Legal
Privacy policy
This privacy policy explains how Eviqly ("Eviqly", "we", "us") collects, uses, and protects personal data when you visit eviqly.com (the "Site") or use our assurance services (the "Services"). Eviqly is established in France and acts as a data controller for the personal data described in this policy, except where we process client evidence on a client's instructions, in which case we act as a processor.
1. Data we collect
Site visitors
- Contact details you provide through our contact form or by email: name, company, work email address, and the content of your message.
- Technical data collected automatically by our hosting provider: IP address, browser type, device type, pages visited, and timestamps, used for security and to keep the Site running.
Clients and their personnel
- Account and engagement data: names, roles, and business contact details of client personnel involved in an engagement, including who drafted, confirmed, or reviewed each item.
- Evidence data: reports, policies, system exports, and uploaded documents that a client provides or authorizes us to read for the purpose of an audit. This may incidentally include personal data contained in those records.
2. How we use data
- To respond to enquiries and scope engagements.
- To perform the Services: drafting audit responses, routing gaps to owners, recording confirmations, and producing signed reports.
- To maintain the immutable audit trail and retain signed reports and certificates for six years, as required by the nature of the Services.
- To secure and operate the Site and our systems, including fraud and abuse prevention.
- To comply with legal obligations.
3. Legal bases (GDPR)
We rely on the performance of a contract (or steps taken at your request before entering one), our legitimate interests in operating and securing our business, and compliance with legal obligations. Where we act as a processor for client evidence, the client is responsible for the legal basis of the underlying processing.
4. System access
When a client connects a system, Eviqly uses authenticate-once, read-only credentials scoped to the engagement. We do not write to client systems. Clients can revoke access at any time. Access to client evidence by Eviqly personnel is logged.
5. Sharing
We share personal data only with: (a) accredited professionals engaged by Eviqly to review and sign audit work, who are bound by confidentiality; (b) service providers that host our infrastructure and support our operations under data processing agreements; and (c) authorities where required by law. We do not sell personal data.
6. International transfers
Review and signing of audit work is performed by U.S.-based AAP-accredited professionals. Where personal data is transferred outside the European Economic Area, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. Retention
Enquiry data is kept for up to 24 months after our last contact. Engagement records, signed reports, and certificates are retained for six years from completion of the engagement. Technical logs are retained for up to 12 months.
8. Your rights
Subject to applicable law, you may request access to, rectification or erasure of, or restriction of processing of your personal data, object to processing, and request portability. You may also lodge a complaint with your supervisory authority; in France this is the CNIL. To exercise your rights, contact privacy@eviqly.com. If your data is contained in a client's evidence, we may refer your request to that client.
9. Cookies
The Site uses only strictly necessary technical cookies and does not use advertising or cross-site tracking cookies.
10. Security
We apply technical and organizational measures aligned with SOC 2 Type I expectations, including encryption in transit and at rest, least-privilege access, segregated client environments, and logged access to evidence.
11. Changes
We may update this policy from time to time. The date at the top indicates the latest revision.
12. Contact
Eviqly, France · privacy@eviqly.com