01 Who is responsible for your data
Pecify, a French simplified joint-stock company with a sole shareholder (société par actions simplifiée à associé unique) with share capital of €1.00, whose registered office is at 60 rue François 1er, 75008 Paris, France, registered with the Paris Trade and Companies Register under number 994 557 635, is the controller of the processing described in this policy.
Contact for any question about your data: donnees@pecify.fr, or by post to the registered office address.
Pecify has not appointed a data protection officer, as its activity does not fall within any of the cases of mandatory appointment provided for in article 37 of Regulation (EU) 2016/679.
02 When this policy applies and when it does not
It applies to data processed by Pecify as controller: visits to the romaldent.fr website, contact and demo requests, marketing to professionals, customer relationship management, support, billing.
It does not apply to data that our professional customers enter in the Romaldent application in the course of their own business, in particular the identification and traceability data of their staff and contractors. For this processing, the customer acts as controller and Pecify as processor, solely on the customer’s documented instructions, under the conditions set out in the data processing agreement annexed to the subscription contract. Data subjects should contact the clinic or practice that employs them, or where they work, directly.
Romaldent does not process any personal health data. The application is designed to track equipment, and the contract expressly prohibits the customer from entering data relating to a patient or to the health of a member of its staff.
03 What the website collects and what it does not
You enter data in three places on the website: the form on the Contact page, the sign-up for emails from our blog (in French), and the request for the Excel inventory template. The contact form collects:
- your work email address and phone number, the only required fields, so that we can call you back;
- if you choose to provide them: your first and last name, the name of your clinic or practice, your role, the number of clinics or practices you oversee, and your message;
- your agreement to be contacted, without which the request is not sent.
Your request is sent to us by email, at contact@pecify.fr. It is also recorded in a log on our server, so that no request is lost if the email fails. This log keeps, with your request, its date, the address of the page from which it was sent and the type of browser used. This data is used solely to respond to you; its retention period is given in section 4.
The sign-up for blog emails collects only your email address. It is stored in our mailing tool, hosted by Infomaniak, and is used solely to send you these emails. Each one includes an unsubscribe link. If you agree to it when signing up, the opening of your emails is measured: see section 9.
The request for the Excel inventory template collects only your email address. It is first used to send you the file, as an attachment. Unless you tick the “Do not contact me” box, it is also sent to us by email, at contact@pecify.fr, and recorded on our server with the date of the request, so that we can contact you about tracking your equipment. You can object to this at any time, by replying “stop” to one of our messages or by writing to us: your address is then removed. If you tick the box, your address is used only to send the file and is not kept.
To limit abusive submissions, a fingerprint of your IP address, not the address itself, is kept in a temporary file on the server with the time of each form submission. It is used solely to count submissions in the last hour.
You can also write to us directly at contact@pecify.fr, without using the form.
The website sets no cookie and loads no third-party resource until you have consented. If you accept audience measurement, an external tool is loaded and sets cookies: see section 9. Apart from this case, the website loads no external fonts, maps, social media buttons or videos hosted elsewhere.
If you do not fill in any form and do not consent to audience measurement, the only data processed during your visit is the server’s technical logs (IP address, date and time, page requested, browser type), recorded by our host to ensure the operation and security of the service, as well as the traffic measurement described in section 9.
04 The processing we carry out
| Purpose | Data processed | Legal basis | Retention |
|---|
| Responding to a contact or demo request, received through the website form or by email | Work email and phone number; where applicable first and last name, role, organisation, number of clinics or practices overseen, content of the message; for a request sent through the form, date, originating page and browser type | Pre-contractual measures taken at your request | 3 years from your last contact |
| Sending the Excel inventory template you request | Email address | Performance of your request | The time it takes to send it |
| Contacting you again after sending the Excel inventory template, unless you refused by ticking the box provided | Email address, date of the request | Pecify’s legitimate interest in developing its business with professionals | 3 years from the request, or until you object |
| Sending blog emails | Email address | Consent | Until you unsubscribe |
| Measuring the opening of blog emails, if you have agreed to it | Opening of each email, clicks on its links | Consent | 25 months at most |
| Marketing to professionals | First and last name, job title, work email and phone number, organisation, history of exchanges | Pecify’s legitimate interest in developing its business | 3 years from the last contact |
| Managing the contractual relationship | Contact details of the people we deal with, account data, exchanges | Performance of the contract | Term of the contract, then 5 years |
| Assistance and support | Login details, description of the request, technical logs | Performance of the contract | 3 years after the request is closed |
| Billing the subscription, collecting payments and chasing unpaid invoices, through our payment provider Stripe (section 6) | Company name, billing address and email, VAT and SIREN numbers, saved payment method (we receive only its type and last four digits), invoices and payments | Performance of the contract | Term of the contract, then retention of invoices (next row) |
| Accounting and retention of invoices | Billing details, invoices, payments | Legal obligation | 10 years from the end of the financial year |
| Measuring traffic to the website | Browsing data | Pecify’s legitimate interest in measuring traffic to its website | 25 months at most |
| Security of the website and the application, traceability | Connection and activity logs, IP address | Legitimate interest in ensuring security | 1 year |
| Unsolicited job applications | CV, cover letter, contact details | Pre-contractual measures | 2 years after the last contact, unless you object |
05 The Romaldent application
The application available at app.romaldent.fr is reserved for Pecify’s customers and their authorised users.
For user account data (first and last name, work email address, role, connection and activity logs), Pecify’s customer is the controller and Pecify acts as processor. This data is created, modified and deleted by the administrator appointed by the customer.
For the data strictly necessary for the operation, security and billing of the service, Pecify acts as controller, under the conditions described in section 4.
The cookies set by the application are described in section 9. None of them is used for audience measurement or advertising.
06 Who has access to your data
Your data is accessible:
- to authorised Pecify staff, within the limits of their duties and on a need-to-know basis;
- to our technical processors, acting on our instructions and bound by contractual confidentiality and security obligations: hosting, email delivery, technical monitoring, payment. The list of processors involved in the services subscribed to by our customers is kept up to date and provided to them;
- where applicable, to our advisers (chartered accountant, lawyer) and to administrative or judicial authorities that lawfully request it.
Subscription payments go through Stripe, our payment provider. Bank cards and IBANs are entered directly in Stripe’s form: Pecify neither sees nor keeps your card number or IBAN. Stripe issues invoices and collects payments on our behalf, as processor. For its own purposes, in particular fraud prevention and compliance with its legal anti-money laundering obligations, Stripe acts as controller, under the terms of its privacy policy.
We do not sell or rent your data to third parties, and we do not use it for advertising on behalf of third parties.
07 Where your data is hosted
The website, the application and the list of blog email subscribers are hosted by Infomaniak Network SA, a public limited company under Swiss law whose registered office is at Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. The data centres are located in Switzerland.
Switzerland benefits from an adequacy decision of the European Commission, adopted on 26 July 2000 and confirmed following the review completed on 15 January 2024. Transfers of personal data to Switzerland are therefore permitted without any specific formality and enjoy a level of protection recognised as adequate.
Billing and payment data is processed by Stripe (section 6), whose European entity is established in Ireland. Stripe may transfer it to its parent company, Stripe, Inc., in the United States. This transfer is covered by the EU–US Data Privacy Framework, recognised as adequate by the European Commission on 10 July 2023, to which Stripe, Inc. has signed up; where necessary, Stripe also relies on the standard contractual clauses adopted by the European Commission.
08 Security
We implement technical and organisational measures appropriate to the risk: encryption of data in transit, access control and segregation, strong authentication for administration accounts, logging, regular backups, and a confidentiality undertaking signed by anyone with access to the data.
These measures are described in detail in the “Security” annex provided to our customers.
09 Cookies and trackers
The romaldent.fr website
Audience measurement, with your consent
No cookie is set until you have accepted audience measurement. On your first visit, a banner asks you to accept or decline it. Declining does not affect your browsing in any way. Your choice is kept for six months, including a refusal, and you can change it at any time using the “Cookies” link at the bottom of the page: declining then deletes any cookies already set.
If you accept, the website loads Microsoft Clarity, a tool published by Microsoft Corporation. It records how the pages are used: pages viewed, clicks, scrolling, pointer movements, device and browser type. These recordings are used to spot what gets in the way of browsing. They are never used to identify you, are not cross-referenced with requests received through the contact form, and are not used for any targeted advertising.
The content of form fields is masked before recording: what you type (name, email address, phone number, message) is not sent to Microsoft.
| Cookie | Purpose | Duration |
|---|
_clck | Identifier assigned to your browser, to distinguish visits without naming you | 1 year |
_clsk | Links the pages viewed to the same visit | 1 day |
Microsoft may also set its own identifiers on its clarity.ms domain. This information is processed by Microsoft Corporation, which may host it outside the European Union; transfers are covered by the contractual safeguards provided for by the GDPR. The legal basis for this processing is your consent, which you can withdraw at any time without giving a reason.
Traffic measurement
The website measures its traffic for statistical purposes, on the basis of our legitimate interest. The data is kept for 25 months at most. You can object to this at any time:
Blog emails: measuring opens
If you agree to it when signing up, your emails contain a tracking pixel and tracked links, which tell us whether you open them and which links you click, so that we can improve them. The legal basis is your consent; without it, your emails contain no tracker. You can withdraw it at any time, without unsubscribing, with the form in the French version of this page, as the blog emails are in French.
The app.romaldent.fr application
The application sets five cookies, all strictly necessary for its operation or used to remember your display preferences. Its Billing page adds two security cookies set by Stripe, described below. None of them is used for audience measurement or advertising.
| Cookie | Purpose | Duration |
|---|
maintenance-dentaire-session | Keeps your authenticated session open. Encrypted cookie, inaccessible to JavaScript. | 120 minutes of inactivity, renewed with each action |
XSRF-TOKEN | Security token protecting your actions against request forgery | 120 minutes |
remember_web | Set only if you tick “Se souvenir de moi” (remember me) when logging in. Encrypted cookie. | 400 days |
appearance | Remembers your choice of light, dark or system theme | 365 days |
sidebar_state | Remembers whether the side menu is open or collapsed | 7 days |
Billing page: Stripe’s cookies
The subscription payment form is provided by Stripe, our payment provider (section 6). Its script, loaded by the Billing page, sets two cookies used solely to detect fraudulent payments. Stripe may set others on its own domains, for the same purpose.
| Cookie | Purpose | Duration |
|---|
__stripe_mid | Device identifier, to spot attempted payment fraud | 1 year |
__stripe_sid | Visit identifier, for the same purpose | 30 minutes |
Why no banner is shown to you
Article 82 of the amended French Act of 6 January 1978 only requires consent for trackers that are not strictly necessary for the service requested. The cookies above all fall within this exemption: they provide authentication, security, including payment security, or remember a preference you have expressed yourself. There is therefore nothing to consent to, and no banner to display.
You can delete these cookies at any time in your browser settings. Deleting the session cookie will log you out of the application.
10 Your rights
Under Regulation (EU) 2016/679 and the amended French Act no. 78-17 of 6 January 1978, you have the following rights:
- access: obtain confirmation that your data is being processed and receive a copy of it;
- rectification: have inaccurate or incomplete data corrected;
- erasure: request the deletion of your data, within the limits provided by law;
- restriction: request that a processing operation be temporarily suspended;
- objection: object to processing based on legitimate interest, and to direct marketing at any time and without giving reasons;
- portability: receive the data you have provided to us in a structured, machine-readable format;
- withdrawal of consent: where processing is based on your consent, withdraw it at any time, without affecting the lawfulness of prior processing;
- post-mortem instructions: set instructions on what happens to your data after your death.
To exercise these rights, write to donnees@pecify.fr or by post to the registered office. We may ask you for proof of identity if there is reasonable doubt about the identity of the person making the request.
We respond within one month of receiving the request, extended to three months for complex requests, in which case we inform you within the first month.
If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.
11 Automated decision-making
We do not carry out any decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, with one exception: unpaid subscriptions.
When an invoice is not paid, the application itself applies the steps provided for in the subscription contract: a reminder on the due date, blocking of access once the specified period has passed, then termination after notice. The only criterion is non-payment by the due date; no profiling is involved. This automation is necessary for the performance of the contract (article 22(2) of the Regulation). You can at any time obtain human intervention from Pecify, express your point of view and contest the measure, by writing to contact@pecify.fr.
The alerts and reminders produced by the Romaldent application are based on the information entered by the customer and are a matter for the customer’s judgement: they do not constitute automated decision-making within the meaning of article 22 of the Regulation.
12 Changes to this policy
We may update this policy to take account of legal, technical or functional changes. The applicable version is the one published on the website on the date you consult it. In the event of a substantial change, we will inform you by appropriate means.
This English text is a translation provided for information: in the event of any discrepancy, the French version prevails.
Last updated: 14 October 2026.
