Privacy policy

Last updated: September 30, 2026

1. Purpose and scope

This policy explains how Datakeen SAS processes the personal data of the people it interacts with: website visitors, prospects, customers and their contacts, newsletter subscribers, job applicants and suppliers.

It applies to the www.datakeen.co website and its subdomains, including the app-v3.datakeen.co platform, to business communications (email, phone, video calls, trade shows) and to the tools we use to manage these relationships.

Datakeen employees are informed about the processing of their data through a separate internal notice.

It does not cover data processed during an identity verification journey carried out on behalf of a Datakeen customer. That processing is described in the Personal Data Processing Information Notice (see section 4).

2. Who is responsible for your data?

For the processing described in this policy, the data controller is Datakeen SAS, a French simplified joint-stock company (SAS) with share capital of €2,000, registered with the Nanterre Trade and Companies Register (RCS) under number 825 303 910, with its registered office at 176 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France.

Datakeen may act in two distinct roles:

• Data controller for the website, platform user accounts and support, prospecting, customer relations, the newsletter, events, recruitment and suppliers: this policy applies.
• Processor within the meaning of Article 28 GDPR for identity verification carried out on behalf of a customer (bank, insurer, platform…): the dedicated information notice applies.
• Processor within the meaning of Article 28 GDPR for document and file analysis and AML screening carried out on behalf of a customer: section 4 of this policy and the customer's privacy policy apply.

Data Protection Officer (DPO): dpo@datakeen.co, or by post to the registered office address, for the attention of the DPO.

3. What data do we process, why and on what legal basis?

We only process the data needed for each purpose. We do not process any sensitive data (health, opinions, origin, biometrics…) in the processing described here.

Where does your data come from?

Most data is provided directly by you: forms, emails, sales conversations, job applications.

For prospecting, some business data also comes from public sources (your company website, LinkedIn profile), trade shows and events, or business contact enrichment tools. In our first message, we tell you how we obtained your contact details and how to opt out of our communications.

Our prospecting commitments

• Our messages cover topics related to your professional role.
• Every email contains an unsubscribe link, which takes effect immediately.
• We do not prospect private individuals, and we never sell or rent your data.
• We may measure opens and clicks on our emails and assign an interest score to your record to prioritize our outreach, as permitted by applicable regulations. This has no legal effect on you.

No fully automated decision producing legal effects concerning you is made as part of this processing.

4. Processing carried out on behalf of our customers

When we provide our solutions to a customer (bank, insurer, property manager, business…), that customer is the data controller. Datakeen acts solely as a processor, on the customer's instructions, and does not reuse the data for its own purposes.

Identity verification

If one of our customers directed you to a Datakeen identity verification journey (document capture, NFC chip reading, selfie), that customer is the data controller. Datakeen acts solely as a processor, on the customer's instructions.

This processing is described in the Personal Data Processing Information Notice: data collected, use of artificial intelligence, sub-processors, security.

Document and file analysis

Our customers may entrust us with documents to analyze: tenant or guarantor application documents, proof of address or income, HR documents, etc. We extract the information and check its authenticity and consistency. You may therefore be concerned without having used a Datakeen service yourself, for example if you act as a guarantor.

Datakeen does not perform any tenant scoring or creditworthiness assessment. We produce no rating, ranking or recommendation about the person: we only flag the document anomalies detected. The decision to accept an application or not rests solely with the customer.

AML screening (sanctions and politically exposed persons)

To meet their anti-money laundering and counter-terrorist financing obligations, our customers may check whether a person appears on sanctions lists or lists of politically exposed persons. Only the data needed for the search is processed (last name, first name, date of birth, nationality), through a specialized provider whose data is hosted in the European Union. The result is sent to the customer, who analyzes it and decides what action to take.

In all cases, as a processor:

• the data is used solely to produce the result requested by the customer;
• it is not used to train our models or for commercial purposes;
• the retention period is set by the customer;
• you should exercise your rights primarily with the customer. If you write to us by mistake, we will forward your request to them as soon as possible.

5. Who has access to your data?

Internally, only the teams that need it have access to your data: sales and marketing for prospecting, management and accounting for contracts and billing, and the people in charge of recruitment for job applications.

We use the following service providers, who act on our instructions under a contract compliant with Article 28 GDPR:

Your data may also be disclosed:

• to administrative or judicial authorities, where required by law;
• to our advisers (lawyers, statutory auditors), who are bound by professional secrecy;
• to an acquirer or a company in the same group in the event of a merger, sale or reorganization of all or part of Datakeen's business. Your data would then continue to be processed in accordance with this policy.

We do not sell or rent your data to third parties.

6. Is your data transferred outside the European Union?

We favor service providers that host data in the European Union. Some transfers outside the EU remain possible:

• audience measurement (Google Analytics), website hosting (Webflow) and platform support (Intercom): data processed in the United States;
• occasional access by some providers (HubSpot, Google Workspace) from the United States, for support or maintenance.

These transfers are governed by the European Commission's adequacy decision on the Data Privacy Framework for certified providers or, failing that, by the standard contractual clauses adopted by the Commission.

You can obtain a copy of these safeguards by writing to dpo@datakeen.co.

7. How long do we keep your data?

At the end of these periods, data is deleted or anonymized. Some data may be archived for longer, with restricted access, where a legal obligation or the defense of our rights requires it.

8. Cookies and trackers

On your first visit, a banner lets you accept or refuse non-essential cookies, just as easily either way. Continuing to browse does not count as acceptance.

You can change your choices at any time by deleting cookies in your browser settings, which will make the banner reappear on your next visit. Refusing non-essential cookies does not prevent you from using the website.

9. How do we protect your data?

We apply technical and organizational measures appropriate to the risks:

• encryption of data in transit and at rest;
• access limited to those who need it, with strong authentication;
• logging of access to our tools;
• encrypted backups hosted in France, and a business continuity plan;
• a confidentiality undertaking signed by every employee and regular data protection awareness training for our teams;
• selection of service providers offering sufficient security guarantees, bound by a data processing agreement.

Our information security management system is being brought into compliance with the ISO/IEC 27001 standard.

In the event of a data breach posing a risk to your rights, we notify the CNIL (the French data protection authority) within 72 hours. If the risk is high, we also inform you.

10. What are your rights?

You have the following rights over your data:

• access: obtain confirmation that we process your data and receive a copy of it;
• rectification of inaccurate or incomplete data;
• erasure, unless a legal obligation or the defense of our rights requires us to keep it;
• restriction of processing, in particular while a dispute is being reviewed;
• portability of the data you provided to us, where processing is based on your consent or on a contract;
• objection to processing based on our legitimate interest. For prospecting, your objection is honored unconditionally and without justification;
• withdrawal of your consent at any time, for the newsletter or cookies;
• instructions on what happens to your data after your death.

To exercise these rights:

1. use the unsubscribe link in each of our emails, for prospecting and the newsletter;
2. or write to dpo@datakeen.co;
3. or write to Datakeen SAS, for the attention of the DPO, 176 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France.

We respond within one month, which may be extended by two months for complex or numerous requests; we would inform you if so. We only ask for proof of identity if there is reasonable doubt about your identity.

11. Complaints and updates

If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

We update this policy when our processing or the regulations change, and at least once a year. The date of the last update appears at the top of the page. In the event of a significant change, we will inform you via a message on the website or by email.