Privacy policy

Controller

Ultrametrix, 58 avenue Chanoine Cartellier, 69230 Saint-Genis-Laval, France. For any question or request about your data: contact@ultrametrix.fr.

What the portal does not process

The portal never stores any data about an industrial site: inventories, device IP addresses, maps and risk analyses stay in the UMX modules, installed and used offline at the customer's.

For a Risk Manager + CTI customer, the threat-intelligence relay passes to the providers it queries only the scope the customer declared (the organization's names and domains), refuses any other field and keeps nothing.

Data processed, purposes and legal bases

• Account: name, professional e-mail address, company, role in the organization, password hash, second factor, language. To run the account and give access to downloads and licenses (performance of the contract).
• Account security: sessions and sign-in journal (IP address truncated to /24 in IPv4 and /32 in IPv6, browser), device cookie, notice of a sign-in from a new device. To protect accounts against takeover (legitimate interest). Kept 30 days.
• Purchase and billing: organization, offer, subscription, licenses issued; the payment method and billing details are entered and kept at Stripe, never on the portal (performance of the contract, accounting obligations).
• Contact and quote requests: name, e-mail address, phone, company, stated need. To answer and make a proposal (pre-contractual steps). Kept 3 years.
• Support: tickets, messages and attachments, attached to the organization (performance of the contract).
• Commercial communications: only with your consent, given in a separate box at sign-up and withdrawn at any time from your space ("Your data") or by e-mail.
• Usage statistics: number of licenses issued and of downloads per organization, without any site data (legitimate interest).

Recipients

The data is processed by Ultrametrix and by its processors, each for its own task only:

• Contabo GmbH (Germany): hosting of the server, the portal and its database.
• OVH SAS (France): sending of the portal's e-mails and the contact@ultrametrix.fr mailbox.
• Stripe Payments Europe, Limited (Ireland): payment, subscriptions, invoices and billing details. Stripe may transfer data to Stripe, Inc. (United States) under the safeguards it documents.

Retention periods

• Account: as long as it exists; it is anonymized when deleted.
• Sign-up whose address was never confirmed: 30 days, then deleted with its organization.
• Sessions and sign-in journal: 30 days.
• Application logs of the server: 30 days.
• Single-use links: until they expire, 1 hour for a password reset, 24 hours for an address check, 7 days for the first password after a purchase.
• Invitations to join an organization: valid 7 days, kept 30 days after they expire.
• Contact and quote requests: 3 years from the request; deleted with the account.
• Commercial consent: until withdrawn or the account is deleted.
• Organization, its accounts, subscriptions, licenses, tickets and downloads: as long as the organization is a customer. One that no longer is (free offer, or subscription ended 3 years ago) and that nobody signed in to for 3 years is deleted with its accounts.
• Invoices and accounting records: 10 years, kept by Ultrametrix in its Stripe account (French Commercial Code, article L123-22).

Cookies

The portal sets no audience-measurement or advertising cookie. Its only cookies are needed for the service, so they need no consent:

• the session cookie, for the time you are signed in (12 hours at most);
• the device cookie, which recognizes a device already used so as to warn you of a sign-in from a new one (about 13 months);
• the language cookie, which keeps your choice between French and English.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent and, under French law, to set directives for your data after your death.

From your space ("Your data"), you download a full copy of your data in a machine-readable format and you delete your account. For any other request, write to contact@ultrametrix.fr: we answer within one month.

You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Security

Encrypted connections, passwords kept as a bcrypt hash and checked against breached-password lists, two-factor authentication by app, revocable sessions and progressive lockout after failed sign-ins.

For the breached-password check, the Pwned Passwords service only receives the first five characters of a SHA-1 hash of the password: neither the password, nor your address, nor any personal data.

Changes

This policy carries a version date. Any significant change is announced to account holders.