Information notice on the protection of customer and prospective customer data

Last update: 08/06/2026

As part of the commercial relationship that links you to the SQORUS Group, or that we plan to establish with your organization, personal data concerning you as an individual is collected and processed by the Group: your name, your professional contact details, your function, and the elements associated with commercial and contractual exchanges. The General Data Protection Regulation (GDPR) requires the Group to inform you precisely about such processing.

The present notice meets this obligation. It is brought to your attention by explicit reference in each commercial proposal and contract. It is also permanently accessible at sqorus.com/customer-data-protection.

The notice is written in clear, accessible language. Should you nevertheless find any of the wording difficult to understand, or if you have any questions, please contact the Group’s Data Protection Officer (DPO) at dpo@sqorus.com.

1.1. Identity of the data controller

The person responsible for processing your personal data is :

If the business relationship is contractually carried out by SQORUS Côte d’Ivoire or SQORUS Morocco (and not by SQORUS SAS), the local legal entity acts as data controller for this relationship, in coordination with the Group (see addenda A and B at the end of the notice).

1.2. Contact details of the Data Protection Officer

The SQORUS Group has appointed a Data Protection Officer (DPO) to act as a single point of contact for any questions or requests relating to your data:

1.3. SQORUS Group scope and quality

The SQORUS Group acts both as a data controller (RT) and as a data processor (ST), depending on the situation:

• As data controller, to manage the commercial relationship with your organization: prospecting, contract conclusion and execution, invoicing, marketing communications. Your data processed in this context is covered by the present notice;
• As a subcontractor, when the SQORUS Group conducts a service mission (TMA, integration, Council, training) involving the processing of DCP for which your organization is data controller (for example: data of your employees on which SQORUS intervenes, data of your customers in a database that SQORUS administers). In this case, it is your organization’s notice that applies to data subjects, and the commitments of SQORUS in its capacity as ST are described in section 9 and formalized contractually (article 28 GDPR clauses).

2.1. Overview

This section presents all the processing of your data implemented by SQORUS in the context of the commercial relationship, in its capacity as data controller. Each processing operation is described according to a standardized framework: purpose, legal basis within the meaning of Article 6 of the GDPR, categories of data, retention period.

The legal bases used are mainly :

• The performance of the commercial contract (article 6 §1.b GDPR) – for processing directly linked to the conclusion and performance of the contract;
• The Group’s legitimate interest (Article 6 §1.f GDPR) – for B2B commercial prospecting (admitted by CNIL doctrine for professional contacts), for post-contractual commercial follow-up, for improving the offer. A balance of interests test was carried out for each processing operation;
• Compliance with legal obligations (Article 6 §1.c GDPR) – accounting (10 years), anti-money laundering and anti-corruption (KYC), tax and reporting obligations ;
• Your consent (article 6 §1.a GDPR) – for specific cases such as newsletter registration, the collection of testimonials or customer cases distributed externally, certain cookies not strictly necessary.

The data processed is exclusively professional data: your identity in the context of your activity, your function, your professional contact details, elements of commercial exchanges. No sensitive data within the meaning of Article 9 of the GDPR is requested or processed.

2.2. Sales prospecting and pre-sales activities

Processing sheet n°1 – B2B sales prospecting

2.3. Contract and customer relationship management

Processing sheet no. 2 – Commercial contract management

2.4. HubSpot CRM – centralize sales data

The SQORUS Group uses HubSpot, a CRM (Customer Relationship Management) platform that centralizes sales data: prospects, opportunities, active customers, exchange history and sales action tracking. This tool is the Group’s sales repository.

Processing sheet no. 3 – HubSpot CRM

HubSpot is an American company (Cambridge, MA, USA). Associated transfers outside the EU are governed by the mechanisms described in section 4 (DPF + Standard Contractual Clauses).

2.5. Billing, payment and accounting

Processing sheet n°4 – Billing and accounting

2.6. Marketing communications and events

Processing sheet no. 5 – Marketing communications

All marketing emails include a clear and functional unsubscribe link. You may also exercise your right to object at any time, without giving any reason, by writing to dpo@sqorus.com.

2.7. Monitoring customer satisfaction

Processing sheet no. 6 – Customer satisfaction

3.1. Internal recipients

Within the SQORUS Group, access to your data is strictly limited to people who have a role in the commercial relationship:

• Sales teams (account managers, pre-sales engineers, sales managers) – for prospecting, negotiation and account follow-up;
• The operational teams assigned to your project (project leaders, consultants, team managers) – for the execution of services ;
• Administrative and financial teams – for invoicing, accounting and payment follow-up;
• Marketing department – for communications, subject to respect for your preferences ;
• General Management – for strategic accounts and major decisions;
• The Data Protection Officer (DPO) – for data protection issues.

Intra-group transfers may occur with subsidiaries SQORUS Côte d’Ivoire and SQORUS Maroc when required by the contract or project (coordination of mixed teams, involvement of consultants from subsidiaries). These intra-group transfers are governed by a GDPR intra-group agreement (ACC-GDPR-INTRAGROUPE) incorporating the European Commission’s standard contractual clauses (Decision (EU) 2021/914), guaranteeing a uniform level of protection.

3.2. Subcontractors

The Group relies on subcontractors to provide tools or perform certain services. These subcontractors are selected according to a rigorous procedure (Vendor Security Assessment) and contractually framed by Article 28 GDPR clauses imposing appropriate security and confidentiality measures.

The complete and up-to-date list of subcontractors handling personal data is kept by the DPO and is available on request from dpo@sqorus.com.

3.3. External third-party recipients

Your data may be communicated to external third parties only in the following cases:

• Public and judicial authorities upon formal legal request;
• Group Councils (lawyers, chartered accountants, statutory auditors) within the strict framework of their mission;
• Financing and banking institutions for payment transactions;
• In the event of partial or total divestment of a business or restructuring of the Group, subject to the guarantee of an equivalent level of protection and prior information of the persons concerned.

Your data will never be communicated to external third parties for commercial, advertising or prospecting purposes.

Some processing operations involve transfers to countries outside the European Economic Area. These transfers are governed in accordance with the Group’s transfer policy (POL-GDPR-TRANSFERTS v1.0) :

All additional technical and organizational measures recommended by the EDPS are implemented: state-of-the-art encryption at rest and in transit, pseudonymization when the purpose allows, strict access management.

The length of time we keep your data varies according to the nature of the processing and applicable legal obligations.

Summary :

The Group’s comprehensive retention policy (POL-GDPR-CONSERVATION v2.0) specifies the periods applicable to each category of data and the archiving and deletion mechanisms. It can be consulted on request to the DPO.

You have the following rights over your personal data, as provided for in Articles 15 to 22 of the GDPR:

7.1. Exercise channel

To exercise any of your rights, please send a request to the Group’s Data Protection Officer :

dpo@sqorus.com

To unsubscribe from the newsletter, you can also use the unsubscribe link present in each marketing email. This action is treated as a formal objection within the meaning of Article 21 §2 GDPR.

7.2. Identification

For commercial contacts who have an established relationship with SQORUS, the use of your professional email address is in principle sufficient identification. In case of doubt, or for requests concerning particularly sensitive data, the DPO may request a copy of an identity document; this copy will be deleted within 30 days of the closure of your request.

7.3. Response time

The DPO will reply within one month of receiving your complete request. This deadline may be extended by two months if your request is complex or if the DPO is handling a large number of requests simultaneously. You will be informed of this extension and the reasons for it within the initial one-month period.

7.4. Right to lodge a complaint

If you feel that your rights have not been respected, you can lodge a complaint with the competent supervisory authority:

• For France: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, 75007 Paris – www.cnil.fr ;
• For Côte d’Ivoire: Autorité de Régulation des Télécommunications de Côte d’Ivoire (ARTCI) ;
• For Morocco: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

You also have the right to take legal action before the competent court, in accordance with Article 79 of the GDPR.

Article 22 of the GDPR provides for the data subject’s right not to be subject to a decision based exclusively on automated processing that produces significant legal effects on him or her.

The SQORUS Group does not carry out any processing that meets this qualification in the context of commercial relations:

• No commercial decision (prospect qualification, discount agreement, relationship suspension, etc.) is taken exclusively by automated means;
• Some in-house tools can integrate prioritization or data enrichment functions (for example, HubSpot can offer prospect scoring) – these aids are consultative, and the decision always rests with a human salesperson;
• The Group’s in-house artificial intelligence tools (notably Microsoft 365 Copilot for internal productivity) can be used to prepare sales proposals or communications, but are not a substitute for human decision-making.

This configuration is verified each time a commercial tool is deployed, and is the subject of a Data Protection Impact Analysis (DPIA) when the tool mobilizes a significant AI system.

In the context of numerous services (Third-Party Application Maintenance, integration, Council, training, run), the SQORUS Group processes, on behalf of your organization, personal data for which your organization is the data controller. This typically involves :

• Data relating to your employees (when SQORUS intervenes on an HRIS, an HR tool or an employee workstation);
• Data relating to your customers (when SQORUS uses a CRM, a commercial database or a customer relations platform);
• Business data processed by applications managed by SQORUS.

9.1. Distinguishing responsibilities

In this case, the responsibilities are as follows:

• Your organization is responsible for processing this data – it determines the purposes and means of the processing;
• The SQORUS Group is a processor within the meaning of Article 28 of the GDPR – it processes data on behalf of your organization, within the framework of documented instructions ;
• Data subjects (your employees, customers, etc.) are informed by your organization by means of its own GDPR notice – not by this SQORUS notice.

9.2. Contractual commitments of SQORUS as a subcontractor

In accordance with Article 28 GDPR, the SQORUS Group contractually undertakes to comply with the following obligations (clauses formalized in our customer contracts or in dedicated contractual appendices):

• Process data only on the basis of documented instructions from your organization;
• Guarantee data confidentiality through confidentiality undertakings signed by all authorized SQORUS employees;
• Implement appropriate technical and organizational measures (article 32 GDPR) – security reference framework aligned with ISO 27001 ;
• Obtain your prior authorization, general or specific, before any further subcontracting (in particular: use of the SQORUS Côte d’Ivoire and SQORUS Maroc subsidiaries);
• Assist you in fulfilling your obligations towards the persons concerned (in particular: exercise of rights, notification of violations within 24 hours, contribution to AIPDs);
• To provide you, at your request, with the information needed to demonstrate compliance with Article 28 and to enable audits to be carried out;
• At the end of the contract, return or delete the data according to your instructions.

9.3. Documentary framework applicable on the SQORUS side

The Group’s internal framework for guaranteeing these commitments includes :

• POL-SEC-PSSI v2.0 – Information System Security Policy ;
• POL-GDPR-PRESTATAIRES v1.0 – GDPR policy for service providers (framework for the subcontracting chain) ;
• PRO-GDPR-VIOLATIONS v1.0 – Violation notification procedure (SQORUS ST → RT customer deadline: 24 hours) ;
• PRO-GDPR-RIGHTS v1.0 – Procedure for exercising rights, including the transfer mechanism to the RT customer when a request is made to him.

If you have any questions about SQORUS’ commitments as a subcontractor, please contact the Group DPO: dpo@sqorus.com.

The present notice is subject to change to take account of changes in regulations, developments in the tools used, or the addition or deletion of subcontractors. Information can be obtained as follows:

• Systematic versioning: each modification gives rise to a new numbered version (v1.0 → v1.1 → v2.0 depending on the extent of the modifications) with application date ;
• The current version is permanently accessible at sqorus.com/customer-data-protection;
• Any substantial modification (new processing, new purpose, new major recipient, change in legal basis, significant change in retention period, change in hosting location) is the subject of prior information, by email, to all active commercial contacts in CRM;
• A purely formal modification (typographical correction, update of an external reference with no impact on your rights) is traced in the version history without individual information.

The version applicable to a contractual relationship is that in force on the date the contract is signed, except in the event of subsequent substantial modification, of which you will be informed in the manner described above.

This addendum supplements the main notice for customers and prospects who have a direct contractual relationship with SQORUS Côte d’Ivoire. It specifies applicable local conditions.

A.1 Identity of the contracting entity

Where the business relationship is contractually carried out by SQORUS Côte d’Ivoire, this legal entity is the local data controller. The Group DPO remains your point of contact for any questions relating to data protection, at dpo@sqorus.com.

A.2. Applicable legal framework

The processing of your data is governed simultaneously by :

• Ivorian law no. 2013-450 of June 19, 2013 on the protection of personal data, and its implementing texts;
• The GDPR, when processing involves coordination with the Group in France (intra-group transfers, mixed teams, contacts residing in the EEA).

The competent supervisory authority for Côte d’Ivoire is the Autorité de Régulation des Télécommunications de Côte d’Ivoire (ARTCI). You can lodge a complaint with this authority if you feel that your rights have not been respected.

A.3 Practical details

• The channel for exercising rights remains dpo@sqorus.com (Group DPO). A local SQORUS Côte d’Ivoire representative may be appointed to act as a relay;
• Transfers to France (Group) or outside Africa are governed by the mechanisms provided for by Ivorian law and by European Standard Contractual Clauses accompanied by a Transfer Impact Assessment;
• The terms and conditions described in the main body of the notice apply, with the exception of local legal terms that may differ (particularly in accounting and tax matters).

This addendum supplements the main notice for customers and prospective customers who have a direct contractual relationship with SQORUS Maroc.

B.1 Identity of the contracting entity

When the commercial relationship is contractually carried out by SQORUS Maroc, it is this legal entity that is responsible for local processing. The Group DPO remains your contact at dpo@sqorus.com.

B.2 Applicable legal framework

The processing of your data is governed simultaneously by :

• Moroccan Act No. 09-08 of February 18, 2009 on the protection of individuals with regard to the processing of personal data, and its implementing regulations;
• The GDPR, when processing involves coordination with the Group in France.

The competent supervisory authority for Morocco is the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP). You can lodge a complaint with this authority if you feel that your rights have not been respected.

B.3 Practical details

• The channel for exercising rights remains dpo@sqorus.com (Group DPO). A local SQORUS Maroc representative may be appointed to act as a relay;
• Transfers to France (Group) or outside Africa are governed by the mechanisms set out in law 09-08 (prior authorization or CNDP notification depending on the case) and by European Standard Contractual Clauses accompanied by a Transfer Impact Assessment;
• The terms and conditions described in the body of the notice apply, with the exception of any local legal terms that may differ.

The short disclosures below are intended to be integrated into the various points of commercial collection (commercial proposals, contracts, web forms). They provide condensed information in line with the layered approach recommended by the EDPS (Transparency Guidelines 03/2017).

Version 1 – Clause to be included in the SQORUS commercial contract

To be included in all commercial contracts where SQORUS is the model issuer. To be placed as an end clause or appendix:

Version 2 – Mention for sales proposal and first contact

Version 3 – Mention for contact web form (sqorus.com)

Version 4 – Footer for marketing emails

To be included at the foot of all Group newsletters, event invitations and marketing communications:

Version 5 – Explicit consent for testimonials and case studies

To be used to obtain a customer’s explicit and revocable consent to the publication of a testimonial or customer case mentioning him or her by name: