Skip to main content

Personal Data Privacy Policy

Text Link

JULY 2026

Orisha Group is committed to protecting individual rights, particularly with regard to the General Data Protection Regulation (GDPR) and the French Data Protection Act, and has implemented this Privacy Policy accordingly. 

Its purpose is to inform you, among other things, about all processing activities involving your personal data, the purposes for which they are processed, and the means available to you to exercise your rights.

WHAT DATA IS COLLECTED?

When using our site, you may provide us with information, some of which may identify you and therefore constitutes personal data (hereinafter referred to as "Data").

Orisha Group only processes and collects Data that is strictly necessary for the purposes for which it is processed.

Accordingly, we may collect data such as:

  • Identification data: Data we collect directly when you fill out a contact or marketing form (including: last name, first name, professional email address, phone number, company, industry/job title, country, and postal code). 
  • Identification and professional status data: Data we collect directly when you submit a job application.
  • Navigation and marketing tracking data: This is data we collect indirectly through the use of internet technologies, specifically cookies or trackers placed by our marketing automation tool (Pardot / Salesforce Account Engagement) integrated via Google Tag Manager.

This data includes the history of pages visited on our website, your resource downloads (white papers, documentation), your device's IP address, and your preferred communication language. Subject to your prior and specific consent to the placement of these cookies, contextualization parameters and technical identifiers are also transmitted automatically when a form is submitted (including: the URL of the referring page, the lead source, UTM/Google Campaign ID type campaign parameters, as well as GCLID and Rose Session ID technical identifiers).

Important note on data reconciliation: This navigation data is initially processed pseudonymously. However, it is intended to be associated with your identification data (and thus become personally identifiable within our Salesforce customer relationship management tool) in two specific cases:

  1. Once you voluntarily submit a form on our website (demo request, contact, download);
  2. When you click on a tracking link within a professional email sent to you by our services.

Orisha Group guarantees that this behavioral tracking is strictly conditional upon your prior consent, which you may grant, customize, or withdraw at any time, in accordance with our Cookie Management Policy.

WHAT PROCESSING ACTIVITIES ARE CARRIED OUT?

The processing activities implemented by Orisha Group serve an explicit, legitimate, and determined purpose:

Processing activities Data collected Purposes Legal bases Data retention period (active database)
Management of contact requests Identification and professional data: data we collect directly when you fill in a contact or marketing form. Depending on the Business Unit your request is addressed to, the mandatory data collected may vary. The Last name, First name, professional email address, phone number, company and business sector fields are always required. The Country field is mandatory for the Commerce and Group entities, while the Postal code is mandatory for the Commerce and Construction entities. Free-text fields remain optional.
  • Respond to requests for information, demonstration or documentation regarding our Solutions.
  • Handle support requests.
 Legitimate interest of the data controller. The time necessary to respond to the relevant request.
Carrying out prospecting activities Identification and professional data: data we collect directly when you fill in a contact form. Depending on the Business Unit your request is addressed to, the mandatory data collected may vary. The Last name, First name, professional email address, phone number, company and business sector fields are always required. The Country field is mandatory for the Commerce and Group entities, while the Postal code is mandatory for the Commerce and Construction entities. Free-text fields remain optional. Sending marketing communications (newsletters, invitations to webinars and events), segmentation by sector interest or Business Unit to send targeted offers, automated delivery scenarios of educational content (lead nurturing) and automated routing of requests to our sales teams (qualification and sector/geographic distribution). Legitimate interest of the data controller. Three years from the collection of the Data by the data controller or from the last contact from the prospect.
Recruitment management Candidate identification data and data relating to their professional situation. Collect and manage applications for job offers. Performance of pre-contractual measures. Two years from the submission of the application (unless objection).

WHO IS YOUR DATA TRANSFERRED TO?

The only recipients to whom your data is transmitted are: 

  • Personnel authorized and designated based on their roles within the Orisha Group; 
  • Third parties such as our subcontractors and service providers responsible for tasks including website hosting, job application processing, and our customer relationship management and marketing automation solution provider. They are contractually obligated to ensure a level of security and confidentiality for your data and to comply with applicable data protection regulations.

We only share with our subcontractors and service providers the data strictly necessary for the provision of services. Consequently, they process your Data solely according to our documented instructions and may in no way use your personal data for other purposes.

WHAT ARE OUR SECURITY MEASURES?

The Orisha Group ensures the security of personal data by implementing enhanced data protection, notably through appropriate organizational and technical measures to preserve the security, integrity, and confidentiality of your personal data, in particular to prevent it from being distorted, damaged, or accessed by unauthorized third parties.

Furthermore, our staff is subject to a confidentiality obligation through their employment contract and an IT policy integrated into our internal regulations. We also organize awareness sessions for our staff regarding privacy and security measures.

POLICY UPDATES 

The version of this Policy currently online is the only one enforceable for the entire duration of your use of the site and until a new version replaces it.

This Policy is updated regularly to account for legislative and regulatory changes and any modifications the Orisha Group makes to the processing of your data.

WHAT ARE YOUR RIGHTS?

In accordance with applicable laws and regulations, notably the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights: access, rectification, erasure, restriction, objection, and where applicable: portability, withdrawal of consent, and the right to define directives regarding the fate of your personal data after your death.

If you have any questions, concerns, or requests regarding the protection of your personal data, or if you wish to exercise your data protection rights, our Data Protection Officer is available at the following email address: dpo@orisha.com or by mail at the following address: 70, boulevard de Courcelles 75017 Paris.

If, after contacting us, you believe that your rights have not been respected, you have the right to lodge a complaint with the competent supervisory authority (such as the CNIL in France).

Your next milestone starts here.

Orisha empowers businesses that refuse to be held back by their technology.