Privacy Policy

1. Purpose

This Privacy Policy informs users and client companies about how the Yloria platform collects, uses, stores and protects personal data processed through its HR features. It is aligned with the GDPR and applicable French law.

2. Controller and processor

The client company is the controller of its employees' personal data. Yloria SASU acts as processor under the GDPR Data Processing Agreement signed with the client.

3. Data collected

Yloria collects only the data necessary to operate the service: first name, last name, professional email, role, skills, quiz results, professional evaluations, career plans and personalized support plans. No unnecessary data is collected.

4. Purposes of processing

Data is processed for recruitment management, professional evaluations, skill management, career planning, personalized support planning, quiz and result management, user account management and service improvement. Data is not used for advertising or commercial resale.

5. Legal basis

Processing is based on the contract between Yloria SASU and the client, the client's legitimate interest in HR management, and user consent where required, for example for non-essential cookies.

6. Access to data

Data is accessible only to the concerned user, authorized client administrators, HR or managers according to their legitimate scope, limited Yloria technical teams and authorized technical processors such as OVHcloud.

7. Hosting

Data is hosted by OVHcloud in France or in the European Union. No transfer outside the European Union is performed by default.

8. Security

Yloria implements technical and organizational measures including HTTPS encryption, server protection, access management, authentication, action logging, regular backups and monitoring. The client remains responsible for managing user access.

9. Retention

Data is retained while the contract is active, then deleted or returned within 30 to 90 days after termination according to reversibility clauses. Backups are purged under Yloria's internal policy.

10. User rights

Under the GDPR, users have rights of access, rectification, objection, restriction, erasure and portability. Requests must be sent to the client administrator, acting as controller.

11. Cookies and local storage

The platform may use technical cookies required for operation. Non-essential cookies, if introduced, require consent. Cookie details are provided in the Cookie Policy.

12. Processors

Processors involved in data processing include OVHcloud for hosting and possible technical providers for maintenance or monitoring. They are bound by confidentiality and security obligations.

13. Support and reporting

Users may contact support through the Suggestions button integrated in the platform. Security or personal data requests must also be relayed to the client administrator where appropriate.

14. Updates

This Privacy Policy may be updated to reflect legal, technical or organizational changes.