Personal data protection policy

1. Controller and contact details

Care And Fly, a French simplified joint-stock company (société par actions simplifiée) with share capital of €1,000, registered with the Paris Trade and Companies Register under number 995 223 443, whose registered office is at 30 boulevard de Sébastopol, 75004 Paris, France (“Care & Fly”, “we”, “us” or “our”) is the controller for the processing it determines in relation to the website, business development, customer relations, system security, recruitment and data-subject rights.

For any data-protection question or request, contact contact@careandfly.eu or write to Care & Fly – Data Protection, 30 boulevard de Sébastopol, 75004 Paris, France.

2. Allocation of roles for Bernadette

Where an organisation makes Bernadette available to its workforce, that organisation generally determines the purposes, intended users, modules and key arrangements. It acts as controller and Care & Fly acts as processor when providing the service on its documented instructions.

The customer organisation remains responsible for the legal basis, workforce information, employment-law procedures, proportionality and access rights. Care & Fly may act as controller for its own obligations, including security, abuse prevention, billing, contract administration and the establishment or defence of legal claims.

3. Mental-health data

Bernadette is an awareness and prevention tool. It is not a medical device, consultation, diagnostic service, clinical assessment or employment-decision tool. Care & Fly does not ask users to disclose a diagnosis, condition, treatment, disability or medical history and does not provide employers with individual mental-health scores.

Users must not submit health data or information that identifies an employee or individual workplace situation. Sensitive data volunteered without necessity may be masked or deleted, subject to applicable security and evidential requirements.

4. Artificial intelligence

The current version of Bernadette does not use artificial intelligence to generate content based on a user’s answers, analyse answers or assess mental health. Its content, scenarios and learning rules are predetermined. User answers are not used to train an AI model.

Care & Fly does not make solely automated decisions producing legal or similarly significant effects. Any future AI feature that changes these practices will be covered by updated information before activation.

5. Categories of data

Depending on the relationship and enabled features, we may process:

• Professional identity and contact data: name, business email, organisation, role and language preference.
• Account and authentication data: identifier, role, status, identity provider, creation and last-login dates.
• Learning data: assigned modules, progress, completion, structured answers, quiz results, choices and voluntary feedback.
• Communications with Care & Fly: contact, support, demonstration, contractual or recruitment exchanges.
• Technical data: IP address, browser, device, timestamps, logs, errors, security events and privacy choices.
• Contract and finance data concerning professional contacts, quotations, agreements, invoices and payments.

6. Purposes and legal bases

Care & Fly processes data to answer enquiries, arrange demonstrations, manage prospects and customers, perform contracts, invoice, recruit, secure and improve its services, handle rights requests and defend its interests. Depending on the circumstances, processing is based on steps taken before entering into a contract, performance of a contract, a legal obligation or legitimate interests.

Marketing messages requested through the form rely on separate, optional and unticked consent confirmed through double opt-in. Consent may be withdrawn at any time. For Bernadette, the customer organisation determines the relevant legal bases; employee consent is not used as the general basis where the employment relationship prevents a genuinely free choice.

7. Sources of data

Data may come directly from the individual, the website form, the customer organisation, an authorised identity provider or professional tool, and the use of the website or Bernadette. The customer organisation must provide only necessary data and inform the individuals concerned.

8. Recipients and service providers

Access is restricted to authorised Care & Fly personnel, authorised customer administrators within the contractual scope, and providers strictly necessary for hosting, authentication, messaging, support, business management, security and consented audience measurement.

For the landing page, requests are collected through Zoho Forms and transferred to Zoho CRM. Zoho Campaigns is used only for people who consent to marketing and confirm their subscription. Data may also be disclosed to legal advisers, auditors, insurers or competent authorities where necessary or legally required. Care & Fly does not sell personal data.

9. International transfers

Care & Fly gives preference to processing in the European Union or European Economic Area. Where a provider involves a transfer to a third country, the transfer relies on an adequacy decision, the European Commission’s Standard Contractual Clauses or another GDPR safeguard, together with supplementary measures where required.

Information specific to Bernadette’s processors and processing locations is provided in the contractual documentation for the relevant deployment.

10. Security

Care & Fly applies risk-appropriate measures intended to prevent destruction, loss, alteration, unauthorised disclosure or access, and unavailability. Depending on the component and risk, these include protected communications, individual access controls, logical separation between organisations, logging, vulnerability remediation, backups and incident procedures.

These principles are not a claim to hold a certification. Detailed measures for Bernadette are specified in the applicable contract and security documentation.

11. Retention periods

Data is kept only as long as necessary for its purpose and evidential obligations:

• New Zoho Forms submissions: scheduled to be moved to trash automatically every 30 days and permanently deleted by Zoho after five further days. Taking Zoho’s initial safeguard cycle into account, covered entries remain subject to a retention period of less than 90 days. Entries predating the setting or held by a pending action are handled separately by an authorised administrator.
• Unqualified prospects: deleted or anonymised no later than three years after the last active contact.
• Marketing suppression records: minimum data retained as necessary to respect the objection.
• Contracts: for the relationship and the applicable limitation period; invoices and accounting records: ten years.
• Applications: two years after the last contact, unless the applicant objects or a different obligation applies.
• Bernadette data: for the period set by the contract and customer instructions, followed by the agreed export and backup cycles, then deleted or anonymised.

12. Cookies and audience measurement

The website operates without non-essential marketing trackers. Trackers strictly necessary for security, operation or recording a privacy choice may be used without consent where the legal exemption applies.

Zoho PageSense will load only after an explicit choice and only while a useful test is active. You may refuse or withdraw your choice through “Manage preferences” in the footer.

13. Your rights

Depending on the processing and legal basis, you may request access, correction, erasure, restriction, objection and portability, withdraw consent, give instructions for the use of your data after death under French law, and request not to be subject to solely automated decisions with significant effects.

For the website and your direct relationship with us, write to contact@careandfly.eu. For Bernadette, contact the organisation that provides the service first; Care & Fly will assist it. Strictly necessary identity checks may be requested. You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

14. Minors and changes to this policy

The website and Bernadette are primarily intended for adults acting in a professional context. Care & Fly does not knowingly collect data about a minor outside a deployment specifically defined and safeguarded with the customer organisation.

This policy may change as the website, services, providers or law evolve. A change materially affecting rights or processing will be appropriately communicated before it takes effect.