Your session data stays in Europe, and we collect as little of it as possible.
A session produces little data, but it belongs to your employees. Here, without jargon, is where it lives, for how long, and what we never do with it.
Where the servers are
The platform runs on a dedicated server rented from netcup GmbH, a German company in the Anexia group, headquartered in Karlsruhe. The data centres used are located in Nuremberg and Vienna: access control, video surveillance, redundant power and cooling, and staff bound by confidentiality.
Session data is stored on these servers, in the European Union. Emails related to sessions (invitations, session preparation, D+7 and D+30 reminders) go through Resend, our email delivery provider. If a participant has accepted notifications on their phone, and only then, their reminders travel through their browser's notification service: Google for Chrome and Android, Apple for Safari and the iPhone, Mozilla for Firefox, Microsoft for Edge. These services only carry encrypted messages, which they cannot read. Exchanges between the phones, the screen and the server are encrypted over HTTPS.
What we collect for a session
- Each participant's first name, and their status (new hire or long-standing employee) if the programme asks for it.
- Their answers, votes, proposals and estimates, per card, and the team names entered in the room.
- Their answers to the D+7 and D+30 reminders: a few questions, linked to their card.
- Their browser's notification subscription, if they turn on notifications on their phone: it is used only to send them their D+7 and D+30 questions, and it is deleted along with the session data.
- The content provided by the company to personalise the programme: names, job titles and photos of the people featured.
- The name and email address of the people invited from the client area (the facilitator, employees): they are used only to send them the invitation and, for employees, their personal session link and then their D+7 and D+30 questions. Anyone can stop these reminders in one click.
- A technical identifier per card, to reconnect the phone if the Wi-Fi drops; the first name entered is kept in the phone's browser, for as long as the tab is open.
What we don’t collect
- No account to create and no password for participants.
- No app installed, so no access to the phone’s contacts, photos or location.
- No advertising trackers, no selling of data; our only service providers are our hosting provider and our e-mail delivery service (see below). Notifications go through the notification service of the participant's own browser, not through a provider of ours.
- Votes and contributions that a programme designates as “anonymous” really are anonymous: they are not linked to any phone.
How long
Session data (participants' first names, answers, votes and team names; the names, job titles and photos of the people featured in the programme; the names and email addresses of the people invited) is deleted from our servers, backups included, no later than 60 days after the session. If the session does not take place, it is deleted no later than six months after the scheduled date or, if later, after the order was last modified. The company's client area keeps only anonymous totals: participation, progress, retention. The company can request earlier deletion, which is carried out within three working days.
One instance per client
Each company has its own instance, on its own subdomain. Two clients’ data never mix, neither on screen nor on the server.
Job applications
When you apply for a job or send a speculative application from corporatesolutions.live/carrieres, Corporate Solutions is the controller of this data.
- Purpose: to review your application and reply to you. A speculative application may be reviewed again when a position opens.
- Data: your name, email, message and CV, the position applied for, your phone number and LinkedIn or portfolio link if you provide them, the date sent and the IP address (to limit abusive submissions).
- Access: only the recruitment team can view them, from a protected area. Your CV is stored on our servers in the European Union, outside the public website, and is never published or shared with third parties. The new-application notice emailed to the team does not include the CV.
- Retention: 24 months after submission, then automatic deletion, CV included.
- Your rights: access, rectification and deletion at any time, on simple request to contact@corporatesolutions.live.
Audience measurement
To count visits to the site and to client instances, we read the logs of our own server: no cookies, no third-party tools. The IP address is truncated before anything is recorded and is never kept in full; a visitor is recognised only on the same day, through a fingerprint computed with a key that changes every day. Visit details are deleted after 60 days; only daily totals remain.
Requests, follow-up e-mails and news
Who is responsible. For requests sent from this site, follow-up e-mails and our news, Corporate Solutions (IKIGAI SARL, RNE 1614612T, Immeuble Inès, 3e étage, A3-1, Centre Urbain Nord, 1082 El Menzah, Tunis) is the data controller. This is not the case for your session data, for which we act on behalf of your company.
What we do, and on what basis. We use your request to reply to you: that is what you ask of us when you send the form. We send you follow-up e-mails only if you have ticked the box provided: five at most, within the two months following your request, tailored to your sector, and never before we have replied to you. They stop as soon as you place an order, unsubscribe or ask us to stop. We send you our news and offers only if you have asked for them and confirmed by e-mail or in your client area: two e-mails a month at most. For each address, we keep its origin (the form, your client area or our exchange) and the exact wording of your consent.
What we measure. Our e-mails contain no tracking pixel. Our delivery provider tells us whether a message was delivered, rejected or marked as spam. When you click a link, our server counts that click, for that link and that e-mail, without recording it under your name, then redirects you; nothing is stored in your browser. To find out whether our e-mails are useful, we also count, as totals, the orders placed within 30 days of an e-mail.
Service provider. Our e-mails are sent by Resend (Resend, Inc., United States). As the company is established in the United States, this service may involve a transfer of data outside Tunisia and the European Union.
Retention periods. Sending records: anonymised after 24 months; the details of a newsletter and the delivery notices from our provider (delivered, bounced, complaint), after 58 days. Subscription: for as long as you remain subscribed. After you unsubscribe, your name and address are deleted from our mailing files within 30 days. Unconfirmed address: deleted after 30 days. Opt-out list: so that we never write to you again, we keep, with no time limit, a fingerprint of your address, computed with a secret key and from which the address cannot be read, and its masked form (a***@example.com).
Your rights. Every follow-up e-mail and every newsletter contains a one-click unsubscribe link. You can also ask for access to your data, its rectification or its erasure, and object to our e-mails at any time: write to contact@corporatesolutions.live or call +216 52 084 285. We reply within 30 days.
Your rights
For session data, Corporate Solutions acts as a processor on behalf of the client company, which remains the data controller. A data processing agreement can be signed with each client on request. Any question or request for access, rectification or erasure can be sent to contact@corporatesolutions.live.
For requests sent from this site, follow-up e-mails and our news, Corporate Solutions is the data controller: see Requests, follow-up e-mails and news.
Applicable legal framework
This Policy is established in accordance with:
- Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data (Tunisia);
- Regulation (EU) 2016/679 of the European Parliament (GDPR), applicable to processing concerning residents of the European Union;
- Directive (EU) 2022/2555 (NIS 2) on cybersecurity;
- the Data Act (Regulation (EU) 2023/2854).