Privacy Policy (GDPR)

Last updated: April 30, 2026 (version 1.0)

1. Data controller

The data controller is the company using the NDF Service (the "tenant"), i.e. your employer or the company that subscribed to NDF SaaS. NDF SaaS itself, as software publisher, acts as a data processor within the meaning of GDPR Article 28.

2. Data collected

• Identification: name, professional email, position, branch.
• Authentication: hashed password, 2FA factors.
• Expense data: amounts, dates, suppliers, receipts, payment method, analytic projects.
• Vehicle data (if mileage feature): license plate, make, model, registration document.
• Connection data: IP address, user-agent, login dates.
• Technical data: system logs, API requests, session ID.

3. Purposes

To provide the Service per subscription, enable accounting and tax management of expenses, comply with tenant legal obligations (10-year retention), ensure Service security, provide user support.

4. Legal basis

• Performance of the contract between user and tenant (Article 6.1.b).
• Legal obligation of the tenant (accounting/tax) (Article 6.1.c).
• Legitimate interest of the tenant in digitalizing its administration (Article 6.1.f).

5. Recipients

Data is accessible to authorized personnel within the tenant and to NDF SaaS as data processor. No data is sold to third parties.

NDF SaaS subprocessors: OVH (EU hosting), Stripe (payment processing), Google Cloud Vision (OCR, optional), transactional email provider.

6. Retention

• User profile: while account active, then anonymized on deletion.
• Expense reports and receipts: 10 years (French accounting law) then archived and deleted.
• Login logs: 12 months.
• Subscription data (invoices): 10 years.

7. Your rights

• Access: view your data via the "Download my data" button in your profile.
• Rectification: correct inaccurate data directly from your profile.
• Erasure: request account deletion. Anonymization of profile; expense reports retained for the legal duration without identifying data.
• Portability: retrieve your data in structured format (JSON + CSV).
• Objection / restriction: contact your tenant administrator.

You may also lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.

8. Security

TLS encryption, hashed passwords, daily backups, audit trail, logging, EU hosting.

9. Cookies

NDF only uses essential cookies (session, CSRF protection). No tracking, advertising or behavioral cookies are deposited. No consent banner required.

10. Changes

Any modification will require a new acceptance at the next user connection.

11. DPO contact

For any question, contact your tenant's DPO. Your NDF administrator can direct you to the right contact.