LIBERTIFY won the Hong Kong FinTech FastTrack 2023 !​

Privacy Policy

Table of Contents

1. Introduction

1.  The main purpose of this document is to provide you with information about the processing of personal data carried out by Libertify (“Liberty” or “we”) in a concise, transparent, intelligible and easily accessible form, to help you understand how your data are processed.

2. Data are collected fairly and in a transparent manner

2. In order to ensure fair and transparent data collection, we provide information on each processing operation we carry out by means of information notices.

3. Data are collected fairly. No data is collected without the knowledge or information of the data subjects.

3. Data are collected for legitimate and proportionate purposes

4. When we process data, we do so for specific purposes: each data processing carried out by us has a legitimate, specified and explicit purpose.

5. For each of the processing carried out, we undertake to collect and use only data that are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

6. We ensure that the data are kept up to date and take steps to ensure that data that are inaccurate are erased or rectified.

4. What data do we process?

7. In the context of the processing of personal data, the purposes of which are presented to you below, we collect and process the following categories of data:

  • identification data of data subjects;
  • data on the use of the services offered on the Libertify platform;
  • data necessary for the management of the contract; 
  • your exchanges with Libertify;

8. You will be informed whether the data to be provided are mandatory or optional at the time of their collection. If you refuse to provide mandatory data, Libertify will not be able to provide you with the Services (such as the creation of your user account, access to the platform’s functionalities or the processing of your order).

9. If you provide us with the personal data of a third party, we remind you that you are required to inform that person of the disclosure and processing of their personal data by Libertify and to communicate this policy to them.

10. Users of the www.libertify.com site and the Libertify platform may be associated, by the devices, applications, tools and protocols they use, with online identifiers such as IP addresses, cookies or other connection identifiers. These identifiers may leave traces which, especially when combined with unique identifiers and other information received by the servers, may be used to create profiles of individuals and identify them. For more information on the cookies used by Libertify, please read our Cookie Policy.

5. What are the purposes and legal bases of our processing?

11. The processing operations carried out by Libertify have the following purposes and legal bases:

No.

Purposes

Legal bases

1.

Ensuring the operation of the platform and the provision of services to users, in particular the establishment of a risk profile

Performance of the contract

2.

Improving the quality and operation of the services

Legitimate interests

3. Managing contracts (managing and tracking orders, payments)

Performance of the contract

4.

Keeping general accounting

Compliance with a legal obligation relating to a data storage requirement

5.

Establishing financial statistics concerning customers

Legitimate interests

6.

Monitoring customer relationship for complaint management

Performance of the contract

7.

Managing prospects (notification of the launch of the platform)(2)

Consent

8.

Managing requests from competent authorities or courts (communication of requested data)

Compliance with a legal obligation

9.

Managing pre-litigation or litigation relating to the contract or not

Libertify’s legitimate interest in establishing proof of a right or contract(3)

2. Note: we have noticed on the current version of the “https://libertify.com/” website the possibility for a user to enter their email address in order to be alerted of the launch of the platform. We therefore propose to keep this purpose, in the event that the privacy policy is posted online before the launch of the platform. Furthermore, as registering to this alert constitutes a form to collect personal data (the email address), we recommend adding the following essential information, in accordance with the CNIL’s recommendations: the identity of the controller, the purposes of the processing, the list of and method for exercising the rights of data subjects, and a reference to the privacy policy.

3. In this case, Libertify must carry out a balancing test which aims to ensure that Libertify’s legitimate interest would not infringe the fundamental rights and freedoms of the data subjects. In its Opinion No. 06/2014, the WP29 proposes to balance the interests of the controller against the fundamental rights and freedoms of the data subjects. In doing so, several elements should be taken into account, such as:

  • the nature of the interests of the controller;
  • the impact of the processing on the data subjects;
  • the nature of the data (sensitive data in a strict or broader sense);
  • the status of the data subject (minor, employee, etc.) and of the controller (e.g. whether a business organisation is in a dominant market position);
  • the way data are processed (large scale, data combination, profiling, disclosure to a large number of people or publication);
  • data subjects’ reasonable expectations;
  • the impact of the processing.

This balancing test must be documented so that it can, if necessary, be reproduced in response to any request that the CNIL may make.

6. Who are the recipients of your data?

12. The recipients of your data are:

  • Libertify’s employees in charge of managing the platform you use;
  • Libertify’s subcontractors, each to the extent to which it is concerned;
  • the competent authorities or courts pursuant to a law, regulation or decision of a competent regulatory or judicial authority;
  • (.)

13. We ensure that only authorised persons of those recipients have access to these data. Libertify has a strict clearance policy which ensures that the data it processes are only shared with those authorised to access them.

7. Do we transfer your data?

14. The personal data collected by Libertify or its processors are processed exclusively in the European Union. This also means that the data are stored in the European Union, can only be accessed by natural or legal persons located, domiciled or established in the European Union and can only be transferred between European Union countries.

8. How long are we keeping your data?

15. We ensure that data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed.

16. The periods for which we keep your personal data are proportionate to the purposes for which your data were collected.

17. More precisely, our data storage policy is organised as follows:

No.

Purposes

Storage period

1.

Ensuring the operation of the platform and the provision of services to users, in particular the establishment of a risk profile

The data are kept for the duration of the contractual relationship.Connection data are kept for 1 year. Beyond this period, only the data necessary for pre-litigation or litigation purposes are archived until the statutory limitation period has expired, it being specified that the ordinary law limitation period in civil and commercial matters is five (5) years.

2.

Improving the quality and operation of the services

The data are kept for the time necessary to achieve the purpose of the study or until the right to object or to withdrawal consent is exercised.

3. Managing contracts (managing and tracking orders, payments)

The data are kept for the duration of the contractual relationship.

4.

Keeping general accounting

Accounting data and business documents (such as invoices, order forms, commercial correspondence) are subject to intermediate archiving for the legal storage period, i.e. up to ten (10) years from the end of the accounting period.

5.

Establishing financial statistics concerning customers

The data are kept for the time necessary to achieve the purpose of the statistics or until the right to object is exercised.

6.

Monitoring customer relationship for complaint management

The data are kept for the duration of the contractual relationship.

7.

Managing prospects (notification of the launch of the platform)(8)

The data are kept for a period of 3 years from the date of collection or the last contact from the prospect (e.g. date of the request to be notified of the launch of the platform).(9)

8.

Managing requests from competent authorities or courts (communication of requested data)

The data are kept only for the time necessary to process the request of the competent authority or court.

9.

Managing pre-litigation or litigation relating to the contract or not

Where applicable, the data are kept for the duration of the pre-litigation or litigation.

In the case of a pre-litigation, the data are then archived until the dispute is settled out of court or, failing that, as soon as the corresponding legal action is time-barred.

In the case of litigation, the data are archived until the ordinary and extraordinary remedies are no longer available against the decision issued.

8. Note: we have noticed on the current version of the “https://libertify.com/” website the possibility for a user to enter their email address in order to be alerted of the launch of the platform. We therefore propose to keep this purpose, in the event that the privacy policy is posted online before the launch of the platform. Furthermore, as registering to this alert constitutes a form to collect personal data (the email address), we recommend adding the following essential information, in accordance with the CNIL’s recommendations: the identity of the controller, the purposes of the processing, the list of and method for exercising the rights of data subjects, and a reference to the privacy policy

9. Maximum period recommended by the CNIL (Deliberation n°2016-264 of 21 July 2016 amending a simplified standard – NS-048). NB: if the prospect is a customer, the recommended storage period is 3 years from the end of the contractual relationship. At the end of this period, the controller may contact the prospect to find out whether they wish to continue receiving marketing messages. In the absence of a positive and explicit response from the person, the data will have to be permanently deleted.

9. How do we ensure the security of your data?

18. The security of your personal data is very important to Libertify.

19. We have implemented technical and organisational measures appropriate to the degree of sensitivity of the personal data, in order to ensure the integrity and confidentiality of the data and protect them against malicious intrusion, loss, alteration or disclosure to unauthorised third parties.

20. Libertify chooses its subcontractors and service providers with care and requires that:

  • they ensure a level of personal data protection at least equivalent to its own;
  • they use personal data or information on a need-to-know basis only to ensure the management of the services they are required to provide;
  • they strictly comply with applicable laws and regulations regarding confidentiality and personal data;
  • they implement all appropriate measures to ensure the protection of personal data they process;
  • they define the technical and organisational measures necessary to ensure security.

10. Do we use processors?

21. Where we use a service provider, we will only disclose personal data to them after obtaining a commitment and guarantees from them that they will be able to meet security and confidentiality requirements.

22. In compliance with our legal and regulatory obligations, the contracts concluded with our processors set out precisely the terms and conditions of the processing of personal data by them in accordance with personal data protection laws.

11. Do we use cookies?

23. When using the Libertify site, application and platform, cookies or other trackers may be installed on the administrator’s or user’s terminal.

24. All the information concerning the cookies that may be set during such use is detailed in Libertify’s Cookie Policy, which is accessible on its website at the following address: (to be completed) and from the footer of each of the pages of Libertify’s site or platform.

12. What are your rights?

25. Libertify is committed to respecting your rights in relation to the data we process, in order to guarantee fair and transparent processing taking into account the particular circumstances and context in which your personal data are processed.

        12.1 Your rights of access

26. You must use the services of the site and all the information to which you may have access exclusively for personal purposes and in a manner that is consistent with public policy, morality and third party rights.

27. You must not interfere with the use that other users may make of the Libertify site, application or platform, not access the accounts of third party users, and not access restricted areas of the Libertify site, application or platform that you are not authorised to access.

28. You have the right to obtain confirmation as to whether or not your personal data are being processed and, where that is the case, access to your data and the following information:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient, and where applicable the international organisations, to whom the personal data have been or will be disclosed, in particular recipients in third countries;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of your personal data or restriction of processing of your personal data or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from the data subject, any available information as to their source;
  • where personal data are transferred to a third country or to an international organisation, the appropriate safeguards provided by Libertify.

29. In connection with the right of access, Libertify may charge you a reasonable fee based on administrative costs for any copy of the personal data undergoing processing beyond that.

       12.2 Your right to rectification of your data

30. You have the right to ask us, as the case may be, to rectify or complete your personal data that are inaccurate, incomplete, ambiguous or expired.

        12.3 Your right to erasure of your data 

31. You have the right to ask us to erase your personal data in the cases provided for by laws and regulations, including where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw the consent you have previously given;
  • you object to the processing of your data and there are no overriding legitimate grounds for the processing;
  • the processing of personal data does not comply with the provisions of the applicable legislation and regulations;

32. Please note, however, that the right to erasure is not a general right and can only be exercised if one of the reasons provided for in the applicable laws is met.

33. Therefore, if none of these reasons is met, Libertify will not be able to act upon your request; this will be the case if Libertify is required to retain the data for compliance with a legal or regulatory obligation or for the establishment, exercise or defence of legal claims.

         12.4 Your right to restriction of processing of your data

34. The right to restriction complements the other rights you have. This right means that our processing of your data is restricted, so that we can keep the data, but we cannot use or process them in any other way.

35. This right applies in specific cases:

  • if you contest the accuracy of your personal data. Processing is then restricted for a period of time enabling Libertify to verify the accuracy of the personal data;
  • if the processing is unlawful and you oppose the erasure of your personal data and request the restriction of their use instead;
  • if we no longer need the personal data for the above-mentioned purposes, but they are required by you for the establishment, exercise or defence of legal claims; 
  • if you have objected to processing on the basis of Libertify’s legitimate interests, you may request that the processing be restricted for the period necessary to determine whether or not we can comply with your objection (i.e. the period necessary to verify whether the legitimate interests of Libertify override yours).

         12.5 Your right to object to processing of your data

36. You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on the legitimate interest pursued by the controller (see clause above on the legal bases for processing).

37. If you exercise your right to object, we will no longer process your personal data for the processing concerned unless we demonstrate compelling legitimate grounds for the processing which must override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

          12.6 Your right to data portability

38. You have the right to portability of your personal data. Please note, however, that the right to data portability is not a general right. Not all data from all processing operations are portable; the right to data portability only concerns processing carried out by automated means to the exclusion of manual or paper processing.

39. This right is limited to processing based on your consent, on the performance of a contract or on the taking of steps prior to entering into a contract.

40. This right does not include derived or inferred data, which are personal data created by Libertify.

          12.7 Your right to lodge a complaint

41. You have the right to lodge a complaint with the CNIL (3 place de Fontenoy 75007 Paris) on the French territory without prejudice to any other administrative or judicial remedy.

          12.8 Your right to give post-mortem instructions

42. You have the right to give special instructions on how your personal data should be stored, erased and shared after your death. These special instructions only concern, and will be limited to, the processing carried out by us.

43. You also have the right, when that person will be designated by the executive branch, to give general instructions for the same purpose.

          12.9 How to exercise your rights?

44. You may exercise the rights listed above by sending a request, together with a document proving your identity by any means, by email to info@libertify.com or by post to 118 rue de Lauriston, Paris 75016.

13. Miscellaneous provisions

           13.1 Language

45. This Privacy Policy has been drafted in French and in (to be completed).

46. In the event of a dispute between the parties, only the French language version shall be considered legally valid.

           13.2 Change to this document

47. We invite you to consult this policy on our website regularly. It may be updated at any time.

48. Last updated: 5th Jan 2023