GDPR & Data protection

Privacy policy

This English translation is provided for convenience only. In case of discrepancy, the French version prevails.

Last updated: September 2026

1. Data controller

2. Data collected and purposes

2.1 Contact requests and forms

When you book an appointment via Cal.com or contact us by email or phone, we collect:

• First and last name,to personalize our exchanges
• Email address,to send you the appointment confirmation and communications related to your project
• Phone number (optional), to contact you directly
• Information about your business,to prepare the audit and recommendations

Legal basis: your consent (article 6.1.a of the GDPR (General Data Protection Regulation)) for audience measurement. No measurement cookie is placed until you have accepted it; declining has no impact on access to the site. The server's technical logs, necessary for security and proper operation, are based on legitimate interest.

We use Google Analytics 4 (Google Ireland Limited) to measure site traffic. The tool is configured in consent mode: until you have accepted, no cookie is written and no identifying data is transmitted. IP addresses are anonymized and data retention is limited to 14 months.

2.2 Browsing data

This site may automatically collect certain technical data during your visit:

• IP address (anonymized as far as possible)
• Browser type and operating system
• Pages visited and time spent
• Referral source

Legal basis: legitimate interest (improving the site), no advertising tracking cookie without explicit consent.

2.3 Client data (services)

As part of our automation and AI assignments, we may process data from your systems (CRM, emails, etc.). This processing is governed by a DPA (Data Processing Agreement) signed with each client.

3. Retention period

4. Data recipients

Your data is never sold. It may be shared with:

• Cal.com,appointment scheduling (privacy policy available at cal.com)
• Technical service providers,hosting, messaging tools (subject to DPAs)
• Legal authorities,only upon judicial request

Every subcontractor is selected for its data protection guarantees, in accordance with article 28 of the GDPR.

Google Ireland Limited (Google Analytics 4): audience measurement, only after your consent. Vercel Inc.: site hosting and technical logs. These providers act as data processors within the meaning of article 28 of the GDPR.

5. Transfers outside the EU

Some tools used (Cal.com, Google Analytics, Vercel) may transfer data to the United States. These transfers rely on the EU-US Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses. For Google Analytics, no transfer takes place until you have consented.

6. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access,obtain a copy of your personal data
• Right to rectification,correct inaccurate data
• Right to erasure,request the deletion of your data ("right to be forgotten")
• Right to restriction,temporarily restrict processing
• Right to portability,receive your data in a structured format
• Right to object,object to processing based on legitimate interest

To exercise these rights, contact us at contact@benit.fr specifying your request. Response within 30 days.

You also have the right to lodge a complaint with the CNIL (French data protection authority).

7. Security

BenIT implements appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure, alteration or destruction, in accordance with article 32 of the GDPR.

8. Cookies

This site places two categories of trackers:

• Necessary: remembers your consent choice, stored in your browser (localStorage) and not shared with third parties. Exempt from consent.
• Audience measurement: Google Analytics 4 cookies (_ga, _ga_*), 13-month lifespan. Placed only after your agreement.

No advertising or cross-site tracking cookies are used. You can change or withdraw your choice at any time: your browser settings. Withdrawal is as simple as acceptance and takes effect immediately.

9. Google user data (BenAI service)

BenIT publishes BenAI, an AI assistant offered by subscription to businesses at ai.benit.fr. A BenAI user may, if they choose, connect their Google account to the assistant. Nothing is accessible without their explicit authorisation: each Google service is connected separately, from Settings → Tools, through Google's consent screen, which lists the access requested. A Google Workspace organisation may also authorise BenAI through a service account that it creates and manages itself. The full description of the BenAI service (roles, sub-processors, retention, security) is in section 9 of the French version, which prevails.

9.1 Data accessed, and why

BenAI accesses Google data only when a user's request (or a task the user scheduled) requires it. BenAI does not copy the user's mailbox, Drive or calendar to its servers.

9.2 Use, retention and transfer

• Google data is used only to provide and improve user-facing features of BenAI requested by the user: answering their question, drafting or sending what they asked for.
• What the assistant read for a request is kept in the user's conversation history and may feed their account's memory; it remains visible to the user and can be deleted by them. Data is hosted in France (Hostinger, Paris).
• To formulate the answer, the necessary excerpts are sent to the provider of the AI model that processes the request, with email addresses, phone numbers and bank details masked by default. They are not transferred to any other third party, except where required by law.
• Google data is never sold, and never used for advertising, to build advertising profiles, or to determine creditworthiness or for lending purposes.
• Google data is not used to train, develop or improve generalised artificial intelligence or machine learning models, neither by BenIT nor, with its authorisation, by any third party.
• No BenIT staff member reads a user's Google data, except at their request, during a support session opened to handle that request (logged in their account and shown on screen for its whole duration), where necessary for security purposes (investigating abuse), to comply with the law, or in aggregated and anonymised form for the operation of the service.
• Google access tokens are encrypted with a key specific to the user's account and are never displayed.

9.3 Revoking access

• In BenAI: Settings → Tools, the Google service tile, then Remove. The service stops being used immediately; when the last Google service is removed, the access token is deleted from our servers.
• At Google, at any time: myaccount.google.com/permissions, which revokes the authorisation granted to BenAI.
• To have Google data already present in conversations or memory deleted: delete it from the application, or write to contact@benit.fr.

10. Changes

This policy may be updated at any time. The version in effect is the one displayed on this page, with the date of the last update.