This is the privacy statement relating to BuildAndRun, a product of BuildAndRun SAS (henceforth referred to as “BuildAndRun”). BuildAndRun SAS is a company under French law, based at 11 rue des Draperies, Bat C, 69450 St-Cyr-au-Mont-d’Or, France.

BuildAndRun is a web application that offers a product flow solution through the website www.buildandrun.com. It is possible that we use your personal data while you are using this application. This privacy statement describes how we use (‘process’) personal data and it explains how that information is used, and maintained, whom it is shared with, and how we protect it.

If you have any questions, the contact information of BuildAndRun is as follows:

Address: at 11 rue des Draperies, Bat C, 69450 St-Cyr-au-Mont-d’Or, France.
E-mail: pr@buildandrun.com

1. Who is responsible for the processing of your personal data?
BuildAndRun is responsible for processing your personal data. BuildAndRun can link to other websites, e.g. via social media buttons. The browsing on other websites, including websites through which you log in to our applications (such as Google), is subject to their own terms, conditions, and (privacy) policy. We are not responsible for these practices.

2. Which personal data do we collect about you and for which purposes?
We collect personal data from you, for the following purposes:
a) For creating a profile for the workflow functionality. Hereby we need your name and e-mail address.
b) For the technical and functional management of the BuildAndRun application, in order to give you the most optimal experience. We can use your IP address, pages you visit, internet browser, geographic data (such as location data), preferred language, and the time and period of your visit (see for more information ’6. Cookies’).
c) To comply with legal obligations and to comply with requests in the context of legal proceedings etcetera.

We endeavor to collect only such information as is reasonably necessary. You are responsible for ensuring that the information you provide is accurate, complete, and current (e.g. by making a profile through our BuildAndRun application). We take reasonable steps to ensure that the information we collect, and use is relevant to its intended use.

Whenever you use our services to create an account, the processing of personal data is a contractual obligation or necessary to enter into the agreement. In other circumstances, it is our legitimate interest (e.g. so that the BuildAndRun application can run smoothly).

This website is not intended to collect or maintain personal data from persons under 16 years old. If BuildAndRun learns that personally identifiable information of a person under 16 years old has been collected without verifiable parental consent, we will take the appropriate steps to delete such information.

3. Who has access to your information?
We do not share or disclose personal data outside of this application unless this is necessary to provide services or conduct our business operations. We might be obligated to share personal data on the basis of the law or on a court decision. In case of use of third parties, as when you log in via Google, Microsoft, or any other service, we will, in accordance with relevant laws and regulations, ensure applicable processor agreements within and outside the EU/EEA and additional measures, if necessary, whereby the security of your personal data is guaranteed by the processor. In other words: we take measures so that the recipients of your personal data will protect it.

4. How is your personal data secured?
To protect your personal data against unwanted destruction, loss, modification unauthorized disclosure, or access, we use technical and organizational security measures. These include secured servers, firewalls, and data processing agreements with third parties (like our cloud providers). We will protect your personal data as can be reasonably expected from us. Our information security policies and procedures are reviewed regularly and updated as necessary to meet our business needs, changes in technology, and regulatory requirements.

5. How long we will keep your personal data?
Whenever personal data is no longer necessary for the purpose for which it has been collected, we will destroy it. If you would like to delete your profile, we will delete it unless retention is required. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

6. Cookies
Cookies are small text files that are downloaded to your computer or mobile device when you visit a website or application. Your web browser (such as Internet Explorer, Mozilla Firefox, or Google Chrome) then sends these cookies back to the website or application on each subsequent visit so that they can recognize you and remember things like personalized details. Some of these cookies are necessary in order to run websites and applications properly, others are used to make sure that they are easy to use (for instance remembering your preferences).

See our cookie policy for more detailed information on the cookies we use and how you can manage these.

7. How do you come in contact with us to exercise your rights?
We respect your rights under the GDPR. We will respond to requests for information as quickly as possible and, where applicable, will correct, amend, or delete your personal information.
In such cases, we will need you to respond with proof of your identity before you can exercise these rights. We need to identify you with these types of requests.
You can exercise the following rights:
– The right to access information
At any point, you can contact us to request the information we process for you. For information that is also present in the profile, we advise you to check that first. There are no fees or charges for the first request.
– The right to correct and update the information
If the data we hold on to you is out of date, incomplete or incorrect, you can inform us and your data will be updated. Some information can be adjusted in the profile, we advise you to check this before you request us to do so.
– The right to restrict the processing of personal data
In certain cases, you can restrict the processing of your data, for instance, if you feel that the data we process is incorrect, and you do not want us to erase your data but restrict the processing.
– The right to have your information erased
If you feel that we should no longer be using your data or that we are illegally using your data, you can request that we erase the data we hold. When we receive your request, we will confirm whether the data has been deleted or the reason why it cannot be deleted (for example because we need it for our legitimate interests or regulatory purpose(s)).
– Withdrawal of given consent
When we process your personal data based on your consent, you have the right to withdraw this at any time.
– The right to data portability
If you want us to move your data to another data controller, you can do this in the circumstances that you have provided the data directly to us yourself, this data is processed based on your consent or used in order to fulfill a contract and the data is automated (this right does not apply to paper records).
– The right to object to the use of your personal information
You can object to the processing of your personal data carried out by BuildAndRun if this is processed in our legitimate interests, to carry out a task in the public interest, or in the exercise of official authority, unless we have legitimate grounds to do so. In the case of direct marketing, you can always object to this processing. This also applies to the situation when your data is processed for scientific, historical, or statistical research purposes unless this is necessary for the public interest. Objecting to the processing when decisions are made on an automated basis is possible, unless this is necessary for the performance or entering into our contract, this is authorized by law, or when you have given us your consent.
– Right to lodge a complaint with the Data Protection Authority
If you feel that we have not dealt correctly with your personal data, you can lodge a complaint with the data protection authority of France: CNIL (Commission Nationale de l’informatique et des libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France) or your local data protection authority.

If you wish to exercise your privacy rights, you can send the request to BuildAndRun SAS (address in the name of BuildAndRun SAS, 11 rue des Draperies, Bat C, 69450 St-Cyr-au-Mont-d’Or, France or to pr@buildandrun.com). We aim to reply to your request within one (1) month. If your request cannot be processed within a month, you will be notified accordingly. If you have any questions about our policy with regard to the protection of personal data, these can be sent to the same post or e-mail address.

8. Changes to this privacy statement
This privacy statement may be changed at any time without prior announcement and is communicated through this privacy statement. Changes come into effect as soon as they are published on this Website or in our App.
In order to be sure that you are familiar with the changes we advise you to check the privacy statement regularly.
This version of the privacy statement is in effect since January 2023.