Privacy Policy

1. Who we are

PolicyMate SAS is responsible for the personal data described in this policy (we are its "controller"). We are a société par actions simplifiée registered in France, with our registered office at 165 avenue de Bretagne (EuraTechnologies), 59000 Lille, France. For any question about this policy or your data, write to [email protected].

2. Who this policy covers

This policy covers:

• customers and users of the PolicyMate platform;
• visitors to our website, policymate.io;
• people we contact, or who contact us, about our services;
• job applicants; and
• people who appear in the public records and recordings of public proceedings that we collect (section 4).

This policy does not cover:

• Content customers upload. When a customer uploads its own documents to the platform, we process them on the customer's behalf, as its processor. The customer decides how that content is used, and our Data Processing Agreement governs it. If your data is in content a customer uploaded, please contact that customer.
• Cookies. Our use of cookies is described in our Cookie Policy.

3. Customers, users and other contacts

3.1 What we collect

• Identity and contact details: name, work email address, phone number, employer and job title.
• Account data: login details and settings. If you sign in with Google or Microsoft, we receive your name and email address from that service. We never receive your password for it.
• Usage data: how you use the platform, such as pages viewed, features used, searches, the entities you follow and the alerts you set up, plus technical data such as IP address, browser, operating system and connection times.
• Communications: emails and messages with us, and recordings and transcripts of sales and support calls.
• Billing data: billing contact, company details and invoicing history.
• Marketing data: your communication preferences and whether you open our emails.
• Job applications: your CV and the information you send us when you apply.

We collect this data from you, from your organisation when it sets up your account, from sign-in services you choose to use, and, for business prospects, from company websites and business data providers. When we ask for information, we tell you which fields are required; without them we cannot open your account or answer your request.

3.2 Why we use it, and our legal basis

4. People who do not deal with us directly

Our platform collects public documents, such as government and parliamentary records, official registers, regulator publications, court decisions, procurement notices, press releases, published media and public social media posts, along with recordings of public hearings. These sources contain data about people, so we hold information about people who have not dealt with us directly. Because it is not feasible to contact them individually, we explain it here.

What we collect:

• names and other information that appear in public documents, hearings, and meetings, including faces and voices in video and audio content;
• for people in public roles, biographical details, roles, affiliations, education, photographs and professional contact details, taken from public sources such as official biographies, Wikipedia and Wikidata;
• public statements and activity, including positions stated on public issues.

We collect information about public activity only, never about anyone's private life.

Why, and our legal basis. We use this information to give our customers journalistic information regarding, and an accurate picture of, the work of public institutions and the people involved in it. We rely on our legitimate interest and that of our customers (Article 6(1)(f) GDPR), as well as Articles 9(2)(e) and 9(2)(g) GDPR read with Article 85 GDPR and Article 80 of the French Data Protection Act, which protect processing for journalistic purposes.

Accuracy and your choices. If anything we hold about you is inaccurate, write to [email protected] and we will correct it. You can also ask for a copy of it or object to our use of it (sections 9 and 10).

5. How long we keep data

We keep personal data only as long as we need it for the purpose we collected it for. After that, we delete it or anonymise it. Anonymised data no longer identifies anyone, so we may keep it to analyse and improve our services.

6. Who receives personal data

• Our staff, with access limited by role.
• Our service providers, who process data on our instructions under contract: hosting and database, network security, AI analysis and text generation, document recognition, transcription, speaker identification and voice processing, customer relationship management, email and system logging. Our current list, with each provider's location, is at policymate.io/legal/subprocessors.
• Our customers, who can see the profiles and public-record information described in section 4.
• Authorities, such as courts, police or regulators, when the law requires it.
• A buyer or investor, under confidentiality obligations, if PolicyMate is sold, merged or restructured.

We do not sell personal data. We do not use personal data to train AI models, and our contracts with AI providers prohibit them from training on it.

7. Transfers outside Europe

We store data in the European Union. A few providers are based in, or may access data from, outside the European Union. Where data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified under it, or on the Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards at [email protected].

8. Security

We encrypt data in transit and at rest, require two-factor authentication to access our platform, and limit staff access by role. You can read more at policymate.io/security.

9. Your rights

You have the right to:

• access your personal data and get a copy;
• correct data that is inaccurate or incomplete;
• delete your data in the cases the GDPR provides;
• restrict our use of your data in the cases the GDPR provides;
• receive the data you gave us in a portable format, where we process it under a contract or your consent;
• withdraw your consent at any time, where we rely on it, without affecting what we did before;
• give instructions about what happens to your data after your death, as French law allows;
• object to our use of your data (section 10); and
• complain to a data protection authority (section 11).

To exercise any right, write to [email protected]. We reply within one month. For complex requests we may extend this by two months, and if we do we will tell you why. If we have reasonable doubts about who you are, we may ask for proof of identity, which we delete once checked.

Automated decisions. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects on them.

10. Your right to object

You can object at any time to our use of your personal data where we rely on our legitimate interests.

To object, write to [email protected] and tell us which data your objection concerns and, except for marketing, why.

• Direct marketing: if you object, we stop. There are no exceptions.
• Everything else: we stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. We will tell you our decision and our reasons within one month.
• Profiles from public records: if we accept your objection, we delete your profile and prevent a new one from being created. The public documents themselves stay in our archive as records of government activity, and your name remains wherever the original document names you.

11. Contact and complaints

Write to us at [email protected] or at PolicyMate SAS, 165 avenue de Bretagne (EuraTechnologies), 59000 Lille, France. If you are not satisfied with our answer, you can complain to the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or to the data protection authority in the country where you live or work.

12. Children

Our website, platform and services are not intended for anyone under 16, and we do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy to reflect changes in the law or in our services. We will publish the new version here with its effective date, and will notify customers by email of any significant change.