GDPR and data protection officer

Processor: where an organisation entrusts us with the monitoring of its perimeter (domains, work addresses, brands, address ranges, suppliers), its analyses, alerts, exports and reports, that organisation remains the controller. VesperID acts on its documented instructions: the service catalogue, the client area settings and the terms and conditions, supplemented by a data processing agreement (Article 28 of the GDPR). We never reuse one organisation’s data for another.

Controller: VesperID determines the purposes and means of processing data about its prospects, its users’ accounts, its invoicing, its support, the security of its platform, the vesperid.com site, and a protected person’s personal area.

The protected person decides: under the Executive protection service, the person accepts the invitation themselves, sets the monitored perimeter, alone sees the detail of their profile, grants and revokes access member by member and ends the monitoring whenever they wish; the paying organisation only sees an aggregate state.

That allocation determines who a request should go to: if your data is processed because an organisation asked us to monitor its perimeter, the request belongs to that organisation, to which we pass it while informing you; if it concerns our own processing or your personal area, we answer directly.

Address: dpo@vesperid.com. Every request received is recorded, timestamped and followed until closure. The named appointment of the officer is in progress; it will be published in the legal notice and declared to the CNIL.

You may write in French or in English. No justification is needed to exercise a right; proof of identity may be requested only where there is reasonable doubt about your identity, and it is deleted as soon as verification is complete.

The response time is one month, extendable by two months for complex requests, with a reasoned notice.

You have the right to access, rectify and erase your data, to restrict its processing, to portability for the data you provided to us, and to object, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21 of the GDPR). You may set instructions about your data after your death.

Member of a client area or holder of a personal area: from your area you export your data in a machine-readable format and request the erasure of your account; for any other right, write to dpo@vesperid.com.

Employee of a client organisation whose work accounts are monitored: your rights are exercised with your employer, the controller, at the contact given in the information notice it handed you; VesperID passes it any request received directly and informs you. You may contest any detection, score or recommended action that seems inaccurate, through the same channel.

Person mentioned in a detection without being a member or an employee (author of a post, holder of a domain, victim of an infected device): write to dpo@vesperid.com; we mask or remove third-party content reproduced in a detection upon report.

You may lodge a complaint with the CNIL at any time, including without having contacted us first.

A person is monitored by name only after accepting the invitation themselves; without that acceptance, the organisation monitors only the work accounts it controls, after informing its staff.

The person monitored alone sees the detail of their profile; they set the monitored perimeter themselves, grant and revoke access member by member, and end the monitoring at any time, without justification or notice: the profile is then closed and the associated monitoring stops. The organisation only sees an aggregate state: profile status, number of open detections, level and update date.

The person concerned may at any time request the list of access grants and of the views of their profile by our staff, as well as a full export of its contents.

A client organisation funding a protection profile has no access to its contents unless the person themselves grants that access. That separation is enforced in the database itself and logged.

An organisation that activates the monitoring of its staff’s work accounts must inform them individually before putting it into service (article L. 1222-4 of the French labour code, articles 13 and 14 of the GDPR) and consult its works council where the law requires it (article L. 2312-38). VesperID supplies the information notice template, with the employer’s instructions, its checklist and the note for the council; the organisation records the corresponding attestation in its client area before activation.

The notice states what the device does and does not do, the legal basis, the recipients and transfers, the retention periods, the rights, and the absence of any use for personnel management.

Anyone holding an account may request an export of their data from their personal area, in a machine-readable format. The export is made available through an authenticated download and deleted after seven days.

An erasure request is validated by an administrator other than the person handling it, then executed. Account data is deleted or pseudonymised; invoices and the audit log are retained under statutory and evidential obligations.

Deleting a user account does not delete the client organisation’s monitoring data, which remains that organisation’s responsibility.

In the event of a personal data breach, VesperID notifies the competent supervisory authority within seventy-two hours where the breach is likely to result in a risk to individuals’ rights and freedoms.

Where VesperID acts as a processor, the client acting as controller is informed as soon as possible, with the elements needed for its own notification.

The individuals concerned are informed where the risk is high, in plain language, with the nature of the breach, its likely consequences and the measures taken.

The competent authority is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

You may contact it at any time, including without having contacted us first.