Privacy Policy

This Privacy Policy (the “Policy”) describes the data collection and processing practices of Avanquest Software SAS and its subsidiaries and Affiliated Companies (“Avanquest,” “we,” “us,” or “our”). The Policy explains what data we collect, why we collect it, and how we use it when you access our websites that link to this Policy (each, a “Website” and jointly the “Websites”), download or use one or more of our software products (“Product(s)”) and using or accessing any related services (together with the Websites and Products, the “Services”).
The titles and headlines are only for convenience purposes and are not legally binding.

Introduction

This Policy is designed in clear language and a modular structure to ease your understanding of its terms and navigation through it. This Policy forms part of your agreement with us and shall be read and consented to together with the terms of service and/or license agreement of the relevant Service.

Please read the Policy carefully to be sure you understand it and agree with its terms before you use any of the Services. If you do not agree with the terms in this Policy and the choices we provide do not mitigate your concerns, please do not access or use the Services. For any questions or matter related to this Policy, or your privacy rights, please contact our data protection officer at: dpo@avanquest.com.

General provisions

1. Jurisdiction and language

Please note that this Policy is designed with the EU General Data Protection Regulation (GDPR), the ePrivacy Directive and Quebec Law 25  directive in mind (jointly, the “Applicable Laws”). If you reside in any jurisdiction other than the EU, the EEA or the UK, and if you would like to learn more about our region-specific processing of Personal Information, you can directly navigate to the supplemental applicable jurisdictions notices below.

In accordance with Quebec’s Charter of the French Language (Bill 96), this Privacy Policy is available in French on our website. Quebec residents may request any privacy-related communication in French by contacting us at dpo@avanquest.com.

2. Scope and applicability

This Policy applies to all individuals who interact with our Websites, Products, or Services in any capacity, whether as visitors, users, customers, business partners, or vendors, and explains how we process Personal Information in connection with those interactions. If you are a business customer, additional or alternative terms may apply to you, including a data processing agreement (DPA) or other contractual privacy provisions governing our relationship.

2.1. Controller Information
Avanquest Software SAS is the data controller of the Personal Information provided that are processed in connection with the Services.
7270356 Canada Inc., operating as Avanquest Canada, is a subsidiary of Avanquest Software SAS and supports the operation of the Services in Canada, including customer relations, local compliance, and administrative functions.
We can be contacted at: contact@avanquest.com for general inquiries, or at dpo@avanquest.com for privacy-related inquiries.

2.2. Data Protection Officer (DPO)
If you wish to contact us in any matter concerning this Policy, you are welcome to do so through the above address or by email to our data protection officer (DPO) at: dpo@avanquest.com.

2.3. Categories of Data Subjects
This Policy applies to the following types of Data Subjects: (a) a visitor to a Website, including a Products webpage or landing page, s that link to this Policy or to this Privacy Portal (“Visitor(s)“); and/or (b) a user of any of the Products who downloads and installs a Product or otherwise interacts with the Services, whether accessing, downloading, installing, consuming or otherwise using them, (“User(s)“); and/or (c) a business customer, a business partner that has a contractual relationship with us, or a prospective customer or partner that is yet to be engaged in a contract with us (“Customer(s)“); and/or (d) a vendor, supplier or a Processor (“Vendor(s)“). Unless otherwise mentioned in this Policy, we refer to any type of Data Subject as “you”.

Changes to this policy

From time to time, we may update this Policy to accommodate changes in our Services, Products, and data processing policies and to conform to new legislation. If we introduce such changes, we will post the amended Policy in this Portal and the website of the specific Product or Service, and the changes will be reflected in the “last updated” date stipulated in the Policy.

In case of a substantial change, we will provide you with a more prominent notice, for example, posting a note on the Website or sending an email to you, if we hold your email address. Your use of the Website or Services following the effective date of any such modification, means you accept and agree to be bound by the modified Policy.

Transparency, consent and choice

You are not legally obligated to provide us with Personal Information (see definition below), and you acknowledge that providing us with Personal Information is done freely by you. You also acknowledge that we will not be able to provide you with the relevant Services or process requests you make without such information. Some of the Services will require you to submit specific Personal Information in addition to other information already processed about you. In such a case, you can choose whether you want to use such additional Services or not. .  To better learn about your rights relating to your Personal Information, please refer to the relevant section in this Policy, or the Privacy Rights section in the portal.

Personal information we may process and how

The information we process in connection with the Services can be one of the following:

• Personal Information (PI) means information that identifies you as a natural person, or that may be used, either alone or in combination with other information, to personally identify you as a natural person. Such information may include, for example, a first and last name, an email address, a phone number, a home or other physical address, and other contact information. In addition, in some jurisdictions (such as the EU, for example), and given the specific use we make with the information, an IP address, device ID, and cookies could be considered Personal Information as well.
  
  
• Non-Personal Information (non-PI) means information that cannot personally identify or lead to identifying a natural person. For example, statistics or aggregated information, or any other type of data that can no longer be attributed to you.

This Policy applies to information in the nature of the former, and can be processed in one of the following ways:

1. Information you submit to us

For example: forms you submit, accounts you open, or information you share when you actively contact us via one or more of the channels we may make available to you.

Submitting information to us is optional in certain cases and required in others, depending on the Services you choose to use or access, and whether you are a Customer or a User. This category includes one or more of the following data categories:

Contact details.

We may process your contact details (such as name, email address, or phone number) in case you submit those to us when you contact us, open an account with us, subscribe to our mailing list, or reach out to our support services, as further described below.

Subscription to our mailing list.

If you voluntarily subscribe to our email communications, you will be asked to provide us with your email address. You can unsubscribe at any time using the unsubscribe option within the body of the email sent to you or by contacting our DPO at dpo@avanquest.com.

Purpose: We use your email address to send you information related to the Products and Services, provide you with tips related to our Services and, subject to your consent,  promotional and marketing emails.

Retention: We retain your marketing and mailing list data, including your email address, consent records, and interaction history, for a period of three years from the date of your last recorded interaction with our marketing communications, which may include your most recent email open, click, opt-in, or direct marketing interaction.

Signing up, registration, and account management.

Some of the Services require registration and signing up to a user account, for example, when you use any of our trial software licenses or, when you choose to purchase a Product license. If you choose to do so, you will be asked to submit some information such as your email address, full name, and other Personal Information as the submission form indicates.

Your email address will be used as your username together with a password of your choice for authentication and authorization purposes. This information will be used to uniquely connect your account and purchases with you, your device, and your usage and for account authentication and security purposes. Upon your consent, your email address will  also be used to send you information, updates, and newsletters about our Services.

Purpose: We use your account information to assign an account to you, secure your access to your account, manage your installations and purchases of license activity, and provide you with access to your account and the ability to manage it directly.

Retention: We retain your account and profile data, including your name, email address, login credentials, and preferences, for the duration of your active use of our Services and for a period of five years thereafter.

Purchasing a product license.

If you wish to purchase a product license from us, you will be asked to provide your contact information, such as your full name, email address, billing information, shipping information (if relevant), and any other purchase-related information, in order to process your purchase, issue a license key for you, contact you in case of support necessity if an issue arises, and to protect the access to your account and purchased Product licenses. We also use this information to deliver purchase confirmations, notifications, download links, activation keys, support and product notices and other Product-related needs.

Upon your requested payment method, certain payment information may be further processed (“Payment Information”). Please note that depending on the product you purchase and the payment method you select, your Payment Information will be collected either by our own payment processing services, or our third-party payment processors. Payment Information is collected and processed by an Affiliated Company that provides billing and payment processing services on our behalf. Therefore, Payment Information will be collected and stored in its secure facilities, certified with the strict PCI DSS certificate, and its privacy policy will be made available from the checkout page, and at: https://avanquest.upclick.com/Legal.aspx?p1=%2F0ym%2Ff9NtlE%3D&p3=JwYRvKNrhHI%3D&p4=DmYSD18sR28%3D.  If you purchase a license via a mobile application store, the relevant store will process your payment directly. Your payment information will be used to charge you for the product by our affiliated payment processing services or by our third-party payment processors.

Purpose: We use this information to process your order, to deliver the Product you ordered, whether physically or by sending you your license key directly to your email address, to manage your purchase and the license key as per your selected type of subscription, and to protect the access to your account and purchased Product licenses.

We also use this information based on your consent and sometimes for our legitimate interest of assigning you a license key based on your specific type of subscription and the specific type of device you associated with the license key. We associate your license key with your email address and device information. If we learn that it is necessary to prevent fraud and abusive conduct, we may add additional data to it. Upon your consent, your email address will also be used to send you information, updates and newsletters about our services.
In case there is an issue with your order, one of our representatives will use the contact details you submitted in order to reach you by email or phone.

Retention: We retain your product license data, including your license key, activation records, and device associations, for the duration of your license validity and for a period of five years thereafter. 

Electronic Signature Service (Soda PDF E-Sign)

When you use our electronic signature feature, we process additional personal data specific to this service. Please refer to the dedicated Electronic Signature Service section of this Policy for full details of what we collect, why we process it, and how long we retain it.

Contacting us/Support.

When you choose to contact us, we will process your inquiry details and content, including your contact details, in order to address such inquiries you have submitted to us. If you contact us for support, feedback, or other inquiries, either through an online form available on our Websites, by sending us an email, or by other means of communication we make available (such as by phone or submitting a bug report or filling in a survey), you will be requested to provide us with your name and email address (or other contact information, as the case may be and depending on how you want us to contact back), and the subject matter of your inquiry.

Purpose: We use this information, based on your consent and our legitimate interest, for the purpose for which it was provided, including, responding to your inquiry and providing you with the support or information you have requested, monitoring status, and for ticketing and recording purposes. This includes addressing any “Help and Support” ticket or chat you submit to us via the Websites or Services.

Retention: We retain your customer support data, including support tickets, chat logs, and correspondence, for a period of five years from the date on which your inquiry was resolved, as determined by the date of ticket closure or your last recorded correspondence with our support teams.

Business customer information.

If you are a business partner, business customer or potential business partner, we may store certain contact information and job title information about you in our CRM systems. This may include full name, work title, work email address and name of the company in which or for which you work, website URL, phone number, and country.

Purpose: We retain and process this information for CRM purposes and business needs, based on your consent and our legitimate interest, that may have been provided to a third party that introduced your details to us. If we enter into a contract, then this will be the lawful basis.

Retention: We retain your account and profile data, including your name, email address, login credentials, and preferences, for the duration of your active use of our Services and for a period of five years thereafter.

Files and/or media uploading.

Certain Products allow you to upload documents, files, or media (“your Content“). In the event that your Content includes any Personal Information, this information will be subject to your use and responsibility. We do not retain your Content, rather than any metadata required to operate, process and support your use of the Product. As a rule of thumb, your Content is retained locally on your local storage.

Upon your choice and request, we may offer you a backup option or cloud storage. In this case, it will be encrypted, and we will have no access to your Content. In any case, we implemented technical and organizational measures to ensure, from our side, maximum protection for you while you are using our Websites or Services.

Purpose and Retention: such type of data will be processed and stored only to the extent necessary and for the time scope required to provide you with the Services, operate them and secure them. In most cases, Your Content will be retained locally on your device, unless you select to use any SaaS or cloud-based version, in which case you may choose to sync or not sync Your Content with the cloud.

Browser and mobile permissions.

When you choose to install the Product on your mobile device, or browser, we will ask for your approval (consent) of the permissions required for the Product you choose to install. For extended functionalities that we may offer from time to time, to update the operating system of your mobile, and its respective application store, to approve special permission (opt-in consent), such as access to your media files.

Job recruitment

If you choose to apply for a job in one of our companies, you will be asked to submit a form and upload your CV file. In such case, your application information will be processed by ADP, LLC, our third-party service provider, which provides recruiting services on our behalf. For additional information, please see ADP’s privacy policy.

Retention: We retain this information for as long as your application for a position is under review, and/or for as long as required by applicable local legislation.

2. Information automatically processed

This category refers to the means we use to improve our Customers’ and Visitors’ experience. and our process performance for our Services.

When you access one of the Websites, download, install or otherwise use a Product or otherwise use the Services, certain information about your actions in connection with the Services, your device, and website visitors may be processed in order to provide the Services, maintain them, understand User’s usage habits, improve the Services with updated versions and additional features, support them and protect them. This data category includes one or more of the following:

Online identifiers

When you access our Websites or use the Products or Services, we may process one or more of the following online identifiers: the IP address that your internet provider assigned to your device and access to the web, cookies information as specified in our Cookie Policy. Like any other digital service, such information is available via your local storage and processed through cookies, pixel tags, and log files.

We use this information to learn about the usage of the Websites, and the features we offer, and to extract analytics and statistics over time. In certain cases, and when a Visitor becomes a User, we may generate a dedicated random User ID to help us avoid providing redundant Services and offers.

This processing of local storage data and online identifiers is subject to your consent which is obtained through the cookie consent notification displayed on our Websites, in which you can accept, decline or set your preferences (with the exception of strictly necessary cookies). We provide full disclosure in our cookie policy and information about the type of cookies used, and how and why we use them. Please note that necessary cookies will be used as part of our legitimate interest and for purposes of Website’s functionality.

Purposes: The use of Online Identifiers serves one or more of the following purposes: (i) As part of our legitimate interest, we use certain online information for analytics and statistical purposes when we want to learn how Visitors and Users use our Websites and Services, and when we want our Services to be responsive to Users’ and Visitors’ actions. (ii) We also use IP addresses many times as part of our legitimate interest to monitor, detect and prevent fraud or any automated non-human actions across our Websites and Services. The IP address also serves our legitimate interest to learn the country from which you access the Services and make sure we serve the Products and Services in the right language and in compliance with the jurisdiction in which we offer our Products and Services. (iii) In certain cases, and upon your consent, third-party cookies and tags will be used for advertising and marketing purposes of our Products and Services, including by using retargeting. See further explanation under “Third Party Services”.

Retention: The retention period for each of the information mentioned in this section is different. You can visit the Cookie Policy available per website or application to learn about each cookie’s or web technology’s retention and expiry term. You may visit the Cookie Policy available per website to learn about each cookie’s or web technology’s retention and expiry term. Otherwise, we retain online information for as long as necessary to achieve the purpose for which it is processed, to begin with, or, until we make it Non-Personal Information, in which case, we reserve the right to retain the information without any time limitation, based on our discretion and commercial necessities.

You may opt out of non-essential product analytics by adjusting your settings within the Product, or by contacting dpo@avanquest.com.

Device Information

We may collect certain information about the device from which you access the Websites, use Products, and Services, such as user-agent (that includes the browser type and version, IP address, operating system type, and version), device type (mobile/desktop), type and version of your operating system, your MAC address, the language you use on your device, and, when you choose to purchase a license to more than one device, we associate your license key and user ID with your email address and device information.

Purposes: Based on your consent, and in certain cases, our legitimate interest, we may process device information for one or more of the following purposes: (i) Product’s compatibility purposes, to the right device type, the relevant operating system’s version and features. (ii) Offering additional Services or features specifically designed for your device type, for instance, mobile vs. desktop. (iii) To associate a license key issued to you with the device on which you install the Product. (iv) The Products’ core functionality is to help you manage your device’s space and optimize your ability to use it. (v) To improve Product’s functionality and security. In that case, as part of the Product’s functionality and based on our legitimate interest we will access certain device information that is required to provide, maintain and support such functionality.

Retention: We retain device information for as long as necessary to provide the Product’s functionality, to maintain a record of your license key and usage of the product, and to associate license terms and renewals.

Online activity

We also process certain online activity information from Visitors, for example, if you click an advertisement of our Product, we will get the source URL from which you click the advertisement, or, by using third-party services (such as retargeting), we may offer to you one or more of our Products when you visit other websites. Under this category, we may also capture your clicks on buttons in log files across our Websites or online Services, if provided, as described under the category of “Online Identifiers”.

Purpose: We use this information for the following purposes: (i) Based on your consent for advertising, marketing and retargeting of our Products and Services. (ii) Based on our legitimate interest – to make the Website, Products and Services responsive and functional, to measure and calculate our payments to advertisers and to monitor and prevent ad fraud concerning our Products and Services.

Installation reports

When you install one or more of our Products, our server may receive some information about your systems such as the type of your Operating System, version, language, timestamp of installation and the IP address that your internet service provider allocates to your computer, for purposes of ensuring that the device and installation are real and not fraudulent and to ensure that the device is one that was not already installed the same product before (anti-fraud purposes). We need this data so we can serve the installed file, operate it and ensure compatibility.

Purpose: This information is collected for purposes of enabling the installation of the Product, recording it in our systems, being able to serve you with the Services via our servers when you use the Product, and tracking and making sure that the device and installation are real and not fraudulent. We also need this data so we can serve the installed file, operate it and ensure compatibility.

Retention: We retain this information for as long as the Product is installed on your device, and sometimes longer if we believe in our discretion that your device and any associated installation are associated with fraudulent installations or any other malicious usage of our Services.

Product Activity

We automatically record and process activities related to the Product’s usage and functionality in order to be responsive to them or allow you to revert certain actions you took.

Media and marketing channels

We use digital media channels in order to market and advertise our Products and Services. When you land on our Website as a result of clicking an ad, we will receive information about the source media from which you arrived at our Services. This information includes a referral URL (the URL from which you arrived at our Site) and your IP address and will be collected via tags and cookies. The purpose of processing this data is to understand the marketing channel from which you arrived, measure and calculate purposes for the advertising, measure the effectiveness of a marketing channel and filter fraudulent actions associated with such marketing and advertising channels.

3. Information about you

This category refers to data we may receive from third parties concerning the Services we provide to you.

We may, in some circumstances, and upon your consent or our legitimate interest, receive information collected from you by third-party services. This information may include, for example, other services you interacted with via our Services. This category includes information you provided to a third party, and we may get access to it. This includes the following:

Billing information

When you purchase a Product your payment and billing information is collected and processed by our payment processor vendor. In this case, we will get access to the order and billing information, however, we will not have any access to your credit card details.

Authentication and social media

When you open an account and/or sign up for the Services, you may have the option to use social or email authentication. In this case, again, we will have access to metadata (such as tokens), and upon your consent, your social media’s public profile.

Marketing

When we buy media and market our Products and Services, we may get certain online information about visitors from third-party media owners, such as Facebook or Google. This information does not personally identify you and is used to learn how successful (or not) our campaigns are.

SSO and Social handles

When you use your social media account to sign in to our services, we may have access to certain public information you submit to such social media platforms.

Cookies and web technologies

A cookie is a small text file that is placed on the browser of the hard drive of your computer (or similar device) by websites you visit. Cookies are typically used in order to make websites function, or function more efficiently, as well as to provide information to the operator of the particular website. Cookies make your use of the Site and Services easier to use and improve their functionality. They are used to make the login process easier for our users, to allow the website to track which products you have added to your cart and your preferred country, language, and currency, and to track the website’s’’ Visitor across the Website.

When you first visit our website, a cookie consent banner is displayed allowing you to accept, decline, or customize your cookie preferences. Only strictly necessary cookies are placed before you make your choice. You can modify your preferences at any time by clicking the cookie settings icon available on each page.

Some of the Services, features, and tools that are integrated into our Site and Services may use their own cookies to be able to function properly. To know more about our cookies and our 3rd party cookies, please refer to the cookie policy available on the website you browse. Please be aware that you may set your browser to refuse or block any cookies from us or our 3rd party partners. In this case, however, some of the Services may not properly function.

Purpose and how we use personal information

We use your Personal Information for the purposes we described next to each data type above, and for the following purposes:  (1) Providing our Services, supporting them, improving them, and securing them so as to better market and advertise them. (2) We use certain information to prevent fraud and fake installations. (3) To Open an account for you, manage it and support it.

Electronic Signature Service

When you use our electronic signature feature (Soda PDF E-Sign), or when someone sends you a document  to sign through  our service, we process additional personal data as described in this section.

What we collect for e-signing

• Your name and email address
• Your electronic signature (drawn, typed, or uploaded).
• IP address at the time of signing.
• Timestamp of each signing action.
• Document content and metadata
• Audit trail of all actions taken on the document (viewing, signing, declining).

The audit trail records the following data for each signature event: signer’s email address, IP address, approximate geographic location derived from IP, browser and device information (user agent), timestamps of each action (document opened, viewed, signed, or declined), and authentication method used. This data is retained for the same period as the signed document.

Why we process this data
The purpose is to create and maintain legally binding electronic signatures. Our e-signature service creates Advanced Electronic Signatures (AES) as defined in eIDAS Art. 26. Under eIDAS Art. 25(1), an electronic signature shall not be denied legal effect solely because it is in electronic form. However, only Qualified Electronic Signatures (QES) issued by a Qualified Trust Service Provider carry the legal presumption equivalent to a handwritten signature under Art. 25(2). For qualified signatures, users should engage a Qualified Trust Service Provider listed on the EU Trusted List. Our e-signature service complies with the following regulations.

• EU: Regulation (EU) No 910/2014 (eIDAS) – Advanced Electronic Signatures (AES) under Article 26 ensuring all requirements:  a) Uniquely linked to the signatory b) Capable of identifying the signatory c) Created using data under the signatory’s sole control d) Linked to the data signed.
  
• US: Electronic Signatures in Global and National Commerce Act (ESIGN Act, 15 – U.S.C. 7001) and the Uniform Electronic Transactions Act (UETA).
  
• UK: Electronic Identification and Trust Services for Electronic Transactions Regulations 2016.
  
• Canada: Canada Evidence Act (ss. 31.1-31.8) and PIPEDA.
  
• Quebec: Act to establish a legal framework for information technology (LCCJTI) and Law 25.

Legal basis for processing

• Account holders who send documents for signature: Contract performance (GDPR Art. 6(1)(b)) – processing is necessary to provide the e-signature service you requested.
  
• Invited signers (recipients): Legitimate interests (GDPR Art. 6(1)(f)) – the sender’s and our interest in executing legally valid signed documents. We balance this against your privacy by collecting only what is strictly necessary, providing full transparency, and offering the right to object.
  
• Audit trails and record retention: Legal obligation (GDPR Art. 6(1)(c)) – we are legally required to maintain audit trails and signed documents for evidentiary and compliance purposes.

Where is your e-sign data processed
E-signature data is processed and stored in Canada (Ontario) by 7270356 Canada Inc. (Avanquest Canada) on behalf of Avanquest Software SAS. Canada benefits from an EU adequacy decision (Decision 2002/2/EC, GDPR Art. 45) for recipients covered by PIPEDA. For UK transfers: UK adequacy regulations (SI 2019/419, Sch. 1). For US-based sub-processors: EU Standard Contractual Clauses (Art. 46(2)(c)) and UK International Data Transfer Agreement (IDTA). Copies of these safeguards are available from dpo@avanquest.com.

Who receives your e-sign data

• 7270356 Canada Inc. (infrastructure operator and processor, Canada).
  
• GlobalSign NV/SA (digital signature and timestamp provider, Belgium).
  
• LeaseWeb (hosting infrastructure, Canada/Ontario). Microsoft Azure (cloud services).
  
• Claranova Group entities involved in the transaction.
  
• Legal authorities where required by law.

How long we keep e-sign data
Signed documents and their audit trails are retained for up to 10 years from the signature date, in accordance with French commercial law (Code de Commerce, Art. L123-22). Unsigned documents and expired drafts may be deleted sooner. For Canadian residents, retention is also governed by applicable Canadian limitation periods.

If someone else sent you a document to sign
Your personal data (name, email) was provided to us by the person who sent you the document for signature (GDPR Art. 14(2)(f)). You have the same rights as described in this privacy policy.

Your additional rights for e-sign

• You may withdraw from electronic delivery at any time by emailing dpo@avanquest.com. This does not affect the legal validity of signatures already applied.
  
• You may request paper copies of any electronically signed document.
  
• Quebec residents have the additional right to de-indexing (Law 25, s. 28.1).
  
• Signed documents may need to be retained even if you request erasure, as we have a legal obligation to preserve them.

Automated decision-making
We do not use automated decision-making or profiling in connection with the e-signature service.

DPIA statement
A Data Protection Impact Assessment (DPIA) has been conducted for our e-signature service in accordance with GDPR Article 35. A summary is available upon request from dpo@avanquest.com.

Where to complain

• EU: CNIL (cnil.fr) or your national data protection authority.
  
• UK: Information Commissioner’s Office (ico.org.uk).
  
• Canada: Office of the Privacy Commissioner (priv.gc.ca).
  
• Quebec: Commission d’acces a l’information du Quebec (cai.gouv.qc.ca).

Lawful basis for processing Personal Information

In addition to the lawful basis mentioned next to each data category:

If you are a Customer, our lawful basis for processing your Personal Information is a contract or preparation for contractual engagement. Otherwise, we will process Personal Information based on your consent, if required by Applicable Laws, or legitimate interest when processed for such an interest. Otherwise, the lawful basis for data processing will depend on the Personal Information concerned and the specific context in which we collect it: (a) we normally process Personal Information where we have your consent to do so, for example, when you submit a form to us or open an account with us, or confirm our cookies usage; or, in certain cases (b) where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, such as when we use the data in order to provide the core Services, or when used for anti-fraud purposes.

In some cases, we may also have a legal obligation to collect Personal Information from you or may otherwise need the Personal Information to protect your vital interests or those of another person. If we ask you to provide Personal Information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Information is mandatory or not.

If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, including if you would like to better understand how our legitimate interests in processing your data are balanced against your data protection rights and freedoms, please contact us.

Data Retention

The data controller for all processing activities described in this policy is Avanquest Software SAS, a company registered in France (RCS Nanterre). Avanquest Software SAS determines the purposes and means of processing across all group entities, including payment processing operations conducted by its affiliates.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with applicable law. The specific retention periods for each category of data are set out in the table below. These periods are based on French law (GDPR, Code de Commerce, Code civil, CNIL guidelines) as the most demanding applicable standard, and satisfy or exceed the requirements of all jurisdictions in which we operate – including Quebec (Private Sector Act, CQLR c P-39.1, as amended by Law 25) and California (CPRA).