Who processes your data
The data controller is AllBusinessGroups, a project currently published on a non-professional basis by a natural person (see the Legal notice). No data protection officer has been appointed: the structure of the project does not require one today.
For any question, or to exercise your rights: privacy@allbusinessgroups.com.
The data we process
We only process what the site genuinely needs.
Your account: name, email address, password (never kept in clear text — only a cryptographic hash is stored), professional activity, role on the platform, chosen interface language, creation and update dates.
Your sessions: a session token, its expiry date, and the IP address and browser used to sign in.
If you ask to list an organization or a group: your name, your role, your work email address, your LinkedIn profile, any comment you write, and the supporting document you attach.
If you ask to take over an existing profile or report a manager: the same identification details, the message you write, and — for a report — the name and email address of the person you designate.
If you ask to visit a group: your name, your email address, your phone number if you provide one, your activity and your message. The group manager can see them in order to reply.
If you leave a review: the author name you provide, your rating and your comment. A published review is public, and the author name appears on it.
If you invite a contact to discover a group: that contact's email address, your message, and a record of who sent the invitation.
If you express interest in the future Premium plan: your name, your email address, your organization's name, the number of groups, your level of interest, the features that interest you and your comment.
If you write to us through the contact form: your name, your email address, the subject and your message. These are not stored in the site database: they are sent to the publisher by email.
If you are a member of a group or attend an event: your membership, your attendance, and who recorded it.
Administration actions: important decisions (approving or refusing an organization or a group, assigning a manager, granting Premium) are logged with their date, their author, their outcome and any comment.
If you allow geolocation on the search page: your coordinates are used only to calculate distances. They travel in the page address and are never stored in our database.
If you register interest in the Founders Offer: your place in the offer is recorded separately from your answers to the questionnaire. That place contains only what will be needed to honour the promise — an arrival rank, your work email address, the date, the number of groups you declared and any known attachment. Neither your name, nor your comment, nor your answers appear in it.
We process no special category data within the meaning of Article 9 GDPR, we carry out no advertising profiling and no automated decision-making, and we neither sell nor rent any data.
Why we process them, and on which legal basis
- Creating and managing your account, signing you in, sending you the emails the service requires (address confirmation, password reset): performance of the service you request (Article 6(1)(b) GDPR).
- Publishing and maintaining the directory of business clubs, groups and professional networks: our legitimate interest in building a useful and reliable directory (Article 6(1)(f)).
- Checking that a person may legitimately manage an organization or a group: our legitimate interest, and that of the organizations concerned, in preventing a third party from taking control of a profile (Article 6(1)(f)).
- Handling visit requests, reviews, invitations, memberships and events: performance of the service (Article 6(1)(b)), and legitimate interest where the feature involves a person who has no account (Article 6(1)(f)).
- Recording your interest in the future Premium plan and letting you know when it launches: your consent (Article 6(1)(a)), which you may withdraw at any time.
- Replying to your messages and providing support: performance of the service and legitimate interest (Articles 6(1)(b) and 6(1)(f)).
- Keeping the site secure, preventing abuse, fraud and impersonation, and keeping a record of administration decisions: our legitimate interest (Article 6(1)(f)).
Where we rely on legitimate interest, you may object: see “Your rights”.
Supporting documents
Before a person may manage an organization or a group, we ask for a document (mandate, certificate, presentation of the group…).
That document is used for this verification only. It is never public, never indexed by search engines, and is not reachable through any permanent address. Only authorised AllBusinessGroups administrators can view it, on screen, with no possibility of downloading it.
As soon as a decision is recorded — approval or refusal alike — the file is genuinely deleted from our servers. Only the information needed for traceability remains: the date it was submitted, the date and outcome of the decision, and who made it. The document itself never survives the decision.
Profiles created from public sources
Part of the directory was built by AllBusinessGroups from publicly available information (network websites, club directories). Those profiles describe structures: club name, parent organization, city, meeting day and frequency, and the address of the source page.
As of today, those profiles contain no personal data: no manager name, no email address and no telephone number has been imported. An unclaimed profile is marked as such.
If a profile concerns you personally, or if it nevertheless contains information identifying you, you may ask for it to be corrected or removed at privacy@allbusinessgroups.com, or from the profile itself. Should we collect personal data from third parties in the future, the people concerned would be informed in accordance with Article 14 GDPR.
Who has access to your data
Your data is accessible to the publisher of the site and to authorised AllBusinessGroups administrators, limited to what their role requires.
Some information is visible to other users, because that is the point of the feature: a group manager sees the visit requests addressed to them and the members of their group; a published review shows the author name you provided.
We use the following technical providers:
- OVH SAS (France) — hosting of the site and the database on infrastructure located in France, and email service for the allbusinessgroups.com domain. Delivering an email therefore sends it the recipient's address and the content of the message.
- OpenFreeMap — map tiles. When a page displays a map, your browser loads the tiles from this service, which therefore necessarily receives your IP address. No other information is sent to it.
- geo.api.gouv.fr (Etalab, France) and Nominatim (OpenStreetMap Foundation) — converting a town or a meeting address into coordinates. These calls are made by our server, never by your browser: your IP address is not sent to them.
Apart from these providers, no data is passed on to third parties, save for a legal obligation or a request from a competent authority.
Transfers outside the European Union
Hosting of the site and of the database is located in France.
Emails are sent through OVH's email service, on the same French infrastructure: the data needed to deliver an email (recipient address, message content) does not leave the European Economic Area.
The map tile service may also be operated from a third country. We therefore cannot claim that 100% of processing takes place in France, and we do not claim it.
How long we keep them
- Supporting document: deleted as soon as a decision is made. Failing a decision, automatically deleted 90 days after it was submitted — the request itself remains readable, without the document.
- Visit request: personal data is erased 12 months after the request is closed — that is, after the manager has replied — or, if the request never received a reply, 12 months after it was created. A manager's silence does not extend the retention period.
- Premium expression of interest: kept until the commercial launch of Premium, then for 12 months at most. Deleted earlier if you withdraw your consent, if the Premium project is abandoned, or as soon as it is no longer useful.
- Place in the Founders Offer: kept for as long as is necessary to honour the price commitment, that is, until the end of the 36 months if you benefit from it. Deleted if you explicitly give up the offer or delete your account — unsubscribing from information about Premium does not delete it.
- Log of administration decisions: 3 years, so that an approval or a refusal can be justified.
- Technical and security logs containing personal data: 6 months, unless an incident is being investigated or a specific legal obligation applies.
- Messages sent through the contact form: 12 months after the last useful exchange, unless there is a dispute.
- Invitation to manage an organization or a group: the link expires after 7 days.
- Report of a manager not confirmed by its author: automatically deleted after 7 days.
- Invitation to an internal ABG account: the link expires after 72 hours.
- Cookie storing your cookie choice: 6 months. Deliberately shorter than the tolerated maximum: this cookie records a choice only, it measures nothing.
- Sign-in session: it expires automatically; signing out deletes it immediately.
- Account and associated data: kept for as long as your account exists.
- Published reviews: kept for as long as the group profile exists. They are anonymised if you delete your account, and can be removed entirely on request.
- Matching opportunity (a group is looking for your profession near you): kept for 12 months after it appears, then deleted automatically. Only you can see it; the group only sees a number, never your identity.
The automatic deletions above are carried out by a scheduled task, with no manual step.
Your rights
Under the conditions laid down by the GDPR, you have the right to:
- access the data we hold about you;
- have it corrected if it is inaccurate;
- ask for it to be erased;
- ask for its processing to be restricted;
- object to processing based on our legitimate interest;
- receive the data you provided in a machine-readable format (portability);
- withdraw your consent at any time where processing is based on it, without affecting what was done beforehand.
To exercise these rights: privacy@allbusinessgroups.com. We reply within one month. We may ask you for something that allows us to verify your identity, but only where reasonable doubt exists.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the supervisory authority of your country of residence.
Cookies and trackers
The site only sets cookies that are necessary for it to work:
- a session cookie, which keeps you signed in;
- a language cookie, which remembers the language you chose;
- a cookie storing your cookie choice, so that you are not asked again on every visit.
These cookies are not used for advertising or audience measurement, and are not shared with third parties.
No audience measurement tool and no advertising tool is installed on the site today. The “Manage my cookies” panel nevertheless offers these two categories: your choice is recorded in advance and will be respected should such a tool ever be added. Refusing is as easy as accepting, and your choice can be changed at any time from the footer.
Security
Passwords are never kept in clear text. Tokens sent by email (invitation, report) are stored only as a hash: a copy of the database would not make them reusable. Exchanges with the site are encrypted.
Access to administration data is restricted to authorised internal accounts, and sensitive actions are logged. An internal account that no longer has any reason to act is disabled rather than deleted, so that the log remains readable.
No system is infallible: if a data breach were likely to result in a risk to your rights and freedoms, we would inform the competent authority and, where required, the people concerned, in accordance with Articles 33 and 34 GDPR.
Account deletion
Three different steps, not to be confused with one another.
**Stop receiving information about Premium.** From “My account”, you can withdraw your consent: your answers to the questionnaire (name, comment, features you were interested in, level of interest) are erased. Your place in the Founders Offer is kept — it rests on a commercial undertaking, not on consent to receive emails.
**Give up the Founders Offer.** Also from “My account”, and after an explicit confirmation, you can give up your place. You then lose the benefit of the Founder rate. A minimal record of the renunciation is kept, to show that the place was indeed freed up.
**Delete your account.** Deletion is possible at any time from “My account”; it requires typing a confirmation word, and it is immediate and permanent. You may also request it at privacy@allbusinessgroups.com, in which case it is handled manually within the one-month period provided for by the GDPR.
What is deleted with the account: your credentials, your sessions, your group memberships, your event attendances, the invitations you sent, your visit requests, your requests to take over a profile, your Premium expression of interest and your place in the Founders Offer.
What remains: organization and group profiles, which describe structures rather than people; and the log of administration decisions. Your published reviews stay online but become anonymous — your name is removed from them. If you want a review to be deleted entirely, ask at privacy@allbusinessgroups.com.
An AllBusinessGroups team account cannot be deleted this way: it has made administration decisions whose record must remain. Such an account is disabled and its personal data removed, without destroying the history.
Changes to this policy
This policy may change, in particular when the project changes legal status or when the Premium plan is commercially launched. The date of the last update appears at the bottom of this document. In the event of a significant change, you will be informed on the site.