Privacy Policy

Vitru'home. In the context of this privacy policy, Vitru'home is the controller of your personal data. This means that Vitru'home is the entity that decides how and why your personal data is collected and used.

Who we are. Vitruhome, a French simplified joint-stock company (société par actions simplifiée) with share capital of 1,000 euros, registered with the Trade and Companies Register (RCS) of Salon-de-Provence under number 994 224 715, whose registered office is at 16 rue du Citis, 13140 Miramas, France (hereinafter “Vitru'home”, “we” or “our company”), is represented by Maxime Gilquin as Publication Director. Vitru'home is the trade name under which Vitruhome operates its platform.

How to contact us. By email at team@vitruhome.com, or by post at the address above.

Data Protection Officer (DPO). Following an analysis carried out with regard to Article 37(1) of the GDPR and the WP243 guidelines endorsed by the European Data Protection Board (“EDPB”), Vitru'home is not legally required to appoint a DPO:

• Art. 37(1)(a): Vitru'home is not a public authority or body.
• Art. 37(1)(b): Vitru'home's core activities do not consist of “regular and systematic monitoring of data subjects on a large scale”, within the meaning of the WP243 criteria (number of data subjects concerned, volume and range of data, duration and permanence of the processing, geographical extent). Vitru'home operates a B2B platform intended for AMOs (owner's project consultants) and professionals in the environmental certification of buildings, with a limited customer base and processing restricted to the data strictly necessary to provide the service.
• Art. 37(1)(c): Vitru'home does not process on a large scale special categories of data within the meaning of Article 9 of the GDPR (racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation, etc.) or data relating to criminal convictions (Art. 10).

This analysis is reassessed whenever our processing changes materially (number of customers, new features, new categories of data). Should the thresholds of Article 37 be crossed, Vitru'home would appoint a DPO without delay and update this policy.

Privacy contact. For any question relating to the protection of your personal data, or to exercise your rights, write to team@vitruhome.com. We will reply within one month at most, in accordance with Article 12(3) of the GDPR.

We keep your personal data only for as long as necessary for the purposes described in section 3 of this policy.

We may keep data for longer where required by law or in connection with a dispute or legal proceedings. During the archiving period, the categories concerned are not accessed by any member of our team, except to fulfil our legal obligations or in the event of litigation (for example, to recover an unpaid invoice). Once the statutory periods have expired, this data is deleted or irreversibly anonymised.

We do not sell, trade or rent your personal data. We may share it with the following parties, only to the extent that they need access to it to perform their tasks:

• ●Members of our team. Authorised members of our teams (product, engineering, support, accounting) who need access to carry out their tasks, subject to internal confidentiality and security rules.
• ●Certification bodies. When a user requests it from their workspace, we send the project's compliance file to the certification body concerned (for example Certivéa): identification and address of the operation, verdicts per criterion and their justification, excerpts from the project documents cited in support, and references of the documents concerned. This transmission is triggered by an action of the user, never automatically. The certification body is a recipient of this data and processes it under its own responsibility, to examine the certification application.
• ●Financial institutions. Banks and payment service providers (Stripe), for the purposes of payment processing and debt collection.
• ●Regulatory and public authorities. The CNIL (French data protection authority), tax administrations, competent judicial or administrative authorities, upon lawful request and strictly to the extent required by law.
• ●Legal and professional services. Where applicable, competent courts, mediators, chartered accountants, statutory auditors, lawyers, bailiffs (commissaires de justice) and debt collection agencies.

In addition, we may share all or part of your personal data with our technical processors. Before engaging a processor, we carry out the necessary checks to ensure that it meets our confidentiality and security requirements, and we sign with it a data processing agreement compliant with Article 28 of the GDPR. Our main processors are listed below.

We give priority to providers established in the European Union. Our main databases and our document storage are hosted in the Paris region (AWS eu-west-3), as is our document conversion processing. Our artificial intelligence processing goes through Vercel AI Gateway with inference pinned to the European Union zone.

Where, for functional reasons, certain providers are established outside the European Economic Area (EEA, i.e. the European Union plus Iceland, Liechtenstein and Norway), in particular in the United States, transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR:

• ●Standard contractual clauses (SCCs) adopted by the European Commission (Decision 2021/914)
• ●EU-US Data Privacy Framework certification for eligible US providers
• ●Supplementary technical and organisational measures: encryption in transit (TLS 1.2+), encryption at rest, logical segregation, pseudonymisation where possible

We systematically attach the most recent version of the Standard Contractual Clauses to our data processing agreements with the providers concerned.

In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

• ●Right of access: obtain confirmation that your data is being processed and receive a copy of it.
• ●Right to rectification: correct inaccurate or incomplete data.
• ●Right to erasure: request the deletion of your data, subject to statutory retention obligations.
• ●Right to restriction: temporarily freeze the processing.
• ●Right to data portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• ●Right to object: object to processing based on legitimate interest.
• ●Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• ●Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR): Vitru'home does not use profiling or solely automated decision-making producing legal or similarly significant effects.
• ●Post-mortem instructions: concerning the retention, erasure and communication of your data after your death (Art. 85 of the French Data Protection Act).

You can exercise these rights:

• ●directly from your personal workspace (“Account settings” section): editing your profile, exporting your data, deleting your account;
• ●by email at team@vitruhome.com;
• ●by post to Vitru'home, for the attention of the team in charge of data protection, 16 rue du Citis, 13140 Miramas, France.

Proof of identity may be requested where there is reasonable doubt as to your identity. We undertake to respond within one month at most of receipt of a complete request, which may be extended by two months where the request is particularly complex (Art. 12(3) GDPR).

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL, the French data protection authority), www.cnil.fr/fr/plaintes.

Vitru'home integrates several artificial intelligence systems for the conversational assistant, document analysis, computer vision and automated site analyses.

• ●The models used are provided by Google (Gemini) or Anthropic (Claude), called through Vercel AI Gateway with inference pinned to the European Union zone and zero retention requested on every call.
• ●Your data and documents are not used to train the models of third-party providers, nor by Vitru'home.
• ●The answers generated may contain errors, inaccuracies or hallucinations; they are a decision-support aid and do not replace the judgement of a qualified professional.
• ●You can delete your conversations and uploaded documents at any time from your personal workspace.

The AI systems deployed, the models used and the obligations applicable under Regulation (EU) 2024/1689 (the “AI Act”) are set out in our AI Charter.

This privacy policy may be amended at any time to reflect changes in our services, our legal obligations or our processors.

In the event of a substantial change, we will inform you by email and/or by a visible notification on the platform at least thirty (30) days before it takes effect. The date of the last update appears at the bottom of this page.