, geolocation, and the delivery of advertising or marketing messages. These processing activities rest on our legitimate interest, with the exception of direct marketing and geolocation, which rest on your consent and may be withdrawn at any time.
3. Persons who may access this data:
Only employees of WeSteer.biz SAS may access the data you transmit to us, strictly within the scope of the performance of their duties.
All necessary security measures have been taken to ensure that this data is never transmitted to a third party, notwithstanding the processors engaged by WeSteer.biz SAS.
In addition, WeSteer.biz SAS does not sell or rent your personal data to third parties. It does, however, collect, retain and use the data generated during use of the Service for the purposes described in Section 2, and it ensures that the same undertakings are observed by all of its processors.
4. Storage limitation
Personal Data must be kept in a form permitting identification of the data subjects for no longer than is necessary for the purposes for which it is processed:
for customers: the term of the contract, followed by archiving until the expiry of the applicable statutory limitation periods
3 years from the last contact for prospect data
2 years from receipt of the application for candidate data
Where several purposes concern the same data, each retention period applies to the corresponding purpose; the data is deleted or anonymized upon expiry of the last active purpose.
These periods are nevertheless applied in compliance with the applicable statutory and regulatory provisions.
5. Data protection rights
You have rights in respect of your Personal Information, which you may exercise by writing to us at the postal address given in Section 1.
In accordance with the applicable regulations, you have in particular:
Right of access:
You have the right to request information about the personal data we hold about you.
Right to data portability:
You have the right to obtain a copy of your data, transferred to you or to another party in a structured and commonly used format. This concerns only the personal data you have provided to us.
Right to rectification:
You have the right to request the rectification of your personal data if it is inaccurate, including the right to have incomplete personal data completed.
Right to erasure:
You have the right to request the erasure of any personal data at any time, subject to the conditions provided by law. You are informed, however, that for reasons of statutory record retention and traceability, we may not delete the information relating to your personal data. In such a case, it would be anonymized as permitted by the GDPR.
Right to object to processing based on a legitimate interest:
You have the right to object, on legitimate grounds, to the processing of your personal data.
Right to object to direct marketing:
You have the right to object to direct marketing, in particular by unsubscribing through the links provided for that purpose in each of our commercial email campaigns.
Right to lodge a complaint:
You have the right to lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
6. Response time
WeSteer.biz SAS undertakes to respond to your request for access, rectification or objection, or to any further request for information, within a reasonable time that shall not exceed one month from receipt of your request.
In addition, WeSteer.biz SAS informs you that it will be entitled, where applicable, to refuse manifestly excessive requests (by reason of their number or their repetitive or systematic character).
7. Approved service providers and transfers outside the European Economic Area
WeSteer.biz SAS informs you that it may engage several authorized and qualified service providers and partners in order to facilitate the collection and processing of the data you have provided to us. These providers operate principally within the European Union. Some of them, or their own subcontractors, may process your data outside the European Economic Area; such transfers are then governed by an adequacy decision of the European Commission or, failing that, by the standard contractual clauses adopted by the Commission, a copy of which you may obtain on request at hello@westeer.io.
WeSteer.biz SAS has satisfied itself in advance that its providers implement adequate safeguards and comply with strict conditions as to the confidentiality, use and protection of data.
The list of our processors is available on request. We will inform you of any change of processor, and you may, within a reasonable time, raise a reasoned objection to that change, in accordance with Article 28 of the GDPR.
8. Cookies and trackers
Our website uses cookies and trackers falling into three categories: cookies strictly necessary for the operation of the website, which do not require your consent; audience-measurement cookies; and personalization and advertising cookies.
The placement of cookies that are not strictly necessary is subject to your prior consent, obtained on your first visit by means of the banner provided for that purpose. You may withdraw your consent at any time, without affecting the lawfulness of prior placements, by changing your preferences from that same banner or by configuring your browser.
Cookies are retained for no longer than thirteen months from the date they are placed, and the data collected through them is retained for no longer than twenty-five months.
9. Security measures and personal data breach procedure
As an IT services provider, our information systems are equipped with current protection technologies and systems and with the highest security safeguards.
We also remain vigilant, regularly testing and strengthening all of these systems in line with developments in the latest IT threats brought to our attention or identified by our experts through enhanced technology monitoring.
We regularly inform and train all of our staff on security practices concerning the processing of the data held in our information systems. They also undertake to comply with strict procedures set out in our IT charter and in our employees' employment contracts.
If, despite all the care we have taken to secure our information system as a whole, a data breach should occur, we undertake to notify the CNIL within 72 hours after becoming aware of it of any breach of your personal data likely to result in a risk to your rights and freedoms (cyberattack, access to files by an unauthorized or malicious person), and to inform you of the breach where it is likely to result in a high risk.