Legal information
Privacy Policy
Current version — April 2026 · Legal notices included
Legal notices
Service publisher: Ellevate
Legal form: Société à responsabilité limitée (SARL) — French private limited company
SIREN: 954 093 183
SIRET (registered office): 954 093 183 00042
EU VAT number: FR69 954 093 183
NAF/APE code: 70.22Z — Business and other management consultancy
Registered office: 35 rue Jacques Hillairet, 75012 Paris, France
Date of incorporation: 1 July 2023
Publication director: Jade Caillot
Data controller (GDPR): Jade Caillot
Contact: qualead@ellevate.fr
Application hosting: Vercel Inc. — 340 Pine Street, Suite 401, San Francisco, CA 94104, United States
Data hosting: Supabase EU — Frankfurt, Germany (European Union)
1 — Who we are
Ellevate (SIREN 954 093 183), publisher of the Qualead service, is the data controller for personal data collected in connection with use of the service. For any questions regarding data protection, please contact us at qualead@ellevate.fr.
2 — Data collected and purposes
Client account data (B2B)
First name, last name, professional email address, venue name.
Reference documentation (Master File)
Information about spaces, rates, and venue availability — non-personal data, configured by the Client.
Processed incoming email data
First name, last name, email, phone, company of event requestors — personal data of the Client's prospects.
Qualead acts as a data processor for the processing of the Client's prospect data. The Client is the data controller for this data.
Navigation data (marketing website)
Aggregated and anonymised analytics data. No third-party cookies. No personally identifiable data.
3 — Sub-processors and data transfers
| Sub-processor | Role | Location | Safeguard |
|---|---|---|---|
| Supabase (EU Frankfurt) | Database hosting | European Union | No transfer outside EU |
| Anthropic | AI email processing | United States | DPA signed + Standard Contractual Clauses |
| Microsoft Graph API | Outlook email reading | EU (client tenant) | Microsoft 365 Terms |
| Stripe | Payment processing | United States | Stripe DPA + SCCs |
| Vercel | Application hosting | Global (edge) | Vercel DPA signed |
4 — Rights of data subjects
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access
- Right of rectification
- Right to erasure ("right to be forgotten")
- Right to data portability
- Right to object to processing
- Right to restriction of processing
To exercise these rights, send your request to qualead@ellevate.fr. We respond within a maximum of 30 days.
If your complaint remains unresolved, you have the right to lodge a complaint with the relevant supervisory authority. In France: the Commission Nationale de l'Informatique et des Libertés (CNIL) at cnil.fr.
5 — Data security
- Data at rest encryption: AES-256
- Data in transit encryption: TLS 1.3
- Access restricted to data strictly necessary for each processing operation
- Full access logging (exportable audit trail)
- No automatic email sending without prior human validation
- Strict data siloing per client venue
6 — Cookies
Qualead uses only functional cookies strictly necessary for the operation of the service: session management and authentication. No advertising cookies, no third-party tracking cookies.
The marketing website qualead.ellevate.fr does not place any third-party cookies. Navigation data is collected in an aggregated and anonymised manner.
7 — Changes to this policy
Any material changes to this privacy policy will be notified by email to active clients at least 15 days before taking effect.
Privacy policy last updated in April 2026.
Contact: qualead@ellevate.fr
See also: Terms of Service · Security & Compliance