Beeye Privacy Policy

Who we are and our roles

Solutions Beeye Inc. ("Beeye") is a corporation incorporated in Québec, with its head office at 4335 avenue Charlemagne, Montréal (Québec) H1X 2H2, Canada.

Beeye acts in two distinct roles:

• Controller for the data collected on the Site (forms, cookies, prospecting) and for client relationship management.
• Processor, within the meaning of Article 28 of the GDPR and applicable Canadian privacy laws (PIPEDA, Law 25), for the data our clients entrust to the Platform: in that case, the client firm remains the controller and a data processing agreement attached to the contract governs the processing and prevails over this policy.

Data we collect

On the Site, the contact, demo request and gated content forms may collect: first name, last name, email address, phone number, company name, company size (number of employees) and role. Browsing data is also collected through the cookies described below.

On the Platform, the data processed on behalf of our clients includes:

• users' professional identification data: first name, last name, email address (required), role, team;
• the scheduling, time and capacity data entered or imported by the firm;
• usage data: language, account creation date, last login date, actions performed on the Platform (for support, diagnostics and improvement purposes).

Only the information that is necessary is shared with the third-party tools listed in the Subprocessors section, and access to those tools is strictly limited to Beeye staff who need it for their duties.

Purposes and legal bases

We process your data for the following purposes, each resting on a legal basis:

• Providing the Platform and services (user authentication, support, diagnostics following bug reports): performance of the contract.
• Responding to your requests (demo, contact, chat): pre-contractual measures and legitimate interest.
• Keeping you informed about our offering and product news (business-to-business prospecting): legitimate interest or consent, depending on the jurisdiction, with the ability to unsubscribe at any time.
• Improving our services (usage trends, recommendations, statistics): legitimate interest, based on limited or aggregated data.
• Ensuring security (logging, fraud prevention): legitimate interest and legal obligations.
• Meeting legal obligations (requests from authorities, court orders): legal obligation.

We do not use your data for any other purpose without your prior consent, and we never sell your personal data.

Marketing communications

When you provide your email address through a form, we use it to handle your request and, in compliance with Canada's Anti-Spam Legislation and the GDPR, to send you professional communications related to Beeye. Every email includes an unsubscribe link allowing you to opt out in a few clicks. You can also ask to be removed from any list by writing to info@mybeeye.com, and opt out of remarketing through Google's ad settings and the Network Advertising Initiative.

Hosting and data residency

Platform data is hosted on Microsoft Azure:

• Clients in Europe: hosting exclusively within the European Union (data center in France). No client data is transferred outside the European Union without the client's prior written approval.
• Clients in Canada: hosting in Canada (Québec City data center), with backups in the Toronto data center to ensure continuity in the event of a major incident.
• Clients in the United States: hosting exclusively within the United States, in the hosting region agreed in the contract. No client data is transferred outside the United States without the client's prior written approval.

Any change of hosting region is subject to prior written notice to clients in accordance with their agreement. Data collected on the Site is hosted primarily on HubSpot, in data centers located in the European Union or North America.

International transfers

Remote access to environments by authorized Beeye personnel takes place from Canada, a jurisdiction covered by a European Commission adequacy decision, solely to provide and support the services and within the scope of Beeye's SOC 2 controls. Any other transfer of personal data outside the European Union, or outside Québec and Canada for data subject to those laws, requires appropriate safeguards (including the European Commission's standard contractual clauses and, where applicable, the assessments required by Law 25) and, for client data, the client's prior written approval.

Subprocessors

Beeye requires its subprocessors to implement security and confidentiality measures at least equivalent to its own, formalized through data processing agreements. Beeye remains fully responsible for their acts. Beeye's subprocessors, established in North America or the European Union, are:

• Microsoft Azure: hosting of the Platform and client data, in the agreed hosting region;
• HubSpot: hosting of the Site, client relationship management, communications and chat.

An up-to-date list is available on request. For clients, any addition or replacement of a subprocessor with access to client data is subject to prior notice in accordance with the agreement, with the ability to object on reasonable grounds.

Retention and reversibility

We keep your data only as long as necessary for the purposes described above:

• Prospecting data (Site): kept for the duration of the business or prospective relationship; Beeye regularly deletes data that is no longer needed for a business purpose, a legal obligation, support or security.
• Platform data: kept for the duration of the client's agreement. Upon expiry or termination, an export mechanism in a structured, commonly used and machine-readable format is made available for ninety (90) days, after which the data is returned or deleted, backups included, with a written certificate of destruction on request.
• Deleted or inactive user accounts: the associated personal data is automatically deleted after six (6) months.

Beeye may retain data that has been irreversibly anonymized and no longer constitutes personal data.

Security

Beeye implements appropriate administrative, physical and technical measures to protect your data, at rest and in transit, including:

• encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
• multi-factor authentication or SSO required for administrator accounts and for remote access by Beeye personnel;
• access logging, regular backups and security testing, including an annual penetration test;
• a SOC 2 Type 2 attestation renewed every year by an independent auditor (available under NDA);
• general liability, professional liability and cyber insurance with reputable insurers;
• an information security policy aligned with ISO/IEC 27001/27002, approved by management, regularly reviewed and audited as part of SOC 2, supported by a dedicated confidentiality and security team;
• annual staff security awareness training, with a yearly commitment to comply with internal policies.

No transmission of data over the Internet is entirely secure; we cannot guarantee absolute security, but we are committed to maintaining measures consistent with recognized industry standards.

Incident notification

In the event of a security incident affecting personal data, Beeye undertakes to:

• notify the affected clients without undue delay and no later than forty-eight (48) hours after becoming aware of the incident, with its nature, the approximate categories and volumes of data concerned, the measures taken or proposed and a point of contact, supplemented as information becomes available;
• notify the competent supervisory authorities (for example the CNIL in France, the Commission d'accès à l'information in Québec) and, where required by law, the individuals concerned, within the applicable legal deadlines;
• bear, where the incident is attributable to Beeye, the reasonable investigation and remediation costs, in accordance with client agreements.

Your rights

Depending on your jurisdiction, you have the following rights over your personal data:

• Access and copy: obtain confirmation that data about you is being processed and receive a copy;
• Rectification: have inaccurate or incomplete data corrected;
• Erasure: request the deletion of your data, within the limits set by law;
• Restriction and objection: request the restriction of processing or object to processing based on legitimate interest, including prospecting;
• Portability: receive your data in a structured, commonly used and machine-readable format (GDPR and Law 25);
• Withdrawal of consent: withdraw consent at any time, without retroactive effect.

To exercise these rights, write to security@mybeeye.com. We respond within thirty (30) days. If your request concerns data processed on behalf of a Beeye client firm, we forward it to that client without delay and assist them in responding. You may also lodge a complaint with your supervisory authority: the CNIL in France, the Commission d'accès à l'information in Québec or the Office of the Privacy Commissioner of Canada.

Cookies

The Site uses cookies to operate, remember your preferences and measure its audience. They fall into four categories:

• Strictly necessary cookies: essential to the operation of the Site, they are not subject to consent;
• Functional cookies: they store your preferences and the information you have entered so you are not asked again;
• Analytics cookies: they help us understand how visitors navigate the Site so we can improve its performance;
• Advertising and social cookies: they enable remarketing and content sharing on social networks.

Non-essential cookies are only set with your consent, given through the banner displayed on your first visit. You can withdraw or change your consent at any time via that banner or your browser settings, and you can browse the main pages of the Site without providing any personal data.

Artificial intelligence and data

Beeye may generate and use aggregated, irreversibly anonymized and non-identifiable data to measure performance, improve its services and train its own systems. This data does not identify any firm or individual.

When a client firm chooses to connect its own AI assistant (for example Claude, Microsoft Copilot or ChatGPT) to the Platform, the exchanges made through that assistant pass through the AI provider chosen by the firm, under the contract and terms agreed between the firm and that provider. Beeye does not use its clients' data to train third-party AI models. The use of generative AI tools by Beeye staff is also governed by a dedicated internal acceptable use policy, audited as part of SOC 2, which protects clients' confidential information and intellectual property.

Privacy Officer

In accordance with Québec's Law 25 and the GDPR, Beeye has designated a person in charge of the protection of personal information, who oversees the compliance of processing activities and is your point of contact for any question about this policy or the exercise of your rights: security@mybeeye.com, attention: Privacy Officer.