Full transparency.

1. Who we are

Liwa is a service published and operated in France by StarterLab. Full legal information about the publisher is available in our legal notice.

Contact for any question about personal data: dpo@starterlab.fr

The service is designed, administered and supported from France. For any question about your data, you deal with a single point of contact, based in France, who knows the service from the inside.

2. Our regulatory framework

Liwa processes personal data in accordance with:

• the General Data Protection Regulation (Regulation (EU) 2016/679, known as the "GDPR");
• French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended;
• the recommendations and guidelines published by the French data protection authority (CNIL).

3. Two distinct roles, depending on the data

The GDPR distinguishes between the party that decides how data is used (the data controller) and the party that processes it on the controller's behalf (the data processor). Liwa acts as one or the other depending on the data concerned.

Liwa acts as data controller for the data of its own customers and visitors: user accounts of administrators and operators, billing, support, and browsing on the liwa.fr website.

Liwa acts as data processor for the data that its customers (groups, associations, training organisations, clubs) record in the application to manage their sessions: members, participants, guests and signatures. In this case, the customer organisation is the data controller. Liwa only uses this data to provide the service, following the customer's instructions, and never for any other purpose. These commitments are set out in the data processing agreement appended to our terms and conditions, in accordance with Article 28 of the GDPR.

If you are a member, participant or guest of an organisation that uses Liwa, you may contact that organisation directly to exercise your rights. You may also write to us: we will forward your request and help the organisation respond to it.

4. The data we process

• User accounts (administrators and operators) : first name, last name, email address, login identifier, password (stored in an irreversibly encrypted form, never in plain text), two-factor authentication settings, role and group(s). When signing in via Google or Microsoft, we only receive the identifier, name and email address needed to create the account.
• Customer organisation data : organisation name, session schedule, configuration preferences.
• Members and participants : first name, last name and, depending on what the organisation chooses to record, email address, phone number, company or occupation.
• Guests : first name, last name and, where applicable, email address, phone number, company, occupation, inviting person and visit date.
• Signatures and attendance : the image of the signature drawn on screen, attendance status, date and time of signature, and, where applicable, the name of a substitute. When a signature is added after a session has ended, the identity of the person who recorded it, as well as the date and time, are kept in order to guarantee the reliability of the attendance sheet.
• Billing : information required for the subscription and invoicing. Card payment data is entered and processed directly by our payment provider: Liwa never has access to it and never stores it.
• Technical data : IP address, browser type, connection and error logs, necessary for the service to function properly and securely.
• Audience measurement and cookies : only with your consent, given through the consent banner (see section 10).

Liwa does not collect any "special category" data within the meaning of Article 9 of the GDPR and never asks for such information.

5. Why we use this data

Liwa does not sell, rent or exchange any personal data. No data is used for advertising purposes without your consent.

6. Who has access to the data

Within each customer organisation, only that organisation's authorised users can access its data. Each organisation's data is strictly segregated: one organisation can never view another organisation's data.

At Liwa, only authorised staff can access the data, and only when necessary to operate the service, provide support, or ensure security.

Our technical providers operate solely to run the service, on our instructions, and are bound by contractual confidentiality and security commitments:

The current list of our sub-processors is provided to our customers on request, and any change is notified to them in accordance with the data processing agreement.

7. Hosting and transfer framework

Liwa relies on recognised hosting and service providers, selected for their level of security and their contractual commitments regarding data protection.

Some of these providers may process data outside the European Union. Whenever this is the case, the transfer is systematically governed by one of the safeguards provided for under the GDPR:

• an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for certified providers;
• or the standard contractual clauses adopted by the European Commission, included in the contracts entered into with these providers.

These safeguards require our providers to apply a level of data protection equivalent to that required in Europe. A copy of the applicable safeguards can be obtained on request at the address given in section 1.

8. Retention periods

We only keep data for as long as necessary for the purpose for which it was collected.

At the end of the subscription, the customer organisation can retrieve its data before it is deleted.

9. Data security

Liwa implements appropriate technical and organisational measures, in accordance with Article 32 of the GDPR, including:

• encryption of all communications (HTTPS);
• storage of passwords in an irreversibly encrypted form;
• two-factor authentication, mandatory for platform administration accounts and available to all users;
• strict segregation of data between customer organisations, checked on every request;
• access rights assigned according to each user's role;
• a database closed to any public access, reachable only through the application;
• single-use signature links, valid only during the relevant session;
• traceability of signatures recorded after a session has ended;
• automatic deletion of data that no longer needs to be kept.

In the event of a data breach likely to create a risk to your rights and freedoms, Liwa notifies the CNIL within 72 hours, promptly informs the customer organisations concerned and, where required by law, the individuals concerned.

10. Cookies

The liwa.fr website and the application use cookies that are strictly necessary for them to function (session, security, remembering your choices), which do not require consent.

Audience measurement cookies are only placed with your consent, collected through the consent banner. You can withdraw this consent at any time, as easily as you gave it. Details are available on our Cookies page.

11. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:

• right of access, to know what data concerning you is being processed;
• right of rectification, to correct inaccurate data;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object, in particular to processing based on legitimate interest;
• right to withdraw your consent at any time, when processing is based on it;
• right to define instructions regarding your data after your death.

To exercise these rights, write to us at dpo@starterlab.fr. We will respond within one month at the latest, in accordance with the GDPR. Proof of identity may be requested if there is reasonable doubt about your identity.

If you are a member, participant or guest of a customer organisation, your request may also be sent directly to that organisation (see section 3).

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at www.cnil.fr.

12. Changes to this policy

This policy may be updated to reflect changes in the service or in the applicable regulations. The date of the last update appears at the top of this page. In the event of a significant change, our customers are notified by email or within the application.