PERSONAL INFORMATION PROTECTION POLICY
BlueKanGo recognises the importance of protecting privacy and individual rights and is committed to doing so in compliance with applicable law, in particular Regulation (EU) No 2016/679 of 27 April 2016 (the GDPR) and French Law No 78-17 of 6 January 1978 as amended, known as the French Data Protection Act (hereinafter the “Regulation”).
(For our Canadian users: the principles set out in this Policy are applied in a manner substantially equivalent to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector (Law 25).)
This privacy policy (hereinafter the “Policy”) aims to inform you of the principles that govern how we process your personal information in our capacity as data controller within the meaning of the Regulation and of the rights you have over your personal information.
Who is the controller of my personal information?
The controller is BlueKanGo, a simplified joint-stock company registered with the Rennes Trade and Companies Register under number 420 710 097, with its registered office at 90 rue Robert Keller, Cesson-Sévigné (35510), France (hereinafter the “Company” or “we”).
BlueKanGo has appointed a data protection officer. For any questions regarding the processing of your personal information, you may contact the officer:
- By post, to the address:
BlueKanGo
Attention: DPO
90 rue Robert Keller
35510 Cesson-Sévigné
France
- By email at: rgpd@bluekango.com
What personal information is collected, for what purposes, and for how long?
In accordance with the principle of data minimisation, we endeavour to collect and use only the personal information that is relevant and strictly necessary for our processing purposes.
Depending on your relationship with us, BlueKanGo collects and processes personal information. In any event, BlueKanGo does not collect personal information from minors.
Website visitors
For visitors to our websites www.bluekango.com and its language variants, our blog https://www.blog-qhse.com/, and the pages we manage on social media, we may process the following categories of personal information:
- Identification information: last name, first name, username, photograph;
- Professional information: position, company;
- Connection information: country of the IP address, visitor identifiers, connection logs, pages visited, country of connection, browser, language choice, full navigation path (source and destination).
This personal information is processed only lawfully for the purposes set out below and for a period not exceeding that necessary for the purposes for which it is processed and retained:
Purpose: Management of the website and blog, management of web traffic, tracking of visitor sources and interactions.
- Legal basis: Legitimate interests of BlueKanGo.
- Retention: 13 months maximum (except where required by law), up to 25 months for cookies.
Purpose: Management of social media pages, measuring the impact of the Company’s offerings.
- Legal basis: Legitimate interests of BlueKanGo.
- Retention: 6 months.
Job applicants
As part of our recruitment process, we collect the following information:
- Identification information: last name, first name, email address, postal address, photograph, telephone number;
- Professional information: information contained in the CV, cover letter, information indicated on the LinkedIn profile;
- Economic and financial information: salary expectations;
- Other: skills tests, rating criteria (where a recruitment firm is used).
This personal information is processed only lawfully for the purposes set out below and for a period not exceeding that necessary for the purposes for which it is processed and retained.
Purpose: Management of the recruitment process.
- Legal basis: Performance of pre-contractual measures to which the data subject is party.
- Retention period: 2 years or until the right to erasure is exercised.
Purpose: Creation of a candidate pool (CV database).
- Legal basis: Legitimate interests of BlueKanGo in maintaining a database of potential candidates.
- Retention period: 2 years or until the right to object is exercised.
Prospects
Prospects are individuals who have shown interest in BlueKanGo and the solution we offer. We collect the following personal information:
- Identification information: last name, first name, photographs/images;
- Professional information: company name, position, role, email address, telephone number;
- Connection information: IP address, visitor identifier, connection logs, pages visited, country of connection, browser, language choice, choice of BlueKanGo newsletter topic, LinkedIn profile;
- Information contained in reviews and comments in requests you submit via our websites and social media pages.
Personal information is collected directly from you through our interactions. We may also collect information via professional social networks or public professional sources such as LinkedIn. Finally, BlueKanGo may indirectly collect your personal information by engaging a third party to enrich and update our prospect database.
This personal information is processed only lawfully for the purposes set out below and for a period not exceeding that necessary for the purposes for which it is processed and retained.
Purpose: Management of prospects and calls for tender.
- Legal basis: Legitimate interests of BlueKanGo in developing business and managing the pre-contractual relationship.
- Retention period: 3 years from the last contact with the individual.
Purpose: Commercial prospecting activities (email, telephone, events and trade shows, webinars).
- Legal basis: Legitimate interests of BlueKanGo in contacting individuals to promote its commercial activities).
- Retention period: 2 years from the last contact with the individual or until the right to object is exercised.
Purpose: Recording of telephone conversations or pre-sales meetings.
- Legal basis: Consent of the individual.
- Retention period: 30 days for video.
Customers
When you become a BlueKanGo customer, we collect the following personal information in our capacity as data controller:
- Identification information: last name, first name, photographs/images, electronic or manual signature, initials, age range, gender, city, country;
- Professional information: organisation name, position, role, business sector, email address, telephone number, training name, training dates and times, training invitations, training evaluations, training completion certificates, type of position (office or field), length of service with the organisation;
- Connection information: login credentials, BlueKanGo solution login, user profile in the solution, geolocation (when using the solution via a mobile phone), type of device used, operating system, internet browsers, device recency, comfort level with internet and technology;
- Other: chatbot interactions, support ticket number, responses to user club feature request questionnaires and interviews.
This personal information is processed only lawfully for the purposes set out below and for a period not exceeding that necessary for the purposes for which it is processed and retained.
Purpose: Management of the contractual relationship with custumers.
- Legal basis: Legitimate interests of BlueKanGo in following the commercial relationship Retention period.
- 5 years from the end of the commercial relationship.
- 10 years for all accounting documents from the close of the financial year.
Suppliers and partners
As suppliers or partners, BlueKanGo collects the following personal information:
- Identification information: last name, first name, photographs/images, electronic or manual signature, initials, personal address, country, telephone number;
- Professional information: company name, position, role, department, contract, performance review, CV, company registration extract, SIRET number, tax identification number;
- Connection information: login credentials, BlueKanGo solution login;
- Economic and financial information: service amount, daily rate (fixed and variable), expense reports, IBAN, bank details, intra-community VAT number, invoices, payment terms.
This personal information is processed only lawfully for the purposes set out below and for a period not exceeding that necessary for the purposes for which it is processed and retaine.
Purpose: Management of the contractual relationship with partners:
- Legal basis: Performance of a partnership agreement.
- Retention period:
- 5 years from the end of the commercial relationship.
- 10 years for all accounting documents from the close of the financial year.
Purpose : Management of suppliers.
- Legal basis: Legitimate interests of BlueKanGo in selecting and managing relationships with third-party suppliers.
- Retention period:
- 5 years from the end of the commercial relationship.
- 10 years for all accounting documents from the close of the financial year.
Visitors
If you visit our head office in Cesson-Sévigné, we collect the following personal information:
- Identification information: last name, first name, signature;
- Other: date and time of visit, person visited.
This personal information is processed only lawfully for the purposes set out below and for a period not exceeding that necessary for the purposes for which it is processed and retained:
Purpose: Management of physical reception and security of the head office premises (including video surveillance system).
- Legal basis: Legitimate interests of BlueKanGo in protecting people, property, and premises.
- Retention period:
- 90 days for Visitor’s Book.
- 30 days for images.
Shareholders
As a BlueKanGo shareholder, the following personal information is collected:
- Identification information: last name, first name, email address, postal address, photograph, signature, date of birth;
- Economic and financial information: number of shares.
Purpose: Administrative management of shareholders, compliance with legal obligations, exercise of shareholder rights.
- Legal basis: Legal obligations (French Commercial Code and Monetary and Financial Code), register management and communication, exercise of shareholder rights.
- Retention period: For the entire life of the Company, plus 5 years after its dissolution.
To whom is my personal information disclosed?
In strict pursuit of the intended purposes, your personal information may be disclosed only to authorised recipients, namely:
- BlueKanGo’s internal departments;
- Our subsidiaries, partners, and third-party suppliers;
- Our IT, marketing, and communications service providers;
- Publishers of software and other IT solutions we use;
- Our shareholders;
- Our consulting firms;
- Recruitment firms we may engage;
- Our banking and insurance institutions;
- Regulated professions (such as lawyers, statutory auditors);
- Social media networks and advertising and announcement management platforms (such as Meta, X, LinkedIn, Matomo, Google).
Finally, in exceptional cases, your personal information may also be disclosed to duly authorised administrative or judicial authorities, in strict compliance with applicable law.
We provide our processors only with the personal information necessary for them to perform their services, and we require that they not use it for any other purpose. They and all subsequent sub-processors process your information only on our instructions and are contractually required to maintain a level of security and confidentiality for your information equivalent to ours and to comply with applicable personal information protection laws.
Is my personal information transferred to countries outside the European Union?
The collected information may be transferred outside the European Union (and, where applicable, outside Canada). In such cases, we systematically take all necessary measures to ensure that recipients provide an adequate and equivalent level of protection in accordance with national and European regulations, including through the use of standard contractual clauses adopted by the European Commission (as well as the GDPR adequacy decision for Canada) and the implementation of additional technical, organisational, and legal measures to further govern such transfers.
How is my personal information kept secure?
We are committed to preserving the confidentiality, integrity, availability, and security of your personal information. In accordance with Article 32 of the Regulation, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks involved in processing your personal information. We also put in place measures to prevent, to the extent possible, any loss, accidental destruction, alteration, or unauthorised access to your personal information.
What rights do I have over my personal information?
In accordance with the Regulation, you have the right to:
- Access and rectify your personal information;
- Object to the processing of your personal information for legitimate reasons;
- In the cases provided for by the Regulation, request restriction of processing and/or erasure of your personal information;
- Request portability of your personal information for your own use or to transmit it to a third party of your choice;
- Withdraw your consent at any time;
- Provide instructions regarding the fate of your personal information after your death, either directly or through a trusted third party or successor.
You also have the right to file a complaint with a supervisory authority, such as the Commission Nationale de l’Informatique et des Libertés (CNIL) or the competent authority in your country of residence.
You may exercise these rights by contacting our data protection officer:
- By post, to the address:
BlueKanGo
Attention: DPO
90 rue Robert Keller
35510 Cesson-Sévigné
France
- By email at: rgpd@bluekango.com
If BlueKanGo has reasonable doubts about your identity, we reserve the right to request additional information, including, where necessary, a copy of an identity document. In such cases, the identity document is deleted immediately once the identity has been verified.
For more information, you can visit the CNIL website.
Updates to this Policy
The Company may amend this Policy. We will inform you of any material changes to the Policy either through a notice in our newsletters or by displaying a notice on our website.
Update: November 2025
