--- title: "StrucTime privacy policy" description: "How AEON Systems collects, uses and protects your personal data, in accordance with the General Data Protection Regulation." canonical: https://structime.com/en/privacy/ language: en last_modified: 2026-08-19 publisher: "AEON Systems (SIREN 993102821)" source_format: html --- # Privacy policy > How AEON Systems collects, uses and protects your personal data, in accordance with the General Data Protection Regulation. Source : https://structime.com/en/privacy/ Publisher: AEON Systems (SIREN 993102821) · StrucTime Legal information Courtesy translation. Only the French version is legally binding: [Politique de confidentialité](https://structime.com/confidentialite/). Should the two differ, the French text prevails. Version 1.1 · Last updated: 25 June 2026 ## Our commitment At **AEON Systems**, protecting your personal data is a priority. This privacy policy informs you how we collect, use and protect your data in connection with the use of the **StrucTime** platform, in accordance with the General Data Protection Regulation (GDPR). ## 1. Data controller The controller of personal data is: - **Company name:** AEON Systems - **Email:** contact@aeon-systems.fr - **Website:** https://structime.app Where StrucTime is used by a corporate customer (the "Customer"), that customer acts as controller for the data of its own employees and contacts. AEON Systems then acts as processor within the meaning of the GDPR. ## 2. Data collected We collect the following categories of personal data: ### Identification data Surname, first name, business email address, telephone number, profile picture (optional). ### Professional data Position, department, employee number, hire date, authorisations and skills, contractual information. ### Connection data IP address, activity logs, connection timestamps, browser type and operating system. ### HR data (if the module is enabled) Absences and leave, medical appointments (dates only), training, appraisals. **Important note:** We do not collect sensitive data (racial origin, political opinions, detailed health data, sexual orientation, etc.) except where strictly necessary for HR management and with your explicit consent. ## 3. Purposes of processing Your personal data is processed for the following purposes: - **User account management**: creation, authentication and administration of access - **Service delivery**: running the platform's features (HR, scheduling, fleet, etc.) - **Technical support**: assistance and incident resolution - **Service improvement**: analysis of usage in order to improve the user experience - **Communication**: sending service-related notifications and important updates - **Security**: detecting and preventing fraud and unauthorised access - **Legal obligations**: compliance with accounting, tax and regulatory obligations ## 4. Legal basis for processing - **Performance of the contract** (GDPR Article 6.1.b): processing necessary to provide the subscribed services - **Legitimate interest** (GDPR Article 6.1.f): service improvement, security, fraud prevention - **Legal obligation** (GDPR Article 6.1.c): compliance with legal and regulatory obligations - **Consent** (GDPR Article 6.1.a): for specific processing requiring your prior agreement ## 5. Recipients of the data Your data may be passed on to the following categories of recipient: - **Authorised AEON Systems staff**: technical and support teams, within the limits of their duties - **Your employer (the Customer)**: the administrators of your company have access to their organisation's data - **Server hosting:** OVH Cloud (France, Gravelines) - **File storage:** Cloudflare R2 (European Union region) - **Authentication:** Supabase Auth (self-hosted on OVH France) - **SEPA payments:** GoCardless (United Kingdom, GDPR adequacy decision) - **B2B e-invoicing platform:** Iopole (France, approved platform registered since 11 December 2025) - **Expense receipt OCR:** Google Gemini API (United States, Data Privacy Framework), solely to extract text from receipts - **Notifications:** Novu (self-hosted on OVH France) - **Competent authorities**: where required by law or by a judicial order We never sell your personal data to third parties. Our processors are contractually bound to respect the confidentiality and security of your data through a data processing agreement (DPA) compliant with GDPR Article 28. ## 6. International transfers Your application data and your files are hosted within the European Union (OVH Cloud, Gravelines, France; Cloudflare R2, European Union region). Two processors operate partly outside the European Union: **GoCardless (United Kingdom)**, which benefits from an adequacy decision of the European Commission, and **Google Gemini API (United States)**, certified under the Data Privacy Framework. For any transfer not covered by adequacy, we put Standard Contractual Clauses (SCCs) in place. ## 7. Retention periods | Type of data | Retention period | | --- | --- | | Account data | Term of the contract + 3 years | | Connection logs | 1 year | | HR data | 5 years after the employee leaves | | Invoicing data | 10 years (legal obligation) | | Support data | 2 years after the ticket is closed | At the end of these periods, your data is either deleted or irreversibly anonymised. ## 8. Data security ### Encryption TLS 1.3 for data in transit, AES-256 encryption for sensitive data at rest. ### Secure authentication Hashed passwords (bcrypt), support for two-factor authentication (2FA), secure sessions with automatic expiry. ### Data isolation Multi-tenant architecture with strict data isolation between customers, role-based access control (RBAC). ### Backups Automatic daily backups, 30-day retention, regular restoration tests. ## 9. Your rights In accordance with the GDPR, you have the following rights over your personal data: - **Right of access (Art. 15)**: obtain confirmation that your data is being processed and receive a copy of it - **Right to rectification (Art. 16)**: correct inaccurate data or complete incomplete data - **Right to erasure (Art. 17)**: request the deletion of your data under certain conditions - **Right to restriction (Art. 18)**: temporarily freeze the processing of your data - **Right to object (Art. 21)**: object to processing based on legitimate interest - **Right to portability (Art. 20)**: receive your data in a structured, machine-readable format - **Withdrawal of consent**: at any time, for processing based on your consent To exercise your rights, contact our Data Protection Officer (DPO) at **dpo@aeon-systems.fr**. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr). ## 10. Cookies Our platform uses cookies that are strictly necessary for the service to work: | Cookie | Purpose | Duration | | --- | --- | --- | | sb-*-auth-token | Session authentication | Session | | cookie-consent | Storing your consent | 1 year | | theme | Display preference (light/dark) | 1 year | We do not use advertising cookies or third-party trackers for profiling purposes. ## 11. Changes to this policy We may update this policy to reflect changes in our practices or for legal reasons. In the event of a substantial change, we will inform you at least 30 days before it takes effect. ## 12. DPO contact - **DPO:** Data Protection Officer, AEON Systems - **Email:** dpo@aeon-systems.fr We undertake to respond to any request within a maximum of 30 days.