Privacy Policy

This English version is provided for convenience. The French version is the only legally binding text.

We invite you to read carefully the data protection policy in force at Paprwork (the “Privacy Policy”), which we hope answers all your questions about the processing of your data.

If it does not, we are available to answer your questions. You can contact us at contact@wearenestor.com, write to our data protection officer at dpo@wearenestor.com, or write to us by mail at the address of our registered office.

This Privacy Policy was drawn up pursuant to European Regulation 2016/679 of April 27, 2016 (the General Data Protection Regulation, “GDPR”), which took effect on May 25, 2018. The Privacy Policy forms part of the General Terms and Conditions, and each term defined in the General Terms and Conditions has the same meaning in the Privacy Policy.

For the documents, messages and information that its customers exchange in Nestor, Paprwork acts as its customers’ processor (sous-traitant), under the Data Processing Agreement. Paprwork may also act as a service provider where the contract so provides.

This document takes effect on April 1, 2020.

Article 1: Nature of the data collected

Paprwork collects and processes the data that Professionals and Users (together, the “Service Users”) voluntarily provide in order to access the Services (the “Data”).

The purposes of this Data processing are:

• to allow Professionals (and, where applicable, Users) to create an account to access the Services,
• to allow Service Users to use the Services,
• to improve the Services,
• to send commercial offers exclusively and solely to Professionals.

The purposes of the processing are as follows:

• Organizing and tracking campaigns for sending secure documents;
• Automating reminders, returns and signatures;
• Archiving the documents sent and signed;
• Possible integration of electronic signature or SMTP connectors.

To open an account, Professionals must provide at least the following information:

• last name and first name
• email address
• postal address

Users other than Professionals are not required to create an account to use the Services, which naturally limits the amount of information collected. Service Users may (but are not required to) complete their profile with other information (phone number, etc.).

Paprwork also collects Data relating to the business relationship with Professionals: subscription plans taken out, invoicing and payment, participation in promotional offers, requests and incidents reported to support...

In any event, Paprwork undertakes to limit the amount of information collected as much as possible.

Article 2: Use of the Data

Paprwork uses the Data in the cases provided for by the applicable regulations, namely:

• the performance of the service contract relating to the use of the Services;
• compliance with a legal obligation;
• the existence of a legitimate interest;
• consent to the use of the Data.

Paprwork may send emails to Professionals at the email address associated with their account for technical or administrative reasons, or to inform them of changes to the Services or of new commercial offers. An unsubscribe link allows them to opt out at any time.

Article 3: Storage of the Data

3.1 Security

Paprwork makes every effort to prevent the loss, misuse, intrusion, unauthorized disclosure, alteration or destruction of the Data.

Accordingly:

• The Data of the Nestor application is stored on servers hosted in France, on fully sovereign European infrastructure.
• All information is encrypted using 256-bit TLS.
• Paprwork staff are bound by a duty of confidentiality.
• Access is strictly regulated through individual authorizations.
• Service providers must offer the same security guarantees.

3.2 Retention period

• Duration of registration: Data is kept for the duration of the registration, plus 12 months.
• Prospecting files: Kept for a maximum of three (3) years from the end of the business relationship.
• Customers: Personal data relating to customers is kept for the duration of the contractual relationship, then archived for a maximum of three (3) years for customer relationship management and prospecting purposes.
• Deletion of data: Data is deleted as soon as it is no longer necessary or at the Service User’s request.
• Retention for legal purposes: Certain data may be kept longer when required by law, in particular to comply with applicable legal, tax or accounting obligations (for example, accounting documents are kept for 10 years).

Article 4: Access to the Data

4.1. Internal access

Access to data is strictly limited to the system administrators of the technical team, and only to the extent necessary to carry out maintenance, security or investigation operations in the event of a technical incident. This access is logged and subject to strict confidentiality obligations.

The contents of the exchange spaces (in particular documents and messages) are not consulted as part of the organization’s internal processes. Any technical investigations relate exclusively to technical or structural data, and only when strictly necessary to resolve a malfunction or incident.

4.2. Disclosure to processors

The subcontracted services include:

• hosting,
• sending mail,
• maintenance and development.

The Processor undertakes to:

• Process the data only on the instructions of the Controller;
• Guarantee the confidentiality of the data processed;
• Implement appropriate technical and organizational measures;
• Assist the Controller in responding to requests from data subjects exercising their rights;
• Notify any personal data breach;
• Assist with GDPR compliance;

Delete or return the data at the end of the contract.

List of Paprwork’s processors

Article 5: Data transfers

Article updated on October 21, 2026.

The data of the Nestor application (accounts, and the documents and messages of the spaces) is hosted in France.

Some processors listed in article 4.2 process data elsewhere: in other European Union countries, or in the United States for the internal project management tool. The wearenestor.com website and its forms are hosted in the European Union by companies established in the United States.

When data is transferred outside the European Union, appropriate safeguards are put in place in accordance with the GDPR, for example the standard contractual clauses adopted by the European Commission.

Article 6: Exercise of Service Users’ rights

Service Users have the following rights:

• right of access,
• right to rectification,
• right to object,
• right to erasure,
• right to data portability,
• right to restriction of processing.

They can exercise them by contacting:

• Paprwork, 225 rue des Templiers, 59000 Lille
• contact@wearenestor.com

You can also contact our data protection officer (DPO), Éléa Baert, at dpo@wearenestor.com.

Article 7: Cookies and audience measurement

Article updated on October 15, 2026.

Paprwork may use cookies in the Services to make navigation easier and improve the user experience. Deleting them in your browser may affect the use of the Services.

The wearenestor.com website does not set any cookies to measure its audience or for advertising purposes.

To find out which pages of the website are viewed and to improve its content, Paprwork uses OpenPanel, an open source audience measurement tool installed on a server that Paprwork administers, hosted in France. The data is not shared with the publisher of OpenPanel or with any third party, and is not combined with any other processing.

The following is recorded: the pages viewed, the referring page, the type of device and browser, an approximate location derived from the IP address, and certain actions on the website (clicking a button, clicking a link to another website, submitting a form, using the simulator). No name, email address or message entered in a form is sent to the tool. This data is kept for 13 months, then deleted automatically.

You can object to this measurement: the website honors the “Do Not Track” and “Global Privacy Control” signals of your browser, and the button at the bottom of this page turns it off for your browser.

Article 8: Requests sent from the website

Article added on October 14, 2026, completed on October 19, 2026.

When you fill out a form on the wearenestor.com website (a request for a demo, a managed campaign, a workshop, a quote or security documents, a technical question or any other question), Paprwork collects:

• your last name and first name, your business email address and the name of your organization;
• if you provide them: your phone number, your job title, the size of your organization and your message;
• the subject of your request and the page of the website from which you sent it.

This information is used solely to answer your request and, if you wish, to prepare a demo or a commercial proposal. This processing is based on pre-contractual measures taken at your request and on Paprwork’s legitimate interest in answering the requests sent to it.

It is accessible only to the members of the Paprwork team in charge of answering you, whose accounts are protected by two-factor authentication. Every change is logged. It is not shared with any third party for commercial purposes.

The website and its database are hosted in Frankfurt (Germany), by the providers listed in article 4.2. This information is not stored in the Nestor application, which is hosted in France.

Each new request is reported by email to the members of the Paprwork team who have access to the website administration. This email contains the request; it is sent by Tipimail, in France.

It is kept for three (3) years from the last contact, in accordance with article 3.2 for prospecting files, then deleted. You can exercise the rights described in article 6 at any time.