Privacy policy
Version 2026-09-30.2
Privacy Policy — OTCValue Version 2026-09-30.2 — 30 September 2026 1. Who processes your data? THELOS SAS, 10 rue de Penthièvre, 75008 Paris, France, 789 713 310 RCS Paris, is controller for the processing it determines to manage OTCValue, including accounts, customer relationships, billing and service security. Data protection contact: THELOS SAS, contact@otcvalue.com. Please use 'Personal data' in the subject if possible. Where your organisation uses OTCValue to process personal data for its own purposes, it may be the controller and THELOS its processor. These operations are governed by the DPA (https://otcvalue.com/Legal/7). You may then exercise rights concerning those data with your organisation; THELOS assists it and forwards requests falling under its instructions. 2. Data concerned and sources Depending on the functions used, data may include: - identity, email address, profile information, language and display preferences; - organisation membership, invitations, roles and access rights; - technical authentication data, login events, security and diagnostic records; - customer and payer-contact details, billing address, tax identifiers, subscriptions, invoices and payment references; - support messages, material needed to resolve a request and handling history; - data entered in portfolios, positions or free-text fields where they identify a person; - declaration of professional use, its text, version, language and date; contractual acceptance references and dates, termination requests and complaints; - historical evidence retained where necessary for an earlier contract or legal obligation, without new collection of consumer residence in the B2B flow. Data come from you, an authorised member of your organisation, the payment provider or operation of the service. When a third party invites you or names you as billing contact, appropriate information must be provided to you. Not all corporate financial data are personal data. Confidential corporate data remain covered by contractual confidentiality commitments. If data come from an organisation member, inviter or billing contact, THELOS informs you no later than its first contact, the first disclosure to another recipient or the applicable statutory deadline, whichever occurs first. You may ask for the source and data concerned. The customer organisation remains responsible for information concerning processing it determines. The service is not intended to receive health data, political opinions, biometric data or other special categories without necessity and a specific framework. Do not send passwords or full card numbers to support. 3. Purposes and legal bases Managing professional eligibility and evidence of declarations and acceptances: Contract performance where the person is a party; legitimate interests in managing professional access and establishing and defending contractual rights, depending on the circumstances. Creating an account, providing the subscription and responding to precontractual requests: Contract performance where the person is a contracting party; legitimate interests in providing the service to the organisation for its representatives and users. Managing invitations, roles and preferences necessary for the service: Contract performance or legitimate interests in administering access; customer instructions for processing on its behalf. Billing, tracking payments and keeping required supporting records: Contract performance and statutory accounting and tax obligations, depending on the operation. Preventing abuse, protecting accounts and diagnosing incidents: Legitimate interests in securing the service, with data and access minimisation; applicable legal obligations. Handling support and complaints: Contract performance or legitimate interests in handling requests; legal obligations for certain remedies. Retaining necessary evidence and managing disputes: Legal obligations where they exist; legitimate interests in establishing or defending rights. Placing non-essential trackers, if added: Prior consent where required. Mandatory data are necessary for the operations indicated in the form; their absence may prevent account creation, service provision or invoicing. Optional fields are identified. This policy does not authorise marketing. Any intended marketing must be described separately with its legal basis and an opt-out mechanism. 4. Who may receive data? Data are accessible to authorised THELOS personnel for their duties, members of your organisation within their permissions and providers necessary for the service. They may also be disclosed to authorities, advisers or accounting professionals where a legal obligation or identified legitimate need justifies it. The main identified technical recipients are: Microsoft Ireland Operations Limited — Azure: Website and database hosting, processing and backup of entrusted data. OVH SAS — OVHcloud: Email hosting and routing, including support correspondence. Stripe: Payments and subscriptions; acts as processor for some operations and independently as controller, notably for fraud prevention and regulatory obligations. See Stripe's information (https://stripe.com/fr/legal/privacy-center). Volentio JSD Limited — jsDelivr: Distribution of website libraries; receives technical connection data when they load, under its privacy policy (https://www.jsdelivr.com/terms/privacy-policy). 5. Locations and transfers The website, primary database and its backups are hosted in France. Email is hosted by OVHcloud, whose service used by THELOS provides for storage in France. These locations do not mean that all support access, email routing and payment processing remain in France. Stripe's DPA (https://stripe.com/fr/legal/dpa) includes transfers to Stripe, LLC in the United States; its data transfer agreement (https://stripe.com/fr/legal/dta) specifies applicable mechanisms. OVHcloud's subprocessor list includes possible operations from Canada and the United Kingdom. jsDelivr also uses an international network. These flows must be distinguished from primary storage. Transfers of personal data outside the European Economic Area must be identified and covered by the applicable mechanism: an adequacy decision valid for the recipient, standard contractual clauses accompanied by the necessary assessments, or another relevant lawful basis. Write to contact@otcvalue.com for transfer details and a copy of applicable safeguards, subject to redactions necessary to protect secrets and third-party rights. 6. Retention periods Periods are defined by purpose, distinguishing active use, restricted archives and backups. Termination justifies neither general indefinite retention nor erasure of records that must legally be kept. Account, profile and access: During active use; for a free account inactive for three years, manual review and at least thirty days' warning before possible closure. The rights of an organisation still active are checked separately. Erasure requests are handled within statutory deadlines, subject to justified exceptions. Portfolios, positions and business histories: During service provision to the organisation, including Free, under its authorised instructions. After closure or an erasure instruction: requested return, then erasure of data no longer needed, subject to retrieval rights and legally necessary retention. One member's inactivity alone does not authorise erasure of the organisation. Invoices and accounting records: Applicable statutory period, generally ten years from the end of the relevant financial year for accounting records. Contracts and evidence useful to their performance: Restricted archiving for five years after the relevant relationship ends, subject to another limitation-period starting point, interruption or suspension, a special obligation or an identified dispute. This does not justify keeping the entire account or every message solely as evidence. Routine support: Handling of the request, then two years after closure; only documents necessary for litigation or contractual evidence are isolated for the corresponding justified period. Security and technical diagnostic logs: A rolling six months; items needed for an identified incident or dispute are extracted and kept with restricted access for the time needed to handle it. This rule does not cover business histories necessary for the service. Technical authentication email queue: The code provides for purging more than thirty days after creation, except messages still being processed; content no longer needed is erased according to the sending/expiry cycle. Acceptance evidence retained with the account is separate from this queue. Other emails and sending evidence: For their purpose's duration: support, contractual evidence or accounting, depending on content. Unneeded transport duplicates are deleted; invoices do not justify indiscriminate archiving of all mailboxes. Email backups: The provider states a fourteen-day retention period. This period differs from retention of messages in the mailbox and is not a guarantee of physical erasure within fourteen days. Database backups: Seven-day restore window. Files needed for a complete restore chain may be retained for up to one additional week, then deleted by the provider when no longer necessary. The seven-day window enables database restoration; it is not a promise of physical erasure of every copy within seven days of a request. Residual backups are reserved for continuity and restoration, protected and excluded from ordinary use. If restoration reintroduces data whose erasure has been handled, deletions must be reapplied before ordinary use resumes. A dispute, investigation or specific obligation justifies additional retention only for necessary data and the corresponding period, with restricted access. Afterwards, data are deleted or effectively anonymised. Manual closure procedures do not exempt THELOS from applying this schedule. 7. Your rights Under the GDPR's conditions, you may request access, rectification, erasure, restriction and portability of eligible data, and object to processing based on legitimate interests. Withdrawing consent does not affect the lawfulness of earlier operations. Applicable French rules on instructions concerning data after death remain reserved. Send your request to contact@otcvalue.com, allowing identification of the account and request. Proportionate identity verification may be necessary; a copy of identity documents should not be requested systematically. THELOS responds within statutory deadlines, normally one month; legally permitted extensions are explained. Account closure and erasure requests are handled manually by THELOS. The personal-data page explains how to write to contact@otcvalue.com; it does not trigger automatic deletion. Specify whether you request account closure, erasure of certain data or both. Subscription cancellation remains a separate action available through subscription management; return to the free plan does not delete data. Closing individual access may require distinguishing organisation-customer data from legally retained supporting records. These distinctions do not permit wholesale rejection of erasure rights. You may complain to the CNIL (https://www.cnil.fr/fr/plaintes) or the competent supervisory authority. 8. Security, automated decisions and updates THELOS must implement measures appropriate to risk: access controls, protection of communications, incident handling and provider oversight. The primary database and its automatic backups are encrypted at rest. This policy announces no particular certification, freedom from vulnerabilities or quantified restore guarantee. Identified automated processing includes valuation calculations and management of entitlements linked to plans and payments. You may contact THELOS for review of a situation affecting your access and to challenge the information used, without reduction of applicable legal rights. Changes to this policy are dated and accessible. A new purpose or an operation requiring new consent is handled under applicable rules; publishing a new version alone does not establish consent.