01 Introduction
This Privacy Policy explains how ouwba collects, uses and protects personal data when you visit our website, use our platform or work with our experts. We are committed to handling personal data in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act ("Loi Informatique et Libertés").
02 Data controller
The data controller responsible for your personal data is:
When we process compliance documents on your behalf as part of the platform, we act as a processor and you remain the controller of that data. We act as controller for the data we collect to run our website, accounts and business.
03 Data we collect
We collect the following categories of personal data:
- Account & identity data, name, work email, role, company and login credentials.
- Customer content, the documents, evidence and information you upload to prepare your certification, which may include the personal data of your team members.
- Usage data, how you interact with the platform, including log data, device and browser information.
- Communications, messages, support requests and notes exchanged with our experts.
- Billing data, the information needed to invoice and process payments.
04 How & why we use it
We process personal data for the purposes and legal bases below:
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and operating the platform and expert support | Performance of a contract |
| Account management and customer communication | Performance of a contract |
| Improving and securing the Service | Legitimate interest |
| Billing, accounting and legal obligations | Legal obligation |
| Marketing communications about ouwba | Consent / legitimate interest |
We do not sell your personal data, and we do not use Customer content to train models or for advertising.
05 Sharing & sub-processors
We share personal data only as needed to run the Service:
- with trusted sub-processors (for example cloud hosting, infrastructure and support tools) bound by data-processing agreements;
- with certification bodies and partners where you ask us to support your audit;
- where required by law, regulation or a valid legal request.
A current list of sub-processors is available on request at privacy@ouwba.com.
06 International transfers
We aim to keep personal data within the European Union. Where a sub-processor processes data outside the EU/EEA, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.
07 Data retention
We keep personal data only for as long as necessary for the purposes described above:
- account and customer data for the duration of the contract, then for a limited archival period;
- billing records for the period required by applicable accounting and tax law;
- website and usage logs for a limited period for security and analytics.
After these periods, data is deleted or anonymised.
08 Security
As a security-first company, we apply technical and organisational measures to protect personal data, including access controls, encryption in transit and at rest, logging and regular review of our security practices. No system is perfectly secure, but we work continuously to protect your data and will notify you of any incident as required by law.
09 Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise these rights, contact us at privacy@ouwba.com.
If you believe your data is not handled properly, you also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
10 Cookies
Our website uses cookies and similar technologies that are strictly necessary to operate the site, plus optional cookies for measurement and to improve your experience. You can manage non-essential cookies through your browser settings or our cookie banner where available.
11 Changes
We may update this Privacy Policy from time to time. The "last updated" date above reflects the latest version, and we will inform you of material changes by a reasonable means.
12 Contact
For any question about this policy or your personal data, contact us at privacy@ouwba.com or by post at OUWBA, 14 avenue du Général de Gaulle, 94160 Saint-Mandé, France.