PeppolCheck.fr privacy notice

English summary

This page is an English-language summary of the French-language politique de confidentialité, which is the authoritative version under French and EU law.

Operator

The data controller is e-invoice.be. Contact for any privacy matter: info@peppolcheck.fr.

What we collect

PeppolCheck.fr is a free public lookup service. Looking up a participant requires no signup, no account, no contact form, and no comments — so we ask for no personal information to use the service. There are two optional exceptions: the newsletter subscription described below, and the listing claim feature described under “Ownership verification of a listing”, which requires a sign-in and the upload of a supporting document.

For simple lookup, the only data we process is anonymous, aggregated traffic telemetry through PostHog (EU region): the URL of the page viewed, interactions with the page (such as views of and clicks on the PeppolCheck.fr banner shown in blog articles, clicks on outbound links, and use of the share buttons), the referrer, an IP-derived country code (the IP itself is not stored in clear), and the parsed User-Agent (browser, OS, device class). We also record the shape of a search (for example “SIREN”, “VAT number” or “name”), the number of results, and the identifier scheme code of the listing viewed. Measurement events contain neither the text you typed, nor a full participant identifier, nor a company name: these are removed from page addresses before they are sent.

For calls to the public API, the MCP server, the /ask endpoint and the documents for agents, we record the type of request, its result, its duration, the country of origin and the family of the calling software (derived from the User-Agent), with no identifier that could link two calls together.

Newsletter. If you subscribe to the newsletter with the form on the home page, we process your email address, together with technical sign-up data (date, originating form and, where applicable, IP-derived country and User-Agent), for the sole purpose of sending you that newsletter. Your email address is passed to the sending provider listed under “Subprocessors”; it is never passed to the traffic analytics tool, which records only the fact that a sign-up took place. You can unsubscribe at any time with the link in each message, or ask for erasure of your data by writing to info@peppolcheck.fr.

The participant data displayed on the site comes from the public OpenPeppol registries (SML, SMP, Directory). It concerns registered businesses on the network and is not personal data about visitors.

Ownership verification of a listing (“claim this listing”)

PeppolCheck.fr lets a company representative claim the public listing of their company so that it shows a “Verified owner” status. This feature is optional and separate from simple lookup.

Purpose. To verify that a person who claims a listing is entitled to represent the company concerned, in order to display a verified-ownership badge and to prevent impersonation.

Legal basis. Legitimate interest of the controller and of the Peppol public (GDPR Art. 6(1)(f)) in a reliable verification badge. A balancing test (legitimate purpose, necessity and minimisation — a single document, reviewed then deleted, reasonable expectation of a person claiming their own company) has been documented internally.

Data processed. Declared name, role and sign-in email address (via Clerk), and the supporting document uploaded (Kbis extract, SIRENE status notice, letter of mandate, or bank/address proof). After the decision, only a verification record is kept: document type, SIREN, reviewer, date, SHA-256 hash of the document, and verified name.

Retention. The supporting document is kept only until the reviewer's decision. On approval, the raw document is deleted promptly and only the verification record is kept. On rejection, the document is deleted within 30 days at most, with a minimal record of the decision. On account deletion or an erasure request, the claimant's active data (stored documents and database rows) is erased immediately, together with the organisation and Clerk account that are no longer used; automatic database backups, which cannot be erased selectively, expire on their own within the retention period (about 30 days for Cloudflare D1 “Time Travel” snapshots). A litigation hold (decision record only, up to 5 years) is applied only where there is a real risk of dispute.

Authentication processor. Identity and sign-in are handled by Clerk, Inc., a US company, acting as a processor under GDPR Art. 28. The resulting transfers to the United States are covered by the EU-US Data Privacy Framework (DPF) and, where needed, by the European Commission's standard contractual clauses. Supporting documents are stored in private Cloudflare R2 storage, with no public URL.

Audience measurement of the claim flow. To measure how well this flow works (steps completed, errors met, time to and outcome of the review), the corresponding events are recorded in PostHog, on the basis of legitimate interest (GDPR Art. 6(1)(f)). When you are signed in, these events are attached to a pseudonymous identifier, derived from your account identifier with a keyed cryptographic function: neither your account identifier, nor your email address, nor your name, nor the identifier of the listing, nor the content of the supporting document is sent to PostHog. This measurement is therefore not anonymous: the site operator is able to link it to your account. It is not matched with your browsing on the rest of the site and is not used for ad profiling. If your browser sends the “Do Not Track” or “Global Privacy Control” signal, the events that come from your own requests are not recorded. The events about the reviewer's decision or about the revocation of a claim are, however, recorded at the time the administrator acts, regardless of that signal. On an erasure request, the pseudonymous identifier and the events attached to it are also deleted from PostHog.

Legal basis

Traffic measurement is performed under the controller's legitimate interest (GDPR Art. 6(1)(f)) to operate and improve the service. For simple lookup it is aggregated and anonymous: no visitor profile is built, and there is no ad-targeting, no cross-site tracking, no matching with other data sources, and no data sales. The measurement specific to the listing claim flow, which uses a pseudonymous identifier, is described under “Ownership verification of a listing”.

The newsletter is sent on the basis of your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time by unsubscribing.

Cookies and tracking

No third-party advertising or social cookies. PostHog traffic is proxied through the site's /ingest path so the browser never contacts a third-party domain. Cookie use is minimised to what is strictly necessary for traffic measurement; the service remains fully usable with cookies blocked.

You can object to this measurement at any time by turning on the “Do Not Track” (DNT) option of your browser, by installing a blocking extension, or by disabling JavaScript for the site. The “Do Not Track” signal is honoured both by the measurement in your browser and by the measurement events that our servers send when they process your own requests; the only exception, which concerns the decision on or the revocation of a claim, is described in the section “Ownership verification of a listing” above.

Subprocessors

• Cloudflare, Inc. — hosting on Cloudflare Workers and edge delivery from EU points of presence.
• PostHog — privacy-friendly traffic analytics, EU-hosted instance.
• Loops (Astrodon Corporation, United States) — management of the subscriber list and sending of the newsletter. Loops receives the email address of newsletter subscribers only. Transfers to the United States are covered by the EU-US Data Privacy Framework (DPF) and, where needed, by the European Commission's standard contractual clauses.
• Clerk, Inc. — authentication, only for the optional listing claim feature.

Retention

Traffic telemetry is retained for up to 12 months, then deleted or irreversibly aggregated. No traffic data is retained beyond that horizon. Newsletter data follows the rules given under “What we collect”, and data from the optional listing claim feature follows the retention rules given under “Ownership verification of a listing”.

Your rights

You have GDPR access, rectification, erasure, restriction, objection, and portability rights. For simple lookup, because traffic data is anonymous, we may not be able to link any record to you, and so may not be able to act on a request about that data (GDPR Art. 11). This limit applies neither to the newsletter, nor to the listing claim, nor to the pseudonymous audience measurement of the claim flow: your rights apply in full there. To exercise rights, write to info@peppolcheck.fr, or file a complaint with the French CNIL.