Privacy
Vigilo helps organisations follow the compliance documents of their suppliers, tenants and partners. This page explains what is processed and why.
Who is responsible
The organisation that asked you for a document decides how your data is used: it is the data controller. Vigilo acts on its behalf (processor). For Vigilo user accounts, Vigilo is the controller.
Data processed
Identity (name, company, registration numbers), contact details (email, phone, address), documents you upload and their validity dates, messages exchanged, reminders sent and the date the link you received was last opened (shown to the organisation as proof of its request, no tracking pixel), activity log (date, action). For Vigilo users who sign in through their organisation's single sign-on: the identifier sent by its identity provider.
A third party's company number (SIREN, SIRET, VAT number) may be checked against public registers: “Recherche d'entreprises” (DINUM, Insee's Sirene data) for France and VIES (European Commission) for VAT, at the organisation's request or periodically according to its setting. Only the number and the country are sent; the status and the name the register publishes are kept with the third party's record until its erasure.
Purposes
Requesting, receiving and checking compliance documents, reminding you before they expire, keeping proof of these exchanges.
Legal basis
The organisation's legitimate interest in following its compliance obligations, or performance of the contract between you and it. No profiling, no resale of data.
Retention
For as long as the relationship with the organisation lasts, then for the period it has set (36 months by default, between 12 and 120 months). At the end of that period, the organisation is asked to erase your data. You can also ask it to erase them; it may refuse where keeping them is still necessary to comply with a legal obligation or to establish, exercise or defend legal claims, and it then tells you why within one month. The activity log keeps sign-ins for 12 months, changes of rights and access for 3 years, other actions for 5 years; your data in it is anonymised when your data is erased. Erased data disappears from backups within 14 days. An anonymous trace of the exchanges is kept as proof. A retention hold (dispute, inspection, inquiry) extends the log's retention while it is active: for actions when it covers a third party or a requirement, for the whole log, sign-ins and IP addresses included, when it covers the whole organisation.
The content of the emails sent to you stays readable for the period set by the organisation (6 years by default, between 1 and 10 years); after that only their date, type, status and fingerprint are kept.
Vigilo account: a sign-up never confirmed by the link received is deleted, with its workspace, 7 days later. Seven days after a trial ends without a subscription, the organization becomes read-only; it is closed 30 days later and its data deleted 90 days after the closure. A confirmed sign-up that the Vigilo team has not opened is closed 7 days later, then deleted 90 days after that.
Server logs
For security, every request to Vigilo's servers is logged: IP address, date and time, page requested (without the secret part of links) and browser. This log is kept for 6 months, then deleted. To limit repeated emails, a keyed hash of an address that receives an invitation, a forwarded request, a password reset link, an address confirmation link or a sign-up attempt notice is kept for at most 48 hours, never the address itself; for these two links, a keyed hash of the address combined with the IP address of the request is kept too. The answer to a request from the organisation's software sent with an idempotency key is kept encrypted for at most 48 hours, so that a repeated request is not run twice.
A request coming from a Vigilo page also keeps the address of that page, masked the same way.
The server's services (SFTP access, database, antivirus, web proxy) record their errors without the secret part of links, as well as the IP address of each SFTP connection; these records are deleted after 60 days at most.
Processors
Sub-processors that may process customer data. Any addition is announced to the organizations' owners 30 days ahead, with a right to object. Documents of a type protected by a code or holding health data are never sent to an AI; documents that name employees only if the organization has chosen it. Documents sent to an AI may show the names of the people who sign an inspection report (inspector, technician) and their certificate numbers; the AI is never asked for these values.
| Sub-processor | Processing | Location and safeguards |
|---|---|---|
| IONOS SE | Servers, uploaded files, encrypted backups | European Union |
| Sendinblue SAS (Brevo) | Sending reminders and notifications | European Union |
| Google LLC | Reading difficult documents and suggested translation of compliance types (Gemini API, paid tier, no training) | United States and countries of its facilities: EU–US Data Privacy Framework, standard contractual clauses, UK and Swiss addenda |
| Anthropic PBC | Reading difficult documents and suggested translation of compliance types when Gemini fails (Claude API, no training) | United States: standard contractual clauses, UK and Swiss addenda |
Your rights
Access, rectification, erasure, portability, objection: contact the organisation that reached out to you. It has Vigilo tools to export or erase your data. You may also contact your data protection authority.
If you have a Vigilo account: you can download your data and delete your account from your preferences. Deletion erases your name, your email address and the IP address of your sign-ins and actions; the IP address remains only on the entry that proves the deletion (12 months) and during a retention hold decided by an organization.