Privacy Policy
GSE-Web is committed to protecting your personal data and respecting your privacy
Who are we?
The addresses of our websites are: xlexe.com, gse-web.xlexe.com, www.gse-web.online, kls-concept.com.
Legal information
KLS-Concept is the trade name of Frédéric KULAS, Entrepreneur Individuel (EI), registered with the Trade and Companies Register of Alençon under number SIREN 817 714 660, whose establishment is located at 4 chemin du binai, 61300 Crulai (Orne, France). Data controller and contact for any question relating to personal data: contact@kls-concept.com.
Personal data is hosted in France. Our hosting provider is OVH SAS (2 rue Kellermann, 59100 Roubaix, France 🇫🇷): the entire GSE-Web infrastructure (shared and dedicated virtual private servers, databases, application, files and images, billing data, technical logs) is hosted on servers located in France, with an encrypted copy of the backups kept in France on a server self-hosted by KLS-Concept. The kls-concept.com website and its forms are hosted by PlanetHoster (France 🇫🇷, phone +33 1 76 60 41 43), with whom the domain name is registered (Canada), without any processing of personal data other than that entered in the website forms. No data is transferred to a third country that does not provide an adequate level of protection.
To provide its services, KLS-Concept also uses the following sub-processors, each for the purpose indicated: Stripe (bank card payment processing — EU/USA, certified for transfers), Tiime (invoicing and accounting — France), Acumbamail (sending of transactional and informational emails — EU), TidyCal (appointment booking), Vbout (marketing automation and management of prospect contacts). An independent technical provider also acts as a sub-processor for the maintenance of the application backend. Each of these sub-processors accesses only the data strictly necessary for its task.
Use of collected personal data
Comments
When you leave a comment on the website, the form data, your IP address and the browser user agent are collected to detect spam comments.
An anonymised string created from your email address (hash) may be sent to the Gravatar service to verify your usage. The Gravatar privacy terms are available here: automattic.com/privacy. After validation, your profile picture will be publicly visible next to your comment.
Media
Registered users should avoid uploading images containing EXIF GPS location data. Visitors can download and extract location data from these images.
Cookies
Comments
If you leave a comment, you will be offered to save your name, email address and website in cookies for your convenience. These cookies expire after one year.
Login
A temporary cookie will be created on the login page to determine if your browser accepts cookies. It does not contain personal data and will be deleted when you close your browser.
When you log in, several cookies record your login information and screen preferences. A login cookie has a lifespan of two days; a screen-option cookie has a lifespan of one year. If you select "Remember me", your login cookie will be kept for two weeks. Logging out clears the login cookie.
Posts
When editing or publishing a post, an additional cookie will be saved. This cookie does not contain any personal data, it simply indicates the ID of the post being edited and expires after one day.
Embedded content from other websites
Articles may include embedded content (videos, images, posts…). Embedded content behaves as if the visitor were on that other website.
These websites may collect data, use cookies, embed third-party tracking tools and monitor your interactions if you have a connected account.
Mobile app
Camera
The mobile app uses your device's camera to scan barcodes and QR codes on products and locations. Images are neither stored nor transmitted: they are processed locally, for the time it takes to read the code.
Offline storage
To let you keep working without an internet connection, the app temporarily keeps a local copy of certain data on your device (products, stock, movements awaiting upload). This local data is synchronised with the server as soon as the connection is restored, and is deleted along with the app.
Device identifier
A technical identifier of your device may be used for connection security (detecting abnormal use) and to send notifications. It is not used for advertising purposes.
Notifications
With your permission, the app can send you notifications related to your activity (stock alerts, reminders). You can disable them at any time in your device's or the app's settings.
Use and transmission of your personal data
How long your data is stored
Account data (last name, first name, email, username) is kept for as long as your organisation uses the service. Educational activity data is kept for the duration of the relevant schooling, then deleted or anonymised. At the end of the contract, the data is returned and then deleted, except where a legal obligation applies (invoices kept for 10 years).
Technical logs are kept for limited periods: 7 days (local), 30 days (development) and 90 days for critical errors only, then anonymised. Registered users can view and edit their profile information; authorised managers of the organisation can also view and edit it.
Your rights over your data
If you have an account or have left comments, you can request a file containing all your personal data, including the data you have provided. You can also request the deletion of your data. This does not apply to data stored for administrative, legal or security purposes.
To delete your GSE-Web account and all your data, a dedicated page explains how: Delete my account and my data.
Transmission of your personal data
Comments may be checked through an automated spam detection service.
We do not transfer or sell any personal data of our visitors, customers and users to third parties.
KLS-Concept undertakes to protect its customers' data and processes it in compliance with Regulation (EU) 2016/679 (GDPR). Since the GDPR came into force on 25 May 2018, the formality of prior declaration to the CNIL is no longer required: it has been replaced by a principle of accountability and the keeping of an internal record of processing activities.
You may exercise your rights or lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the supervisory authority competent in France.
Purchases made from the App Store or Google Play
When a subscription is purchased within the app via the App Store (Apple) or Google Play (Google), the store concerned acts as the seller and is responsible for billing: it collects and processes itself the data required for payment (payment method, billing, VAT). No banking data passes through KLS-Concept or GSE-Web for these purchases. Apple's and Google's privacy policies apply to this processing.