Privacy policy

Courtesy translation. Only the French version is legally binding: Politique de confidentialité. Should the two differ, the French text prevails.

Version 1.1 · Last updated: 25 June 2026

Our commitment

At AEON Systems, protecting your personal data is a priority. This privacy policy informs you how we collect, use and protect your data in connection with the use of the StrucTime platform, in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

The controller of personal data is:

• Company name: AEON Systems
• Email: contact@aeon-systems.fr
• Website: https://structime.app

Where StrucTime is used by a corporate customer (the "Customer"), that customer acts as controller for the data of its own employees and contacts. AEON Systems then acts as processor within the meaning of the GDPR.

2. Data collected

We collect the following categories of personal data:

Identification data

Surname, first name, business email address, telephone number, profile picture (optional).

Professional data

Position, department, employee number, hire date, authorisations and skills, contractual information.

Connection data

IP address, activity logs, connection timestamps, browser type and operating system.

HR data (if the module is enabled)

Absences and leave, medical appointments (dates only), training, appraisals.

Important note: We do not collect sensitive data (racial origin, political opinions, detailed health data, sexual orientation, etc.) except where strictly necessary for HR management and with your explicit consent.

3. Purposes of processing

Your personal data is processed for the following purposes:

• User account management: creation, authentication and administration of access
• Service delivery: running the platform's features (HR, scheduling, fleet, etc.)
• Technical support: assistance and incident resolution
• Service improvement: analysis of usage in order to improve the user experience
• Communication: sending service-related notifications and important updates
• Security: detecting and preventing fraud and unauthorised access
• Legal obligations: compliance with accounting, tax and regulatory obligations

4. Legal basis for processing

• Performance of the contract (GDPR Article 6.1.b): processing necessary to provide the subscribed services
• Legitimate interest (GDPR Article 6.1.f): service improvement, security, fraud prevention
• Legal obligation (GDPR Article 6.1.c): compliance with legal and regulatory obligations
• Consent (GDPR Article 6.1.a): for specific processing requiring your prior agreement

5. Recipients of the data

Your data may be passed on to the following categories of recipient:

• Authorised AEON Systems staff: technical and support teams, within the limits of their duties
• Your employer (the Customer): the administrators of your company have access to their organisation's data
• Server hosting: OVH Cloud (France, Gravelines)
• File storage: Cloudflare R2 (European Union region)
• Authentication: Supabase Auth (self-hosted on OVH France)
• SEPA payments: GoCardless (United Kingdom, GDPR adequacy decision)
• B2B e-invoicing platform: Iopole (France, approved platform registered since 11 December 2025)
• Expense receipt OCR: Google Gemini API (United States, Data Privacy Framework), solely to extract text from receipts
• Notifications: Novu (self-hosted on OVH France)
• Competent authorities: where required by law or by a judicial order

We never sell your personal data to third parties. Our processors are contractually bound to respect the confidentiality and security of your data through a data processing agreement (DPA) compliant with GDPR Article 28.

6. International transfers

Your application data and your files are hosted within the European Union (OVH Cloud, Gravelines, France; Cloudflare R2, European Union region).

Two processors operate partly outside the European Union: GoCardless (United Kingdom), which benefits from an adequacy decision of the European Commission, and Google Gemini API (United States), certified under the Data Privacy Framework. For any transfer not covered by adequacy, we put Standard Contractual Clauses (SCCs) in place.

7. Retention periods

At the end of these periods, your data is either deleted or irreversibly anonymised.

8. Data security

Encryption

TLS 1.3 for data in transit, AES-256 encryption for sensitive data at rest.

Secure authentication

Hashed passwords (bcrypt), support for two-factor authentication (2FA), secure sessions with automatic expiry.

Data isolation

Multi-tenant architecture with strict data isolation between customers, role-based access control (RBAC).

Backups

Automatic daily backups, 30-day retention, regular restoration tests.

9. Your rights

In accordance with the GDPR, you have the following rights over your personal data:

• Right of access (Art. 15): obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification (Art. 16): correct inaccurate data or complete incomplete data
• Right to erasure (Art. 17): request the deletion of your data under certain conditions
• Right to restriction (Art. 18): temporarily freeze the processing of your data
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to portability (Art. 20): receive your data in a structured, machine-readable format
• Withdrawal of consent: at any time, for processing based on your consent

To exercise your rights, contact our Data Protection Officer (DPO) at dpo@aeon-systems.fr. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

10. Cookies

Our platform uses cookies that are strictly necessary for the service to work:

We do not use advertising cookies or third-party trackers for profiling purposes.

11. Changes to this policy

We may update this policy to reflect changes in our practices or for legal reasons. In the event of a substantial change, we will inform you at least 30 days before it takes effect.

12. DPO contact

• DPO: Data Protection Officer, AEON Systems
• Email: dpo@aeon-systems.fr

We undertake to respond to any request within a maximum of 30 days.