Privacy Policy

Controller for Okouro's own operations

For the processing carried out to run Okouro's own business - the okouro.com website, account signup, subscription billing and support - the data controller is:

• Killian Jacob, trading as Okouro, registered under SIREN 840272967 (Registre national des entreprises), activity 62.01Z (software development), based in France.

Data protection contact: write to dpo@okouro.com, or, for any other legal matter, to legal@okouro.com.

Two roles: controller and processor

Okouro is a B2B platform used by organisations ("accounts"). Depending on the data, Okouro acts either as a controller or as a processor.

• Business data entered by a customer organisation about its own people and clients - consultant and employee profiles, timesheet lines, time-off records, expense reports, client and contact records - is processed by Okouro strictly as a processor, on the organisation's documented instructions, under a data processing agreement (DPA) with each customer. The organisation is the controller. If you are a consultant, an employee or a client contact whose data appears in an Okouro account, address your access, rectification or erasure requests to that organisation first; Okouro assists its administrators as the DPA requires.
• Account and billing data (who signs up, subscription plan, invoices) and website visitor data are processed by Okouro as the controller, as described in the rest of this policy.

Data we collect

We limit collection to what the service actually needs. The categories are:

• Account and user data: name, work email address, role within the organisation, hashed password, and workspace settings such as language and interface preferences.
• Billing data: billing name and address, subscription plan and invoices. Payment card details are processed by Stripe; Okouro does not store full card numbers.
• Usage and technical data: connection logs, IP address, device and browser information, and feature usage signals that help us operate and improve the product.
• Support and communication data: messages, tickets and exchanges you have with our teams.
• Customer-entered business data (Okouro acts as processor here): consultant profiles including skills and rates, timesheet lines, time-off records, expense reports, and client and contact records.

Purposes and legal bases

Each processing operation rests on one of the following GDPR legal bases:

• Performance of the contract: providing the Okouro features an account has subscribed to - staffing and allocation, automated monthly timesheets, time off, expenses, invoicing and financial reporting.
• Legitimate interests: securing the platform, preventing fraud and abuse, improving the product, measuring the audience of our marketing site with a cookieless, self-hosted analytics tool (see Cookies), and marketing our own B2B services to a professional audience.
• Legal obligations: accounting and tax retention of billing and invoice records, and other obligations imposed on us as a company.
• Consent: marketing emails. Consent to marketing emails can be withdrawn at any time, without affecting the lawfulness of the processing carried out before withdrawal. Beyond strictly necessary cookies, the marketing site sets no trackers: its audience measurement is cookieless (see Cookies), so no tracking-consent banner is required.

Sub-processors

We share personal data only with vetted sub-processors that act on our documented instructions and under data protection terms equivalent to ours:

• Scaleway SAS (8, rue de la Ville-l'Évêque, 75008 Paris, France) - cloud hosting and storage.
• Stripe - payment processing for subscriptions.
• Scaleway - transactional email delivery.

The current sub-processor list is available on request at dpo@okouro.com. We notify customers bound by a DPA before a new sub-processor starts processing their data.

Hosting location and transfers outside the EU

Production data is hosted in the European Union, in Scaleway data centers in Paris, France.

A transfer outside the EU/EEA may occur only for a limited purpose, for example when a supplier operates part of its service outside the EEA. In that case we rely on an adequacy decision or on European Commission standard contractual clauses, together with supplementary safeguards where needed, and we provide a copy of the relevant safeguards on request.

Retention periods

We keep personal data only as long as needed for the purposes described above, then delete or anonymise it:

• Account and user data: for as long as the account is active.
• Deleted records and closed accounts: purged after 90 days, unless a legal obligation requires longer retention.
• Invoices and accounting records: kept for the periods required by applicable tax and accounting law - for example ten years for invoices in France.
• Backups: encrypted backups are rolled over within 35 days, so deleted data also disappears from backup copies within that period.

Security

We apply state-of-the-art technical and organisational measures appropriate to the risk, including:

• TLS encryption for all traffic in transit and encryption at rest for stored data.
• Passwords hashed with industry-standard algorithms, never stored in clear text.
• Role-based access control and per-tenant data isolation inside the application.
• Least-privilege access for staff, with logging and monitoring of administrative actions.
• Regular encrypted backups and a documented incident response process.

If a personal data breach is likely to affect customer-entered data, we notify the affected controller without undue delay, as required by the DPA and by Article 33(2) GDPR; the controller then handles any notification to the supervisory authority and to individuals.

Your rights

Under the GDPR you may request, free of charge:

• Access to the personal data we hold about you, and confirmation that we process it.
• Rectification of inaccurate data and completion of incomplete data.
• Erasure of data that we no longer need to keep.
• Restriction of processing in the situations set out by Article 18 GDPR.
• Portability of the data you provided to us, in a structured, commonly used, machine-readable format.
• Objection, on grounds relating to your particular situation, to processing based on our legitimate interests.

Write to dpo@okouro.com. We answer within one month of receipt and may ask for proof of identity. For data entered by a customer organisation, contact your organisation's administrator first: for that data Okouro can only act on the controller's instructions.

You may withdraw any consent at any time, and you may lodge a complaint with the French supervisory authority, the CNIL, or with the supervisory authority of your place of residence in the EU.

Cookies

• Marketing site (okouro.com): only strictly necessary cookies and local storage (session, language, UI preferences). To understand how the site is used, we run a self-hosted, cookieless audience-measurement tool (Umami) on our own infrastructure in the European Union. It sets no cookies or similar trackers, does not build advertising profiles, does not track you across other websites and does not use your IP address to identify you; the statistics are kept in aggregate. Because it meets the conditions for the audience-measurement exemption, it relies on our legitimate interest and requires no consent banner, and there is no cross-site tracking.
• Web application (app.okouro.com): strictly necessary session cookies - authentication token, chosen language and interface preferences - based on contract performance and our legitimate interest in operating the service.
• Your browser can block or delete cookies; blocking strictly necessary cookies will sign you out and may break parts of the application.

Minors

Okouro is a professional tool sold to organisations and used by adults in a work context. We do not knowingly collect or process personal data of minors under 16. If you believe a minor's data has been submitted to us, contact dpo@okouro.com and we will delete it.

Changes to this policy

We may update this policy to reflect changes in the service or in the law. Material changes are announced in the application or by email to legal@okouro.com before they take effect. The revision date at the top of this page always shows the version in force.

Contact

For any question about this policy or about your personal data:

• By email to Killian Jacob, a French sole trader trading as Okouro: dpo@okouro.com (data protection) or legal@okouro.com (legal matters).