This policy describes the processing of personal data carried out by ALL4FEED (“we”) in connection with the FeedSourcing platform, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978 as amended. It applies to visitors, account holders, persons mentioned in the directory and contacts of listed companies. In case of discrepancy, the French version prevails.
FeedSourcing is a professional (B2B) service: the data processed concern persons acting in the course of their professional activity.
1.Controller and contact
Controller: ALL4FEED, [TO COMPLETE: legal form, registered office, SIREN].
Data Protection Officer / GDPR contact: [TO COMPLETE: name or position, dedicated e-mail]. Any question or request to exercise your rights may be sent by e-mail, via the contact form (topic “Personal data”) or by post to the registered office.
MOBYCLIC (Alistair Marca), which develops and technically operates the Platform, acts as a processor (Article 28 GDPR) under a data processing agreement setting out its obligations (confidentiality, security, assistance, deletion of data at the end of the contract, supervised sub-processing). [TO COMPLETE: date and reference of the agreement.]
2.What data, for which purposes, on which legal basis
| Processing | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Account creation and management | Identity (first and last name), professional e-mail, phone (optional), job title, language, password (hashed), declared profile and intended uses, membership of one or more companies | Performance of the contract (Terms of Use) — Art. 6(1)(b) |
| Authentication | One-time codes sent by e-mail, magic links, session tokens, password reset | Performance of the contract; legitimate interest (security) — Art. 6(1)(b) and (f) |
| Company directory | Company name, SIREN/SIRET, address, generic professional contact details, activities, species, certifications, entries on official lists, geographic position; directors where the public source publishes them | Legitimate interest (professional networking, market information) — Art. 6(1)(f); data from public sources and licences |
| Claiming a company record | Kbis extract or equivalent (containing the identity of directors), declared SIRET, contact e-mail and phone, result of the automated reading (SIREN found, directors found, e-mail domain consistency) | Performance of the contract; legitimate interest (anti-impersonation) — Art. 6(1)(b) and (f) |
| Catalogue, documents and business relations | Products offered, uploaded documents (technical sheets, attestations, certificates), document requests, introductions, messages between companies | Performance of the contract — Art. 6(1)(b) |
| Subscriptions and payment | Plan, invoicing history, Stripe customer ID; card data are processed by Stripe and never transmitted to us | Performance of the contract; legal obligation (accounting) — Art. 6(1)(b) and (c) |
| Alerts, monitoring, notifications, newsletter | E-mail, alert preferences (ingredients, species, areas, frequency); opens/clicks are not tracked | Performance of the contract for requested alerts; consent for the newsletter (unsubscribe at any time) — Art. 6(1)(a) and (b) |
| Contact forms and reports | Name, e-mail, phone (optional), company, message | Legitimate interest (answering requests) — Art. 6(1)(f) |
| Platform security | IP address, request timestamps, rate counters, temporary bans, anti-bot fields, log of revealed contact details (who viewed which details, when) | Legitimate interest (security, prevention of data scraping) — Art. 6(1)(f) |
| Usage measurement (pilot programme) | For accounts enrolled as pilot users only: pages viewed, searches, answers to the expectations and feedback questionnaires, acceptance of the letter of commitment | Consent (voluntary participation) — Art. 6(1)(a) |
| AI assistance | Content of imported PDF catalogues and Kbis extracts (reading), texts to summarise or translate | Performance of the contract (requested import); legitimate interest (content quality) — Art. 6(1)(b) and (f) |
No special-category data (Art. 9 GDPR) are collected. No decision producing legal effects is taken solely by automated means: the automated reading of a Kbis does not grant the “Verified by ALL4FEED” badge, which is subject to human review.
3.Directory data: origin and rights of data subjects
The directory lists companies, not individuals. It is built from public sources (Sirene register, DGAL and DGCCRF official lists, Agence Bio, OQUALIM, FAMI-QS), licensed data (MovUP) and declarations by the companies themselves. It may contain personal data where the company is a sole trader (the trader’s name is then the company name) or where a public source mentions a director.
These data are processed on the basis of our legitimate interest in informing professionals of the sector and facilitating their business relations (Art. 6(1)(f) GDPR; Art. 14 for information of data subjects). Data subjects are informed through this policy and through the source shown on each record.
Any data subject may object at any time, on grounds relating to their particular situation, to the presence of their data in the directory (Art. 21 GDPR): the “Removal request” page, available from each record, allows a correction or removal to be requested. An accepted request is recorded in an opposition list that prevents the record from reappearing during automatic updates.
A company’s e-mail and phone do not appear in the public content of pages: they are only communicated to a signed-in user, at their request, and each disclosure is logged and capped.
4.Recipients
Data are accessible, within the limits of their duties, to: authorised ALL4FEED staff; MOBYCLIC (technical processor); the providers listed in section 5 for the sole operations entrusted to them; other users of the Platform for the information you choose to publish (company record, catalogue, public documents, messages sent).
Data may be disclosed to competent authorities where required by law. We do not sell or rent personal data.
5.Hosting, providers and transfers outside the European Union
We favour data locations within the European Union: the application runs in our host’s Europe-West region (Netherlands), the database is in Ireland and files are stored with an EU storage location. E-mails and AI processing involve providers established in the United States.
Point of attention: US-law providers and the CLOUD Act
Several providers (Railway, Cloudflare, Resend, Anthropic, Esri) are US companies. Even where servers are located in the European Union, these companies are subject to the CLOUD Act (18 U.S.C. § 2713), which may compel them to disclose data to US authorities in criminal proceedings, and to FISA 702 for data in transit. We draw the following consequences:
- Framed transfers: each US provider is either certified under the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) or bound by the Commission’s standard contractual clauses (Decision 2021/914) supplemented by a transfer impact assessment. [TO COMPLETE: measure selected for each provider.]
- Minimisation: providers only receive what their task requires — Resend receives the address and content of an e-mail, Anthropic the text of a document to read, never the database as a whole.
- Encryption: data are encrypted in transit (TLS) and at rest with the database and storage hosts; passwords are hashed; Kbis extracts are stored in a private, non-public space.
- Reversibility: the application is containerised and the database exportable; a migration to an EU-established, EU-law host (e.g. Scaleway or OVHcloud) is technically planned and may be decided if the risk analysis so justifies. [TO COMPLETE: ALL4FEED decision after the audit.]
The United Kingdom (SurrealDB Ltd; Nominatim) benefits from a European Commission adequacy decision (28 June 2021). The database instance itself is located in Ireland.
List of sub-processors
| Provider | Processing | Data location | Transfer safeguard |
|---|---|---|---|
| Railway Corporation (USA) | Application hosting | European Union (Netherlands) | [TO COMPLETE: SCCs] |
| SurrealDB Ltd (UK) | Database hosting | European Union (Ireland, AWS) | UK adequacy decision |
| Cloudflare, Inc. (USA) | File storage (R2), anti-bot protection (Turnstile) | European Union (R2); global network (protection) | [TO COMPLETE: DPF / SCCs] |
| Resend, Inc. (USA) | E-mail sending | USA | [TO COMPLETE: SCCs] |
| Stripe Payments Europe, Ltd (Ireland) | Payment, invoicing | European Union | N/A |
| Anthropic, PBC (USA) | Assisted reading of documents, writing and translation | USA; data not used to train models (commercial terms) | [TO COMPLETE: DPF / SCCs] |
| Mistral AI (France) | OCR of Kbis extracts | European Union | N/A |
| Esri (USA) | Base maps (tile requests: IP address) | USA | [TO COMPLETE] |
| OpenStreetMap Foundation (UK) | Geocoding of company addresses (no visitor data) | UK | Adequacy decision |
This list is kept up to date; any substantial change is announced to account holders by e-mail or by a message in the professional area.
6.Retention periods
| Data | Period |
|---|---|
| Account and profile | Lifetime of the account, then 3 years after the last sign-in; deletion on request |
| Session tokens, one-time codes, magic links | Session: 30 days of inactivity; codes and links: 10 minutes to 1 hour, then purged |
| Kbis extract uploaded for a claim | Duration of the accepted claim, then [TO COMPLETE: 12 months]; a refused document is not kept |
| Documents uploaded by companies | As long as the company keeps them online, then 1 year in archive |
| Contact messages, reports, removal requests | 3 years from closure of the request; the opposition list is kept without limitation to guarantee its effect |
| Invoicing | 10 years (Art. L. 123-22 French Commercial Code) |
| Security log (IP addresses, rate limiting) | In-memory counters: 1 minute to 24 hours; bans: until expiry (24 h by default), at most 1 year |
| Log of revealed contact details and usage measurement | 90 days, then automatic deletion |
| E-mail sending log | 12 months |
| Newsletter | Until unsubscription, then 3 years on a suppression list |
| Pilot programme questionnaire answers | Duration of the programme, then 3 years in aggregated form in the report |
7.Your rights
You have the rights of access, rectification, erasure, restriction, portability (for data you provided) and objection, as well as the right to set directives on the fate of your data after death. You may withdraw consent at any time (newsletter, pilot programme) without affecting the lawfulness of prior processing.
From your account: “My account” lets you edit your information, change your password, manage your alerts and the newsletter, and delete your account. Claimed companies may correct their record and choose whether their e-mail and phone are disclosed.
By request: to the DPO / GDPR contact (section 1). We reply within one month, extendable by two months for complex requests. Proof of identity may be requested in case of reasonable doubt.
Complaint: you may lodge a complaint with the French supervisory authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
9.Security
- Encryption in transit (HTTPS/TLS) across the Platform; encryption at rest with the database and file hosts.
- Passwords hashed with a cost-based algorithm (never stored in clear); passwordless sign-in available by one-time code or magic link; codes limited in time and attempts.
- Segregation of rights: public area, professional area (company membership verified by Kbis), back-office restricted to authorised staff.
- Protection against data scraping: per-address rate limiting, temporary banning of abusive addresses, contact details revealed on click and capped, bounded pagination, no indexing of private areas.
- Form protection against bots (honeypot field, minimum delay, rate limiting, Turnstile).
- Kbis extracts stored in a private space with no public address.
- Regular database backups by the host; logging of administration access.
- Notification to the CNIL within 72 hours and information of data subjects in the event of a data breach presenting a risk (Arts. 33 and 34 GDPR).
10.Minors
The Platform is intended exclusively for professionals. It is not aimed at persons under 18 and we do not knowingly collect data about them.
11.Changes
This policy may be amended to reflect changes to the Platform, its providers or regulations. The date of the last revision appears at the top of the document; in the event of a substantial change, account holders are informed by e-mail or by a message in the professional area.