Privacy policy
This page sets out what personal data we collect through this website, what we do with it, how long we keep it, and the rights you have.
About this translation
This page is an English translation provided for convenience only. The data controller is a French company and this policy is issued under French law and the EU General Data Protection Regulation. In the event of any discrepancy or dispute, the French version prevails and is the only legally binding text: Politique de confidentialité.
Last updated:
1. Who is responsible for your data
The data controller is ATHELIANS, SAS (société par actions simplifiée, a French simplified joint-stock company), whose registered office is at 45 avenue Coriandre, Zone Athelia II, 13600 La Ciotat, France, registered under number 93924260800015. Full details are given in our legal notice .
For any question about your personal data, or to exercise your rights, write to privacy@lemmpo.com or use our contact form .
This policy covers the www.lemmpo.com website. Processing inside the Lemmpo application, when you are a customer, is governed by the contract signed with your organization: in that context your employer is the data controller and Lemmpo acts as a processor.
2. What we process, why, and for how long
Each processing operation serves a specific purpose and relies on an identified legal basis.
Handling and answering your demo or contact request
- Data:
- First name, last name, work email, company, phone (optional), team size (optional), message (optional), answer to “How did you hear about us?”
- Legal basis:
- Steps taken at your request prior to entering into a contract (GDPR art. 6(1)(b))
- Retention:
- 3 years from our last contact with you, in line with the French data protection authority's guidance on business prospecting
Measuring which channel brought you to us, in order to evaluate our marketing
- Data:
- UTM parameters, referring site, landing page, advertising click identifiers (gclid, fbclid, li_fat_id, msclkid), date of first visit
- Legal basis:
- Your consent, collected through the banner shown on your first visit (French Data Protection Act art. 82). Without your acceptance, none of this data is collected
- Retention:
- Tracker: 180 days. Record of consent: 13 months if accepted, 6 months if refused. Data attached to a request: same duration as the request
Keeping the site secure, diagnosing incidents and detecting abuse
- Data:
- IP address, user agent (browser and system), timestamp, pages viewed
- Legal basis:
- Legitimate interest in protecting the service (GDPR art. 6(1)(f))
- Retention:
- 6 months for technical logs
Following up the business relationship that began with your request: exchanges, call notes, documents exchanged, next steps
- Data:
- Professional identity and contact details, job title, content of emails exchanged with us and of the related internal notes, attachments, history of the deal's stages
- Legal basis:
- Legitimate interest in following up our business exchanges (GDPR art. 6(1)(f)), and pre-contractual steps where the request came from you (art. 6(1)(b))
- Retention:
- 3 years from the last exchange. Exchanges attached to a customer are kept under the contractual relationship
Receiving, handling and keeping a record of your support requests
- Data:
- Name, email address, company where applicable, content of your request and of our replies, attachments you send us
- Legal basis:
- Performance of our contract where you are a customer (GDPR art. 6(1)(b)), legitimate interest in answering otherwise (art. 6(1)(f))
- Retention:
- 3 years after the ticket is closed
Identifying businesses that may be interested in our services, and preparing a professional approach
- Data:
- Company data from the public business register (legal name, SIREN, address, activity, headcount band) and, where listed, the NAME and ROLE of the director. We copy neither their date of birth nor any personal contact details: the register publishes them, we do not copy them
- Legal basis:
- Legitimate interest in developing our business with professionals (GDPR art. 6(1)(f)). You may object at any time, without having to give a reason
- Retention:
- 12 months if no contact is made. Once contact takes place, the data joins the business follow-up and follows its retention period
Informing you about our software updates and professional news, and measuring whether those messages are opened
- Data:
- First name, last name, professional email address, company name. For measurement: the send date, the dates of the first and last image load in the message, and a counter. We record neither your IP address, nor your browser, nor any location data
- Legal basis:
- Legitimate interest in informing our professional contacts about our services (GDPR art. 6(1)(f)). Every message carries an unsubscribe link; an objection is permanent and overrides any other criterion
- Retention:
- 3 years after sending, for the recipient list and open measurement. Unsubscribed addresses are kept WITHOUT TIME LIMIT, solely to guarantee we no longer write to you: deleting them would amount to re-subscribing you
Sending you the acknowledgement of your request
- Data:
- First name, last name, email address
- Legal basis:
- Steps taken at your request prior to entering into a contract (GDPR art. 6(1)(b))
- Retention:
- Delivery logs retained by our email provider under its own policy
Required fields in our forms are marked with an asterisk. Without them we cannot handle your request. The other fields are optional and have no bearing on our response.
3. Who receives your data
Your data is accessible to the Lemmpo sales and technical staff who need it. It is never sold, rented or traded. It is also processed by the following providers, acting on our instructions:
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Website and database hosting | France |
| Mailjet (groupe Sinch) | Transactional email delivery | European Union |
| OVHcloud AI Endpoints | AI assistance, when enabled: the content of an exchange may be sent to obtain a suggested reply or action. People we know are replaced by a pseudonym beforehand, and no model is trained on this data | France |
Your data may also be disclosed where the law requires it, in particular in response to a judicial order.
4. Transfers outside the European Union
Data collected through this site is hosted and processed within the European Union. No transfer to a third country takes place in the context of this website.
The Lemmpo application, reserved for customers, relies on a limited number of services located outside the European Union, at the edge of the product — subscription payment processing and push notification delivery in particular. The complete list, with each provider's role and location, is shared on request as part of our security questionnaire.
5. Cookies and trackers
On your first visit, a banner asks whether you accept the measurement tracker described below. Nothing is stored on or read from your device before you answer. Refusing is as easy as accepting and has no effect on your browsing: the entire site remains accessible.
Your choice is stored so you are not asked again on every page — 13 months if you accept, 6 months if you refuse — after which you are asked again. You can change it at any time using the link at the bottom of every page. Withdrawing immediately deletes any trackers already set.
| Tracker | Purpose | Duration | Nature |
|---|---|---|---|
| lm_ft | Records the channel that brought you to the site (marketing attribution). Set on the .lemmpo.com domain so the journey can be followed through to the application. | 180 days | Consent required |
| lm_ft / lm_lt (stockage local) | Same purpose as the cookie above, held in your browser's local storage. | Until you clear your browsing data | Consent required |
| lm_consent | Records whether you accepted or refused the measurement trackers, so we neither ask again on every page nor lose the record of your choice. This tracker is strictly necessary to honour your decision. | 13 months if accepted, 6 months if refused | Strictly necessary |
| Cookies de session de l'espace d'administration | Keeping authorized users signed in to the administration area. Authentication is impossible without them. | Session duration | Strictly necessary |
We use no advertising network, no third-party analytics tool and no social media button that sets a tracker. No browsing data is passed to an advertiser.
Independently of this banner, you can delete trackers and block them from your browser settings.
6. Security
Traffic to and from the site is encrypted. Database access is restricted to authorized staff and logged. Since no method of transmission or storage is infallible, we cannot guarantee absolute security — but we undertake to inform you without undue delay of any breach likely to result in a high risk to your rights, in accordance with article 34 of the GDPR.
7. Your rights
You have the following rights over the data concerning you:
- • Right of access — confirm whether your data is being processed and obtain a copy of it (art. 15).
- • Right to rectification — have inaccurate or incomplete data corrected (art. 16).
- • Right to erasure — request deletion of your data, within the limits of our legal retention obligations (art. 17).
- • Right to restriction — ask us to freeze a processing operation, for instance while the accuracy of contested data is checked (art. 18).
- • Right to data portability — receive the data you provided in a structured, machine-readable format, or have it transmitted directly to another organization (art. 20).
- • Right to object — object to processing based on our legitimate interest, and at any time without giving a reason where direct marketing is concerned (art. 21).
- • Withdrawal of consent — withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (art. 7(3)).
- • Post-mortem instructions — set instructions on what should happen to your data after your death (art. 85 of the French Data Protection Act).
To exercise these rights, write to privacy@lemmpo.com . We respond within one month, extendable by two further months for complex requests. Proof of identity may be requested where there is reasonable doubt as to who is making the request.
8. Complaint to the supervisory authority
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr .
You may also contact the supervisory authority of your country of residence within the European Union.
9. Changes to this policy
This policy may change, in particular if our processing operations change. Any amendment is published on this page with a new update date. Where a substantial change affects your rights, we will inform you by an appropriate means.
See Lemmpo in action
Book a personalized demo and see how Lemmpo fits the way your teams work.