Privacy policy

In short

This policy explains what personal data Reglova processes, why, for how long, and how to exercise your rights (EU Regulation 2016/679, the GDPR, and the French Data Protection Act). No data is sold, no ads are shown, no tracking tool is used.

Who is responsible?

• Website and presentation requests: Victor Aubague EI is the data controller.
• Reglova application: the client company that opens the accounts is the controller for the data of its employees and contractors; Victor Aubague EI acts on its behalf as a processor (GDPR Article 28), under the contract and its data processing agreement. To exercise your rights over this data, contact your employer first: we help them answer you.

Privacy contact: [email protected].

Presentation requests

• Data: name, company, business email address, phone (optional), number of plants, message (optional), page language.
• Purpose: answer your request and organise the presentation.
• Legal basis: pre-contractual steps taken at your request (GDPR Article 6(1)(b)).
• Retention: three years after the request, then automatic erasure.
• Recipients: the Victor Aubague EI team. No transfer, no marketing by third parties.

Application accounts

• Account data: name, email address, role, accessible plants; for a technician, their card (trade, hourly cost), qualifications and their expiry, absences and on-call duties (the reason for an absence is visible to managers only). The password is stored hashed (Argon2) and cannot be read by anyone.
• Activity records: work orders, time spent, reports, signatures, messages, photos and attachments, audit log (sign-ins, failed sign-ins, sensitive actions), each with its time and author.
• Purposes: plan and record maintenance; prove regulatory inspections and work safety (lockout, work permits, qualifications); secure access.
• Legal basis: performance of the contract between Victor Aubague EI and the client company; legal obligations and the company's legitimate interest in the safety and traceability of its installations.
• Retention: for the term of the contract. When it ends, the company retrieves its data (exports); the data is then erased within three months, unless the law requires keeping it. An administrator can erase a user at any time: their name is replaced by a pseudonym in the history, which remains usable.

Requests without an account (QR code)

An operator can report a breakdown by scanning a machine's QR code, without an account. Name and email address are optional; the address is only used to send the request's updates. The client company is the controller; the data follows the retention of its work orders.

Technical data and security

• Server logs: IP address, date, requested address and response code, for security and diagnostics; kept for twelve months at most.
• Sign-in protection: failures are counted per email address and per IP address, in memory, for fifteen minutes; five failures suspend sign-in for that email address during this time.
• Security measures: encrypted connections (TLS), hashed passwords, two-factor authentication, single-use reset links, each client's data isolated in the database, audit log, daily backups kept for thirty days, then one per month for twelve months.

Cookies and storage on your device

Reglova sets no advertising or audience measurement cookie. The application keeps on your device the session (sign-in token), the language, display preferences and, offline, entries waiting to be sent. This storage is strictly necessary for the service you request and needs no consent. The session is cleared at sign-out; offline entries once sent.

Fonts and the 3D model decoder are served by our servers: your browser contacts no third-party domain.

Processors

• Hosting of data and backups: Contabo GmbH, Aschauer Straße 32a, 81549 München, Allemagne, in the European Union.
• Sending emails (invitations, password resets, request updates): the mail server configured by Victor Aubague EI or by the client company.
• AI generation of 3D models (optional, at a manager's request): the link or photo of the machine is sent to the configured AI provider (Anthropic, in the United States, by default). No user data is attached.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Write to [email protected]: we answer within one month. In the application, an administrator can export all of a user's data and erase it.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.

Changes

Any change is published on this page, with its date at the top. Significant changes are notified to the client companies' administrators.