Personal data
Privacy policy
H-Box is committed to processing your personal data in a way that is transparent, proportionate and secure.
1. Data controller and contact
The data controller is H-Box Conseil & Formation. For any question about your personal data, or to exercise your rights, write to micheline@h-box.fr, with the subject “GDPR – request”.
2. Data concerned and purposes
We collect only the data that is useful for our exchanges and for providing our services: identity, business contact details, the content of your message, information about your project and, where a contractual relationship exists, the information needed to manage it.
- Responding to a contact or appointment request: our legitimate interest in responding to your enquiry and, where applicable, pre-contractual steps taken at your request;
- Carrying out an assignment, a training course or a contract: performance of the contract and compliance with our legal obligations;
- Connecting and using Facebook and Instagram services through our application: performance of the service requested and the authorisation you grant when connecting your Meta account;
- Sending you commercial information: consent where it is required, or legitimate interest under the conditions set by the regulations, with the right to object at any time;
- Ensuring the security and proper functioning of the site: legitimate interest and applicable legal obligations.
We do not ask you to provide sensitive data in a form or by email. Please do not send any unless absolutely necessary and after discussing it with us first.
3. Recipients and transfers
Your data is accessible only to authorised persons at H-Box and, where necessary, to our technical service providers acting on our behalf (hosting, email, customer relationship management tools). These providers are selected and supervised so as to protect your data. We do not sell your personal data.
If a tool involves a transfer of data outside the European Economic Area, we put in place the appropriate safeguards required by the regulations and provide you with the relevant information on request.
4. Facebook and Instagram data
When you choose to connect a Facebook or Instagram account to an application or service managed by H-Box, we may receive and process, within the limits of the permissions you grant to Meta, the data needed for the service:
- access tokens and technical connection information;
- identifiers and account information for a Facebook Page or Instagram professional account (for example name, identifier, profile picture or information made available by Meta);
- content that you ask us to prepare, schedule or publish, and the metadata strictly necessary for that operation;
- publication statuses, error messages and technical logs needed for security, support and the proper functioning of the service.
We use this data solely to provide the requested functionality: connecting the account, preparing or publishing the content you have authorised, providing support and securing the service. We do not access your Facebook or Instagram password and we do not sell this data.
Access tokens are protected by appropriate security measures and access is restricted to authorised people and systems. They are not shared with third parties for their own use or with advertising partners. Data may be shared with Meta to carry out the requested action and with our technical subcontractors where necessary for the service to function, within the framework described in section 3.
5. Retention periods
- Contact requests and prospect data are kept for up to 3 years after your last active contact with us, unless you object or request erasure sooner.
- Data relating to a customer relationship is kept for the duration of the relationship, then archived for as long as necessary to meet our legal obligations or to defend our rights.
- Accounting records are kept for the applicable legal periods, including 10 years where the regulations require it.
- Data needed as evidence of a request relating to your rights may be kept for as long as necessary to process it and to handle any dispute.
- Meta access tokens and connection information are deleted or made unusable no later than 30 days after the account is disconnected, the authorisation is revoked or the service ends, unless a legal obligation or a documented security need applies.
- Working copies of Facebook or Instagram content are deleted no later than 30 days after the end of the service or of the scheduling. Content that has already been published may remain visible on Facebook or Instagram until it is deleted on the platform concerned, under that platform’s own rules.
- Technical logs linked to Meta services are kept for up to 12 months, unless a shorter period is needed or a legal obligation applies.
6. Cookies and trackers
The site may use trackers that are strictly necessary for its operation and security. Any non-essential tracker (for example for audience measurement or advertising) must be the subject of specific information and, where the law requires it, of your consent before it is placed. You can change your choices through the cookie management mechanism displayed on the site when one is present, or by configuring your browser.
7. Your rights
Under the applicable regulations, you have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time where the processing is based on it. You can also set directives on what happens to your data after your death.
We reply within one month of receiving your request. This period may be extended by two months in the case of a complex request or a large number of requests; we will then inform you within the first month. If you consider that your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority; page in French) or with the data protection authority of your country of residence.
8. Security and updates
We apply appropriate technical and organisational measures to limit unauthorised access, loss and disclosure of data. This policy may change when our practices or the regulations change. The date of the last update appears at the top of this page.
