Privacy policy

Last updated: 4 September 2026

ARTIBOX SAS, publisher of the Qualibox platform, attaches essential importance to respecting your privacy. This policy describes what personal data we collect, how we use it and what your rights are in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act ("Informatique et Libertés").

1. Data controller

The data controller is ARTIBOX SAS, a simplified joint-stock company (société par actions simplifiée) with share capital of 21,861 euros, registered with the Meaux Trade and Companies Register under number 823 659 123, whose registered office is located at 36 rue de Lamirault, 77090 Collégien, France.

2. Who this policy applies to

• Consumers: individuals reading or submitting reviews about businesses
• Professionals: businesses managing their profile and their online reputation on Qualibox
• Networks: managers and members of a brand group
• Visitors: any person browsing the website without being registered

3. Data collected

Depending on the services used, Qualibox may collect:

3.1 Identification data

• Last name, first name, email, telephone
• Password (hashed) for user accounts
• Postal address (professional area, billing)

3.2 Business data

• SIRET, SIREN, company name, legal form
• Contact details (address, telephone, email, website)
• Sector, trade, description, profile photos

3.3 Published content

• Reviews, ratings, associated photos, professionals' replies
• Quote requests and associated messages

3.4 Browsing data

• IP address (retained for a limited period, see table below)
• Browsing data (pages viewed, duration, referrer) via analytics tools if consent is given
• User agent, language, country (inferred from the IP address or from preference cookies)

3.5 Payment

Our payment provider (Stripe) processes bank card information. ARTIBOX does not collect full card numbers.

4. Purposes and legal bases

Purpose	GDPR legal basis	Retention period
Provision of the service (reviews, directory, quotes, professional area)	Performance of a contract (art. 6.1.b)	3 years after last activity
Account creation and authentication	Performance of a contract	Until the account is deleted + 1 year
Moderation, review certification, fraud prevention	Legitimate interest (art. 6.1.f)	Duration of the review's publication + 5 years of evidential archiving
Sending newsletters	Consent (art. 6.1.a)	Until unsubscription
Traffic measurement (anonymised analytics tools)	Consent or legitimate interest	13 months (CNIL recommendation)
Security logs	Legitimate interest (art. 6.1.f)	1 year
Accounting and tax obligations	Legal obligation (art. 6.1.c)	10 years
B2B prospecting	Legitimate interest	3 years after the last contact

5. Data recipients

Your data may be passed on to:

• Authorised internal ARTIBOX teams (support, operations, technical, administration)
• Other users, for data intended to be public (business profile, published reviews, replies)
• Listed professionals if you contact them through a quote request
• Ecosystem partners (Thervy, ArtiBox) as part of review federation, only under the conditions provided for by the service and, where applicable, with your consent
• Technical providers: Amazon Web Services (hosting, EU), Brevo (emailing, France), Stripe (payments)
• Administrative or judicial authorities upon legal request

No data is sold to commercial third parties.

6. Transfers outside the European Union

Some providers (notably Stripe, and Google / Microsoft / Hotjar if the corresponding analytics cookies are enabled) may process data outside the EU. These transfers are governed by the European Commission's standard contractual clauses and, where applicable, adequacy decisions (Data Privacy Framework for the United States).

7. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability: receive your data in a structured format
• Right to object to processing
• Right to withdraw consent at any time
• Right to set post-mortem instructions
• Right not to be subject to an automated decision producing legal effects

To exercise these rights, contact dpo@quali-box.fr. Response within 1 month (extendable by 2 months if the request is complex).

8. Cookies

The Website uses several types of cookies: essential cookies (session, authentication, security, language and country), traffic measurement cookies subject to consent, and marketing cookies which are not currently used. The itemised details are set out in the cookie policy.

9. Security

Qualibox implements technical and organisational measures to protect your data:

• HTTPS/TLS encryption on all communications
• Password hashing
• AWS hosting within the European Union (eu-west-3 Paris region)
• Regular backups
• Monitoring and audit logs
• Restricted access to data according to operational needs

10. Minors' data

Qualibox does not knowingly collect data from minors under the age of 15. If you believe that a minor has provided us with data, please contact dpo@quali-box.fr to have it deleted.

11. Complaint to the CNIL

In the event of a dispute, you may lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr/fr/plaintes.

12. Changes to the policy

Qualibox may amend this policy to reflect legal or technical developments. In the event of a substantial change, you will be informed by email or by notification on the Website.