Privacy policy

VALKO, a sole proprietor (entrepreneur individuel) established in Sens (89100), France, provides the CRM and manages accounts, access, security and technical operation.

The organizations that use Valko decide the purpose of their sales follow-up, which members of their team may access the data and how long it is kept. For any question, you can write to services@valko.fr.

Lead data may come from:

• Facebook forms linked to the Pages connected by an organization that uses the CRM;
• imports of past leads from Meta;
• CSV files imported by authorized members of the team;
• information added by the team during the sales follow-up.

• Lead data: name, contact details, city, postal code, answers given in the forms, advertising-related identifiers and the associated dates.
• Follow-up data: notes, statuses, priority score, appointments, assignment to a member of the team and the history of the actions needed to handle the lead.
• CRM account data: name, email address, role, group, password stored in hashed form, sessions and security records, including a fingerprint of the IP address and information about the browser.
• Meta connection data: Page identifiers and access tokens, stored in encrypted form.
• Contact requests: name, email address, message and, if given, the company and phone number typed into the form of the home page. They are sent to VALKO by email and are not stored in the CRM.

• receiving and importing the leads sent by Meta or in a CSV file;
• organizing the sales follow-up, reminders, appointments and the sharing of work;
• qualifying and prioritizing requests with statuses and a score;
• managing the accounts, roles and access of teams;
• securing the service, maintaining sessions and tracing sensitive activity;
• connecting Meta Pages and sending the Web Push notifications a user chose to turn on;
• replying to the requests sent from the form of the home page.

Business data can be accessed by the authorized people of the organization that uses the CRM, according to their role and their group. VALKO can access it when support, security or the operation of the CRM requires it.

The service relies on the following providers and technical services:

• Hostinger for technical hosting and email;
• Google (Gmail) for a second mailbox, which receives a copy of contact requests;
• Meta for Facebook forms, the connection of Pages and the related imports;
• geo.api.gouv.fr to look up a town from the city and the postal code only;
• OpenStreetMap for map tiles, requested directly by the browser, which gives the tile servers the usual technical information of a request, including the IP address;
• the Web Push provider of the browser, when a user chooses to turn notifications on.

The Hostinger server used by Valko is located in France. The backups of this hosting are located in Lithuania, according to the information provided by Hostinger.

Meta, Google, the map services and the notification provider of the browser also apply their own data processing terms. The location of the Valko hosting does not mean that all of these external services process their data exclusively in the European Union. You can contact services@valko.fr with any question about the services used for your records.

The CRM uses the cookies needed to sign in and to protect the actions made from your session. One of them remembers, for 400 days at most, that a device was already allowed to display the sign-in page. The theme and the state of the menu may be kept locally in the browser. The CRM includes no Meta Pixel and no audience analytics tool.

The public site exists in French and in English. The language you choose with the FR / EN switch is kept in a strictly necessary cookie named site_language, stored for 12 months at most: it is set when you open, from a page of the site, the home page in a given language, which is what the switch does. Without that choice, the language of the home page is decided by our server from the country your IP address is assigned to and from the language of your browser, using a local table and without calling any outside service: the address is not stored for this.

The public site asks for your choice before any audience measurement. That choice is kept for 6 months in a strictly necessary cookie named site_consent, after which you are asked again. You can change it at any time with the “Cookies” button at the bottom of every page of the public site. Until you have answered, and if you choose “Necessary only”, nothing is measured.

If you accept audience measurement, and only then, our server itself records, with no outside tool and no advertising: the public pages viewed and their language, the light or dark theme, the kind of device inferred from the width of the screen, the domain name of the site that led you here, the campaign words of a link (utm_source, utm_medium, utm_campaign), the sections reached, how far the page is read in quarters, the buttons and links used, the questions opened, the controls of the demo, the fact that the form was started, refused (the field concerned, never its content) or sent, and the time spent on the page. Two cookies are then set: site_visitor, a random identifier kept for 13 months at most and never extended, and site_visit, a visit identifier that expires after 30 minutes without activity. Neither your IP address, nor the identity of your browser, nor the full address of the page you came from, nor what you type in a form is stored with these measurements. They are read by VALKO only, to improve the site.

If you withdraw your agreement, both identifiers are removed from your browser and nothing more is measured: the measurements already stored can no longer be linked to your browser. Each answer to the banner is counted without any identifier, to know the share of each choice. To limit abuse, a fingerprint of the IP address is stored temporarily when a choice or a measurement is sent.

The organization that uses the CRM decides how long leads are kept, according to its needs and obligations. The CRM currently has no general period after which leads are purged automatically. They are therefore kept until they are deleted by hand or until the organization concerned gives an instruction.

• Deleting a lead from the CRM removes its business data and the content received by webhook. Backup copies and some technical identifiers are not erased instantly.
• Disconnecting a Meta Page removes its access token, but does not delete the leads already imported.
• Deleting a CRM account deactivates and anonymizes it while preserving the history the service needs to operate. It is not an exhaustive erasure of every trace.
• The activity log is limited to the last 90 days and to 50,000 entries. The oldest entries are purged when a new activity is recorded and one of these limits is exceeded.
• Contact requests are kept in VALKO’s mailbox for as long as it takes to handle them and the exchanges that follow. To limit abuse, a fingerprint of the sender’s IP address is stored temporarily.
• The audience measurements of the public site are kept for 13 months at most, then deleted automatically.

Valko limits access according to roles and groups. Passwords are hashed, Meta tokens are encrypted and security records are kept to protect accounts and to review sensitive activity.

Under the conditions set by the applicable law, you can ask to access your data, to have it corrected or deleted, to object to or restrict its processing, or to receive it in a portable form. If your data was collected by an organization that uses the CRM, you can also contact that organization directly so that it finds your records faster.

To send a request to VALKO, see the data deletion procedure or write to services@valko.fr. You can also lodge a complaint with the CNIL, the French data protection authority.