Politique de Confidentialité

Version 1.0 — effective 21 May 2026

Data controller: Kevalco — SAS with a share capital of €2,500.00 — registered under 994 157 576 R.C.S. Laroche-sur-yon — 4 Le Pommeragu, 85260 Montreverd, France — hello@kevalco.com — SIRET: 994 157 576 00012

2.1 Identification and contact data

Data: first name, last name, email address, phone number (optional), city and postcode.

Purposes:

• Creating and managing your user account
• Authentication and access to the service
• Service-related communications (notifications, support)
• Billing and commercial management

Legal basis: Performance of contract, legitimate interest.

2.2 Connection and usage data

Data: IP address, connection logs, browsing data, user preferences.

Purposes:

• Securing the service and preventing fraud
• Improving performance and user experience
• Anonymised usage statistics

Legal basis: Legitimate interest.

2.3 Home employment contract management data

Data: information on employment contracts, schedules, exchanges between employers and employees.

Purposes:

• Providing the home employment contract management service
• Scheduling and tracking interventions
• Connecting private employers and home-based employees

Legal basis: Performance of contract.

2.4 Billing data

Data: banking information, invoices, payment history.

Purposes:

• Processing payments
• Issuing and retaining invoices
• Accounting and tax management

Legal basis: Performance of contract, legal obligation.

2.5 Electronic signature data

Data: IP address and user-agent of each signing action when signing employment contracts.

Purposes:

• Evidentiary value of electronically signed contracts
• eIDAS compliance

Legal basis: Legitimate interest. This data is only accessible in the event of a dispute.

2.6 Third-party data entered by the User

Within the contact book, the User may enter data relating to third parties who do not use the Service (name, email, phone, address). This data is entered under the User's sole responsibility, who undertakes to have obtained the consent of the persons concerned. Kevalco acts as a data processor for such data. Any person wishing to exercise their GDPR rights over data concerning them must contact the User who entered it directly.

Your personal data may be shared with the following recipients:

• Authorised staff: technical teams, customer support, accounting
• Technical service providers: hosting (OVH SAS, France), transactional email sending (Brevo / Sendinblue SAS, France), payment processing (Stancer, France)
• Competent authorities: on legal requisition only

All our service providers are bound by contracts ensuring the security and confidentiality of your data, in compliance with the GDPR.

Some of our service providers may be located outside the European Union. In such cases, transfers are carried out in accordance with appropriate safeguards:

• Adequacy decision by the European Commission
• Standard contractual clauses approved by the Commission
• Approved certification or code of conduct

You may obtain a copy of the appropriate safeguards by contacting us at hello@kevalco.com.

We retain your personal data for the following periods:

• Account data: duration of the contractual relationship + 30 days after account deletion
• Billing data: 10 years (legal obligation)
• Active conversations: 2 years after the last message
• Archived or blocked conversations: 90 days after archiving or blocking
• Deleted listings: 1 year after deletion
• Inactive listings: 180 days after expiry
• Electronic signature audit log (IP, user-agent): 5 years after the signing date
• Signed contracts (PDF): 5 years after the signing date
• Resolved contact requests: 90 days after resolution
• Closed moderation reports: 1 year after closure
• Inactive accounts: deletion after prior notification (150 days of inactivity)

At the end of these periods, your data is deleted or anonymised, unless otherwise required by law.

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right of rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data under certain conditions
• Right to restriction: limit the processing of your data
• Right to data portability: retrieve your data in a structured format
• Right to object: object to processing on legitimate grounds
• Right to withdraw consent: withdraw your consent at any time

To exercise your rights, contact us at hello@kevalco.com with a copy of your identity document. We will respond within a maximum of 1 month. The right to erasure can also be exercised directly from your account settings, without needing to contact us.

7.1 Strictly necessary cookies

The Service uses only strictly necessary cookies for its operation, which do not require prior consent:

• Authentication: maintaining your session and securing your connection
• Preferences: remembering your technical choices (language, display)
• Consent: recording your response to the consent banner

These cookies are retained for the duration of your session or until you log out.

7.2 Privacy-friendly analytics

We use Plausible Analytics, a privacy-friendly analytics tool, compliant with the GDPR, which:

• Places no cookies on your device
• Collects no personally identifiable data
• Does not use fingerprinting
• Shares no data with third parties
• Collects only anonymised and aggregated statistics

These anonymous statistics allow us to improve the Service without compromising your privacy. No consent is required for this type of anonymous collection.

7.3 Cookie management

You may configure your browser to refuse all cookies. However, this will affect the proper functioning of the Service, in particular logging into your account.

We implement appropriate technical and organisational measures:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Strong authentication and access management
• Regular and secure backups
• Monitoring and intrusion detection
• Staff security training

In the event of a data breach likely to result in a high risk to your rights, we will notify you within 72 hours in accordance with the GDPR.

The Kiwisio Service is intended for adults (18 years and over). We do not knowingly collect personal data from minors under 18. If you are a parent and believe your child has provided us with personal data, please contact us immediately at hello@kevalco.com so we can delete it.

This privacy policy may be updated to reflect changes in our practices or regulations. Significant changes will be notified to you by email or via the service. The date of the last update is shown at the top of this page.

If you believe that the processing of your personal data does not comply with the GDPR, you may lodge a complaint with the French data protection authority (CNIL):

• CNIL — 3 Place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07
• Phone: +33 1 53 73 22 22
• Website: https://www.cnil.fr

For any question relating to this privacy policy or the exercise of your rights, contact us:

• Email: hello@kevalco.com
• Address: 4 Le Pommeragu, 85260 Montreverd, France

To ensure proper tracking and traceability of your requests, we favour written communication (email). You may also contact us by post at the address above.