Privacy policy

Ediware, in its capacity as data controller within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and of French Act no. 78-17 of 6 January 1978 as amended (“Informatique et Libertés”), undertakes to protect the information concerning you as well as possible and to comply with the applicable European and French regulations.

The protection of personal data, at the heart of our concerns, is a major condition of the trust placed in us by our clients and prospects as well as our partners.

1. Scope of application

The purpose of this policy is to explain how we use your personal data on the sites ediware.eu and www.ediware.eu (hereinafter the “websites”) as well as on the MDWorks platform, accessible at www.mdworks.fr and its aliases (hereinafter the “Platform”).

It applies to all processing carried out by Ediware, as data controller, on the personal data of clients or prospects. It aims to inform you, in accordance with the regulations, about our practices concerning the collection, use and sharing of the personal information provided through our websites and the Platform.

You may be a visitor to our sites, a prospect, or a natural person using the Platform on behalf of an Ediware client (hereinafter the “User”, in the sense given to that term by the Terms of Use and Sale).

If you have received a message (email, SMS, rich message or voice message) sent through the Platform by one of our clients, or if you have filled in a form on an online page created by one of our clients, your situation is described in section 5: for those processing operations, Ediware acts as a processor and the client concerned is the data controller.

2. Collection of personal data

Personal data is information relating to a natural person who can be identified, directly or indirectly.

By using our websites, in particular by accepting the installation of cookies or by using our contact forms, you may be led to transmit personal data to us such as:

• for our commercial prospecting: company name, your name, your business telephone number, your contact email;
• for your registration to the emailing or dataprospect demonstration accounts: company name, your name, your business telephone number, your contact email;
• for your definitive subscription to our services: company name, your name, your business telephone number, the users' contact email, as well as the login credentials.

By using the Platform, the following data is collected:

• on opening the account: surname, first name and email address of each User;
• on login and use: connection and usage data, including the IP address, the timestamp and the user agent;
• in respect of the profile: where applicable, an address and a telephone number;
• in respect of payment: the bank details (IBAN) needed to execute a SEPA direct debit mandate (see section 4);
• in respect of security: a history of the actions carried out by the logged-in User.

We may collect your data at various moments in your relationship with Ediware, and in particular when you visit our websites, which may use cookies or other trackers. Where certain data is indispensable for us to perform your contract, or to meet a legal or regulatory obligation, we tell you so at the point of collection (generally with an asterisk).

3. Processing, legal bases and retention periods

Processing is an operation or a set of operations carried out by automated or non-automated means and applied to personal data. We process your data for a lawful and legitimate purpose, justified either by the performance of a contract, or by your consent, or by compliance with one or more legal obligations, or by our legitimate interest or that of a third party.

3.1 Processing linked to the websites and to prospecting

• Carrying out commercial prospecting operations: processing based on our legitimate interest in promoting our services; you have been informed of it, you may object at any time, and we do not keep this information for more than two (2) years after our last exchange with you.
• Responding to your requests for information and contact made on our sites: processing necessary for pre-contractual measures with a view to entering into a contract, or for pursuing our legitimate interest in communicating with you by answering a request from you. If a contract is entered into, the data is kept for the whole duration of the contractual relationship, then archived for five (5) years in line with limitation periods, and finally destroyed; if no contract is entered into, it is kept until our last contact with you in the context of commercial prospecting.
• Management of our sites and internal technical operations (problem solving, data analysis, testing, research, studies): processing based on our legitimate interest in improving the functionality of our sites and your browsing. The corresponding data is kept for one (1) year at most.

3.2 Processing linked to the Platform

In the event of judicial or administrative proceedings, your data is kept for the time needed to resolve them.

4. Payments

Card payments are handled by a payment services provider. Ediware neither collects nor stores any bank card data.

For payments by direct debit, Ediware keeps the bank details (IBAN) needed to execute the SEPA direct debit mandate.

5. You have received a message or filled in a form from one of our clients

Messages sent through the Platform are sent by our clients, from their own contact files. For those processing operations, the sending client is the sole data controller; Ediware acts as a processor, on that client's instructions, under the terms of a Data Processing Agreement.

The data concerned is the contact data imported by the sending client and the behavioural data associated with the campaigns, such as opens, clicks and unsubscribes. Ediware does not use it on its own behalf, apart from the processing expressly authorised by the client in the Data Processing Agreement.

To exercise your rights over this data (access, rectification, erasure, objection), contact the sender of the message, identified in the message received. Each message also contains an unsubscribe link. Requests we receive directly are passed on without delay to the client concerned, the sole data controller.

Online pages and forms created by our clients through the Platform follow the same regime: the client publishing the page is the sole controller of the data you enter there, and Ediware processes it as a processor, on their instructions. To exercise your rights, contact the publisher of the page, identified on it; requests we receive directly are passed on to them without delay.

Campaigns and the associated data are kept, by default, until the sending client's account is closed, then deleted within three (3) months, subject to the client's instructions under the Data Processing Agreement.

6. Recipients of the personal data

In the course of our activities, we may call on service providers or suppliers, to whom we may give access to data or transmit data, solely for the needs of their assignment and in accordance with our agreements with them.

Some of these partners are processors within the meaning of the GDPR, since they carry out this processing on our behalf. We ensure by contract that they act only on our instructions, that they implement appropriate technical and organisational measures meeting the requirements of the GDPR and guaranteeing the protection of your rights, and that they do not use your data for purposes other than those provided for:

• IT services necessary for the proper operation of the sites and of the Platform (database management, hosting, storage, maintenance);
• hosting services located in France, necessary for storing your data;
• User support services;
• payment services (see section 4).

In addition, when a client activates a connector or an integration between the Platform and a third-party service, the data strictly necessary for that integration to work is transmitted to that service, on the instruction and under the responsibility of that client.

The list of sub-processors involved with the data can be obtained on written request sent to dpo@ediware.net.

The conditions relating to the personal data processing carried out by these providers and to the rights you have in that respect are, unless expressly stated otherwise, the same as those described in this policy.

In accordance with the legislative provisions in force, your personal data may be communicated to any administrative or judicial authority empowered by law that requests it.

7. Transfer outside the European Union

We do not transmit your personal data outside the European Union.

8. Data protection

We ensure that your data is processed in a way that guarantees an appropriate level of security through the implementation of technical and organisational measures.

Ediware follows a “Privacy by Design” approach: for any processing of personal data, we take data protection into account through technical and organisational measures suited to the processing concerned.

9. Your rights

In respect of the protection of your data, you have the following rights:

• right of access;
• right to rectification;
• right to object;
• right to erasure;
• right to portability;
• right to restriction of processing;
• right to lay down directives concerning the retention, erasure and communication of your personal data after your death;
• right to lodge a complaint with a supervisory authority (in France, the CNIL) should we fail to respond appropriately to your requests.

These rights may be exercised at any time, subject to certain conditions. We will do our best to meet your request as quickly as possible, and at the latest within one month in accordance with article 12 of the GDPR.

You may exercise your rights by post or by email addressed to Ediware, Data Protection Officer, 46B avenue du Maine, 75015 Paris, or dpo@ediware.net.

To ensure your request is handled quickly and correctly, please give your surname and first name as well as a contact address. Proof of identity may be requested if there is reasonable doubt about your identity, in particular in order to protect you against identity theft.

If you are the recipient of a message sent through the Platform by one of our clients, please refer to section 5: your requests fall to the sending client, the sole data controller.

10. Updates to this policy

Our personal data protection policy may be amended and updated at any time. In the event of an amendment or update, the revised policy is published on the websites, stating its version and its date of entry into force. With regard to Platform clients, changes to the conditions described in this policy are additionally notified under the terms provided for by the Terms of Use and Sale.

This version 2.0 comes into force on 8 August 2026.

11. Cookie management policy

When you use the sites www.ediware.net, www.ediware.eu, ressources.ediware.net and help.ediware.net, or the Platform, cookies or other trackers may be placed on your device. Cookies make it possible, for the duration of their validity, to identify your device on its next visits.

Ediware places no audience measurement or advertising cookies on its sites, and the site www.ediware.eu places no cookie at all. The only trackers subject to your consent are those of third-party services embedded in some pages: the YouTube and Vimeo video players of the documentation pages, and the TidyCal appointment calendar on the contact page of www.ediware.net. We use the Tarteaucitron consent manager to collect and store your choice. Only the issuer of a cookie is able to read or modify the information it contains.

What is a cookie?

It is a text file placed on a device when a site is visited or an advertisement is viewed. The purpose of a cookie is in particular to collect information about the user's browsing and to send them personalised services and content.

Identifying cookies

There are different types of cookie:

• Third-party cookies and first-party cookies: a cookie is said to be “first-party” or “third-party” depending on the domain it comes from. First-party cookies are those installed by the site the user is visiting. Third-party cookies are installed by a domain other than that of the site visited; when a user visits a site and another entity installs a cookie through that site, that cookie is a third-party cookie.
• Session cookies: they make it possible to follow a user's actions for the duration of a browsing session, which begins when the browser window opens and ends when it closes. They are temporary and are deleted when the browser is closed.
• Persistent cookies: they remain on the user's device after the session closes, for the period set by each of them, and are activated each time the user visits the site that generated them.

The trackers used on our sites and their purposes

Strictly necessary trackers, exempt from consent:

Trackers subject to your consent, placed only on pages that embed the service concerned and only after you agree:

Video players are embedded in enhanced privacy mode (YouTube without cookies, Vimeo with the “Do Not Track” signal). Until you accept, the video or the calendar is replaced by an information box and none of these trackers is placed. The placing and use of these cookies are governed by the privacy policies of Google, Vimeo and TidyCal, which we invite you to read.

How can you manage cookies?

On www.ediware.net, the cookie management icon is shown at the bottom of every page; on the documentation pages that embed a video, a banner lets you accept or refuse the trackers concerned. You can also allow a specific service by clicking the button displayed in its place. Your choice is stored for twelve (12) months and can be changed at any time from that icon. The site www.ediware.eu places no tracker requiring consent and therefore shows no banner.

Refusing has no effect on your browsing, apart from the videos and the calendar concerned not being displayed; a link to the calendar remains available.

If you disable cookies in your browser or delete those already stored, your display preferences and consent choices will be requested again on your next visit.

For further information, you can consult the CNIL website: https://www.cnil.fr/fr/site-web-cookies-et-autres-traceurs.