Privacy Policy

Revision date: October 15th, 2026

1. Preamble and Scope

EQOLUX is committed to protecting the confidentiality of the data entrusted to it by users of the EQOLUX platform (the “Platform”). As a France-based company, EQOLUX adheres to the principles set out in the General Data Protection Regulation (“GDPR”) and applicable French data protection laws.

The Platform is a business-to-business service: its customers are companies and other organizations registered on the Platform (the “Members”), and it is not offered to individuals acting in a private or consumer capacity. Using the Platform nevertheless involves personal data, meaning information about identifiable individuals acting in a professional capacity. This Privacy Policy describes that personal data, why it is processed, who receives it, how long it is kept, and the rights of the persons concerned. EQOLUX processes in particular:

• Account data of Members’ users: name, professional email address, sign-in identifiers, the organizations and establishments a user can access, their permissions and interface preferences;
• Professional contact data of suppliers’ staff: names and professional contact details (email address, phone number) of supplier contacts recorded by Members, and those appearing in the purchasing documents (invoices, delivery notes, credit notes) that Members import into the Platform;
• Technical logs: records of the requests made to the Platform and to its AI assistant connector (see section 8), kept for security, support and troubleshooting;
• Website data: information sent through the contact and newsletter forms of the eqolux.com website, conversations with the website’s AI assistant, and website audience statistics.

Roles of EQOLUX. Depending on the processing, EQOLUX acts:

• as a processor, on behalf of each Member, for the data that the Member and its users put into or access through the Platform — purchasing documents, supplier data and the personal data they contain — including through the AI assistant connector. The Member is the controller of that data. The Data Processing Agreement (“DPA”) sets out the terms of this processing;
• as a controller, for the data it needs to run its own business: the management of user accounts and of the relationship with Members, the security of its services, and the data collected through its website.

EQOLUX SAS is a simplified joint-stock company (SAS), with a share capital of €5,425, registered with the RCS of Saint-Malo under number 883 206 146, with headquarters at 37 rue de l’ancienne gare, 22240 Plévenon, France.

2. Types of Data Collected

EQOLUX collects data related to the business identity of Members and to the individuals who act for them or deal with them, such as:

• Company account information: business email and login credentials (passwords are securely hashed and not stored in plain text);
• Corporate profile data: company name, legal status, registration number, VAT number, headquarters address, and general business contact details;
• Representative and contact data: names and professional contact information (email, phone) of authorised persons or legal representatives acting on behalf of the company;
• Order-related data: products purchased, transaction numbers, delivery addresses;
• Purchasing data imported by Members: delivery notes, invoices, credit notes, products, prices and supplier information, including the names and professional contact details of suppliers’ staff that they may contain.

Additional usage data may be collected during use of the Platform, including:

• Interactions between Members;
• Feedback or reviews submitted on the Platform;
• Email tracking related to administrative or order-related notifications;
• Technical logs of the requests made to the Platform and to the AI assistant connector (see section 8).

On the eqolux.com website, EQOLUX collects the data sent through the contact and newsletter forms (name, email address, company, message) and audience statistics through Google Analytics, configured with IP anonymisation.

Website AI assistant. On the eqolux.com website and on the phone line +33 1 62 04 51 05, an AI assistant (“Julia”) answers questions about Eqolux and can book a demo. It processes the content of the conversation (written messages, speech transcribed into text, the page being viewed) and the details the person chooses to give (name, company, role, email address, phone number); on the phone, it also receives the caller’s number. The assistant is provided by our processor ElevenLabs, whose servers are located in the United States (see section 7). Audio is not recorded and transcripts are kept for 90 days. When a demo is booked, the invitation is created in EQOLUX’s Google Workspace calendar and the request is passed on to the EQOLUX team.

EQOLUX does not offer its services to individuals acting in a private or consumer capacity. The Platform does not process any banking data of users, health data, or special categories of data within the meaning of Article 9 of the GDPR.

3. Purposes and Legal Basis

EQOLUX collects this data solely for the purpose of:

• Providing access to the Platform and its features, including the AI assistant connector;
• Facilitating order processing, communication, and payments between business Members;
• Ensuring the security of the Platform and of the AI assistant connector, and providing support;
• Fulfilling legal and contractual obligations;
• Improving service functionality;
• Answering requests sent through the website or to its AI assistant, organising the demos requested, and sending the newsletter to those who subscribed to it.

As a controller, EQOLUX processes data on the basis of the performance of its contract with the Member (provision of the Platform and management of user accounts), its legal obligations, its legitimate interests (security of its services, support, improvement of the Platform, answering business requests) and, for the newsletter, the consent of those who subscribe to it.

Data processed on behalf of a Member is processed only on the Member’s documented instructions, as set out in the DPA. The Member, as controller, determines the purposes and the legal basis of that processing.

4. Recipients of Data

The data collected may be shared with:

• Authorized EQOLUX staff under confidentiality obligations;
• Other business Members, when needed to complete transactions (e.g. delivery address of buyer to seller);
• Subcontractors (e.g. payment providers, hosting services, email platforms) solely to perform technical or support services;
• External professionals (legal, accounting) bound by confidentiality;
• Authorities, in the event of legal or regulatory obligations;
• Potential acquirers, in the case of corporate restructuring.

All third parties are contractually bound to handle data securely and exclusively for the specified purposes. The subcontractors that process data on behalf of Members, their role and the location of processing are listed in Annex 3 of the DPA.

AI assistants that a Member chooses to connect to the Platform receive the results of the requests they make, under the Member’s own agreement with their provider (see section 8).

5. Data Retention

Business data is retained only as long as necessary for operational, contractual, and regulatory compliance purposes. Following this period, it may be archived with restricted access or securely deleted in accordance with our data retention policy. In particular:

• Data processed on behalf of a Member is kept for the term of the Member’s agreement, then deleted or returned as provided in the DPA: active data is deleted within 30 days of the end of the agreement, and backups expire no later than 60 days after it;
• User account data is kept while the account is active, then deleted on the same schedule;
• Logs of the AI assistant connector are kept for 30 days (see section 8);
• Website contact and newsletter data is kept as long as needed to answer the request, or until the person unsubscribes from the newsletter;
• Conversations with the website AI assistant are kept for 90 days by ElevenLabs, without any audio recording; requests passed on to the team follow the previous rule.

6. Your Rights

Within the conditions and limits set by the GDPR, any person whose personal data is processed has a right of access, rectification and erasure, a right to restrict or object to the processing, and a right to data portability. Under French law, they may also give instructions on what happens to their data after their death. Newsletter subscribers can unsubscribe at any time.

• Data processed on behalf of a Member (for example the contact details of a supplier’s staff, or personal data contained in purchasing documents): the Member is the controller, and requests are best sent to the Member. If EQOLUX receives such a request, it forwards it to the Member concerned and assists the Member in answering it, as provided in the DPA.
• Data for which EQOLUX is the controller (user accounts, website data): requests can be sent directly to EQOLUX. Company representatives may also request updates or corrections to their business profile at any time.

To exercise these rights, contact us:

• By post: EQOLUX SAS, 37 rue de l’ancienne gare, 22240 Plévenon, France
• By email: support@eqolux.com

EQOLUX answers within one month of receiving the request; this period may be extended in the cases provided for by the GDPR. Proof of identity may be requested where there is reasonable doubt about the identity of the person making the request.

Any person who considers that the processing of their personal data does not comply with data protection law may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL, www.cnil.fr), or with the supervisory authority of the EU country where they live or work.

7. Data Hosting and Transfers

EQOLUX hosts data on secure infrastructure both within and outside the European Union. In all cases, data is stored and processed using industry-leading cloud platforms that are ISO/IEC 27001 and SOC 2 Type II certified, ensuring a high standard of data protection, operational integrity, and security controls.

When data is hosted outside the EU, EQOLUX ensures that such transfers are made in full compliance with applicable data protection laws, including the GDPR. This includes the use of appropriate safeguards such as Standard Contractual Clauses (SCCs), where required. The location of each subcontractor is listed in Annex 3 of the DPA.

8. AI Assistant Connector (Claude, ChatGPT, Microsoft 365 Copilot)

Members can connect their own AI assistant — Claude by Anthropic, ChatGPT by OpenAI, or Microsoft 365 Copilot by Microsoft (through the Eqolux agent) — to the Platform through the Eqolux connector (the “Connector”), and ask questions about their purchasing data in a conversation. The Connector is described on the Eqolux for Claude, ChatGPT and Microsoft 365 Copilot page. EQOLUX processes the data that goes through the Connector as a processor on behalf of the Member (see section 1).

• Activated by the Member. The Connector is only used when a user installs it in their AI assistant and signs in with their Eqolux account. Sign-in goes through our identity provider (WorkOS), which shares the user’s identifier, name and email address with EQOLUX.
• Read-only, with the user’s permissions. The Connector can only read data. Each request is limited to the organizations, establishments, suppliers, documents and product categories the signed-in user can access on the Platform.
• Data sent to the AI assistant. To answer a question, the AI assistant sends requests to the Connector, and EQOLUX returns their results: purchasing data (products, prices, quantities, suppliers, documents, establishments) and, when a question calls for it, the professional contact details recorded on supplier profiles (names, email addresses and phone numbers of suppliers’ staff). EQOLUX does not receive the conversation itself, only the requests the assistant makes; these requests may contain words or values taken from the question, such as a supplier or product name.
• The AI assistant’s provider. The AI assistant is chosen and contracted by the Member: Anthropic for Claude, OpenAI for ChatGPT, Microsoft for Microsoft 365 Copilot. Its provider processes the data it receives, including the results returned by the Connector and the sign-in tokens issued for it, under the Member’s own agreement and settings with that provider, including retention and model training. It is not a subcontractor of EQOLUX.
• Logs. For security, support and troubleshooting, EQOLUX logs each query made through the Connector: the user identifier, the organization identifier, the text of the query (a database query, which may contain values taken from the question), the period requested, the number of rows returned and the duration. Query results are never logged. The hosting platform also keeps standard technical logs of each request to the Connector (time, IP address, user agent, response status) and error messages. These logs are kept for 30 days, then deleted automatically.
• Permission checks. To apply the user’s permissions, the Connector calls the Platform’s backend, operated by our subcontractor Xano under the DPA, which may keep a technical history of these calls, including the user identifier and their access scope, for up to 24 hours.
• Hosting. The Connector server runs on Google Cloud (Cloud Run) in the European Union, in Belgium (europe-west1 region). Its logs are stored in Google Cloud Logging, in Google’s global location, which is not limited to the European Union. The purchasing data the Connector reads is the Platform’s data, hosted as described in section 7 and in the DPA. Google Cloud and Xano are subcontractors listed in Annex 3 of the DPA; transfers outside the EU are covered by the safeguards described in section 7.
• Disconnecting. A user can disconnect the Connector at any time from their AI assistant’s settings, or by removing the Eqolux plugin or agent. A Member can end a user’s access by removing them from its organizations on the Platform.

9. Changes to This Privacy Policy

This Privacy Policy may be updated at any time. The latest version will always be available on the Platform and will indicate the date of last revision.