AeroCertLink — Privacy Policy

AeroCertLink, a société par actions simplifiée unipersonnelle registered with the Lyon Trade and Companies Register under number 130 794 274, with its registered office at 33 Chemin du Clos Burtin, 69230 Saint-Genis-Laval, France (“AeroCertLink”, “we”), is the controller of the personal data described in this policy.

Contact for any privacy matter: privacy@aerocertlink.com, or by post to the address above.

Person in charge of the protection of personal information (Québec, Act respecting the protection of personal information in the private sector, section 3.1): Antoine Begon, President, privacy@aerocertlink.com.

Our personal information governance policy is available at Québec privacy governance.

We have not appointed a data protection officer, as we are not required to. The contact above handles all privacy matters.

When we act as processor. Where an Organisation submits to the Platform personal data of its own staff or contacts that we process on its behalf, the Organisation is the controller and we are its processor. Our Data Processing Agreement governs that processing; this policy does not.

Account data is necessary to create and operate an account: without it we cannot open one. All other data is optional: if you do not provide it, only what other Users can see about you is limited.

We do not collect payment card data, government identity numbers, or special categories of data within the meaning of Article 9 GDPR. Please do not send them to us.

We do not want export-controlled technical data, except within a service expressly designed for it and governed by specific terms. Such a service, if offered, will be described in an update to this policy before it opens.

Mandatory notices. If we refuse, restrict, suspend or terminate your account, we will tell you and give our reasons even if you have unsubscribed from all e-mails.

We do not verify Designations. They are displayed as declared by each Expert.

We do not rate, score or rank people by merit. The Platform only displays, for each requirement of a Position, whether an Expert's declarations meet it. This is a comparison of declared facts.

No decision producing legal effects concerning you, or similarly significantly affecting you, is based solely on automated processing within the meaning of Article 22 GDPR. Every decision to invite, select, reject or engage is taken by a person.

We do not use your data to train machine-learning models, ours or anyone else’s.

The data kept after closure is accessible to authorised administrators only, except for the Engagement Record, which the other party to the Engagement can still see. It is never exposed through any public view.

Other Users see what the Platform is designed to show them: your public profile and, within an application, invitation or Engagement, what you exchange with the other party. The name of an Organisation is not shown to Experts for a Position until an Engagement is agreed on it, unless the Organisation chooses to display it.

Our authorised administrators may access accounts, exchanges and attachments where strictly necessary to operate and secure the Platform, to process a report or a complaint, to investigate a suspected breach of the Terms, or to comply with a legal obligation. This access is limited to what is necessary. Every administrator action that changes data is logged.

Our processors, each bound by a contract meeting Article 28 GDPR:

When paid services are introduced, a payment service provider will be added to this list before any payment data is collected.

Authorities. We disclose data to a court or a competent authority only where the law requires it.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and there are no advertising trackers on the Platform. We measure audience and performance with Vercel Web Analytics and Speed Insights, which set no cookie and report aggregated figures (section 11).

Your account data and files are stored in France, in Supabase’s Paris region.

Some processors operate from the United States (section 6). Those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework and, failing that, on the standard contractual clauses adopted by the European Commission. A copy of these safeguards can be obtained by writing to privacy@aerocertlink.com.

Users in Québec. Storing your data in France is a communication of personal information outside Québec. We carried out a privacy impact assessment before doing so and concluded that your information receives adequate protection there, in particular under the GDPR.

Whoever and wherever you are, you can ask us to:

• access your personal data (GDPR Art. 15);
• correct anything inaccurate or incomplete (Art. 16);
• erase your data, within the limits of section 5 (Art. 17);
• restrict its processing (Art. 18);
• receive a copy in a structured, commonly used and machine-readable format, or have it sent to another organisation where technically feasible (Art. 20, and Québec law);
• object to processing based on our legitimate interest (Art. 21);
• give instructions on what happens to your data after your death (French Data Protection Act, Art. 85).

How. Write to privacy@aerocertlink.com. We may ask you to confirm your identity. We reply within one (1) month, extendable by two (2) months for complex requests, in which case we tell you within the first month. For Québec residents, we reply within thirty (30) days.

Complaints. You may lodge a complaint with a supervisory authority, in particular:

• France: Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, www.cnil.fr;
• Québec: Commission d’accès à l’information, www.cai.gouv.qc.ca;
• elsewhere in Canada: Office of the Privacy Commissioner of Canada, www.priv.gc.ca;
• or the authority of your country of residence.

Canada. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act and, for Québec residents, the Act respecting the protection of personal information in the private sector. The person in charge named in section 1 answers any request.

United States. Where a US state privacy law applies to our processing, you may exercise the rights it grants you (such as access, correction, deletion and portability) as described in section 8. We do not sell or share personal information within the meaning of those laws, and we do not use it for targeted advertising or profiling producing legal or similarly significant effects. We will not discriminate against you for exercising your rights.

Other countries. Your account data and files are stored in the European Union and protected under the GDPR, whatever your country of residence. Some processors operate from the United States (section 6).

Access to data is controlled at database level by row-level security policies. Data is encrypted in transit and at rest. Passwords are hashed and never stored in clear text; we will never ask you for yours. Every administrator action that changes data is logged.

No system is perfect. Where a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority within seventy-two (72) hours of becoming aware of it, and we inform you directly where the risk is high (GDPR Art. 33 and 34). For Québec residents, we notify the Commission d’accès à l’information and the persons concerned where an incident presents a risk of serious injury. We keep a register of all incidents.

We use strictly necessary cookies only: they keep you signed in and protect your session. Under Article 82 of the French Data Protection Act, they do not require your consent.

We use no advertising cookie and no analytics cookie. Vercel Web Analytics and Speed Insights (section 6) measure audience and performance without setting any cookie; we consider that they do not require your consent. If that changes, we will ask for your consent before setting any cookie, and we will update this policy first.

We also keep a few settings in your browser's local storage and session storage. They stay on your device and are not used to track you.

The Platform is a business-to-business service reserved for people aged 18 or over. We do not knowingly collect data about minors. If you believe we hold such data, write to privacy@aerocertlink.com and we will delete it.

We may update this policy. Where a change materially affects how we process your data, we notify you on a durable medium at least thirty (30) days before it takes effect. Each version and its date are kept and available on request.