Effective as of October 6, 2025. This English version is provided for convenience only. In case of discrepancy, the French version shall prevail.
Publisher: Sole proprietorship Pierre ABOUCAYA (trade name: Orchesia)
SIREN: 942 838 244 — SIRET (head office): 942 838 244 00013
Head office: 8 rue du Pont de l’Abbaye, 59520 Marquette-lez-Lille (France)
Contact: contact@orchesia.com
Covered services: https://www.orchesia.com (website) and https://app.orchesia.com/app (application)
We may update this policy at any time. Changes are published here and, if necessary, notified by email or in-app depending on their importance.
This privacy policy sets out our commitment to protecting your privacy when using https://www.orchesia.com (website) and https://app.orchesia.com/app (application), operated by SP Pierre ABOUCAYA (Orchesia).
In operating the website https://www.orchesia.com and the application https://app.orchesia.com/app, we collect and process your personal data in compliance with the GDPR (EU) 2016/679 of 27 April 2016.
This policy explains what data we process, why, on which legal bases, for how long, with whom we share it, and your rights. It applies to the website, the application, support and billing. It complements our Terms of Use/Sale.
We process your data in accordance with the GDPR; applicable legal bases are detailed in Section 3.
Controller: SP Pierre ABOUCAYA (Orchesia) — registered with the RNE SIREN: 942 838 244 — SIRET (head office): 942 838 244 00013 Head office: 8 rue du Pont de l’Abbaye, 59520 Marquette-lez-Lille (France) Privacy contact: contact@orchesia.com
Orchesia has not appointed a DPO under Article 37 GDPR. For any privacy question or to exercise your rights, write to contact@orchesia.com.
We do not collect special categories of data (“sensitive data”) within the meaning of the GDPR.
Required fields are indicated; without them we may be unable to create the account, provide the service, or invoice.
No automated decision produces legal effects concerning you.
We seek your consent only for processing activities that require it (e.g., marketing, non-essential cookies).
Processing necessary for account creation/management, service delivery, first-level support and billing relies on contract performance (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)).
A banner allows “Accept all”, “Reject all”, “Customize”. You can change your choices anytime via “Cookie settings”. The list and lifetime of cookies are detailed in the Cookie Charter (Annex).
Proof of cookie consent: we keep a record of your choices (consent/refusal) for as long as needed for management and proof.
Access is strictly limited to authorized Orchesia personnel and our partners (categories listed below). The detailed list of main providers, their roles and links is in Article 6.4.
No transfer outside the EU/EEA is made without appropriate safeguards under Article 46 GDPR. Some providers may process data outside the EU/EEA (e.g., United States). We apply appropriate safeguards (SCCs, transfer assessments, encryption, minimization) and transfer only what is necessary.
We do not sell or rent your personal data. We share it only where strictly necessary:
We may retain or disclose data to comply with a legal obligation or a valid, necessary and proportionate request from an administrative or judicial authority. Legal basis: legal obligation (Art. 6(1)(c) GDPR) or legitimate interests (defense in legal proceedings, Art. 6(1)(f)).
We never receive your passwords in clear text. They are hashed and salted. If forgotten, a reset via temporary token is offered; the existing password cannot be recovered.
Data is encrypted in transit (HTTPS/TLS) and at rest (database, attachments, backups). The service is not end-to-end encrypted (E2EE): keys are managed by our servers to operate the app (processing, search, backups).
Exceptional access to data may occur in the cases provided in Articles 7.3 to 7.6 (support with consent, legal requisitions, anti-fraud), under authorization, with minimization and access logging (Article 7.7).
Exceptionally and duly justified, we may access certain data (including Customer Content) via an admin panel in order to:
All access is permissioned, minimized and logged (who, when, why, consulted scope).
We may analyze usage indicators (e.g., number of projects, tasks, storage volumes, technical signals) and, in case of serious suspicion, perform targeted checks including the bare minimum of Customer Content. Legal basis: legitimate interests. Right to object for legitimate reasons, unless compelling grounds.
We may retain or disclose certain data in order to comply with a legal obligation or to respond to a request from a competent authority (such as the police or judicial authorities). We only respond to valid, necessary, and proportionate requests, after appropriate verification.
If needed, we may request your explicit consent for temporary and limited access to your data for diagnostics/resolution. Without consent, we restrict ourselves to technical logs and metadata. Granted access is temporary, tracked and limited.
All sensitive access (notably admin access to Customer Content) is logged (who, when, why, scope) and retained for 12 months.
We implement appropriate and proportionate technical and organizational measures to ensure the confidentiality, integrity, availability, and resilience of personal data, in accordance with the GDPR. These measures are reviewed periodically and adjusted in line with evolving risks, technological developments, and implementation costs.
Measures may include appropriate encryption in transit and at rest, access controls and strong authentication, sensitive access traceability, backups and restoration tests, security monitoring and vulnerability management, and contractual safeguards with our providers (including for transfers outside the EU).
In case of a personal data breach, we follow our incident response procedure and will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, in accordance with Article 33 GDPR.
When a data breach is likely to result in a high risk to the rights and freedoms of individuals, we will inform the affected persons without undue delay, in clear and plain language, about the recommended protective measures and the contact details for further information, in accordance with Article 34 of the GDPR. Where the law allows (for example, when data has been rendered unintelligible through strong encryption), such individual notification may not be required.
As a user, you are granted several rights under the GDPR and the French Data Protection Act, including:
We will respond without undue delay and at the latest within one (1) month of receiving your request. This period may be extended by two (2) months due to complexity or number of requests; in that case, you will be informed within one month of the reasons for the extension.
We may request additional information to verify your identity where necessary and only in case of doubt. When a request is made electronically, we will respond by electronic means where possible, unless you request otherwise.
Where a request is manifestly unfounded or excessive (notably repetitive), we may refuse to act on it or charge a reasonable fee based on administrative costs (with justification).
The version date at the top is updated; for significant changes, a dedicated notice is sent (email/in-app).
Any privacy questions or rights requests: contact@orchesia.com.
On first visit, a panel offers Accept all / Reject all / Manage preferences. You can modify your choices at any time via “Cookie settings”.
A. Necessary (no consent)
| Name | Provider | Purpose | Duration | Domain | Secure | HttpOnly | SameSite | Legal basis |
|---|---|---|---|---|---|---|---|---|
| orchesia_cookie_consent | Orchesia (1P) | Store your choices (analytics, YouTube) + timestamp | 6–12 months (currently 180 days) | .orchesia.com | Yes | No | Lax | Necessary (consent management) |
Example value: v=1|nec=1|ana=1|ytb=0|ts=2025-10-09T09:12:00Z.
B. Audience measurement (with consent)
| Tool | Provider | Purpose | Data processed | Legal basis |
|---|---|---|---|---|
| Google Analytics 4 (GA4) | Aggregated traffic statistics (pages, events) | Online identifiers, browser/IP info (IP anonymized), events | Consent (opt-in) |
Conditional loading: GA4 only if “Analytics” accepted.
Settings: IP anonymized, no ad retargeting via GA4.
C. Video player (with consent)
| Tool | Provider | Purpose | Data processed | Legal basis | When set |
|---|---|---|---|---|---|
| YouTube (iframe) | Google/YouTube | Embedded video playback | Online identifiers, browser info | Consent (category “YouTube”) | On load or interaction; youtube-nocookie.com when possible |
D. Local storage (non-cookie)
| Type | Example | Purpose | Legal basis |
|---|---|---|---|
| localStorage / sessionStorage | Non-sensitive UI preferences | Ease of use / navigation | Legitimate interests / necessary for the service |
This charter may be updated. Significant changes will be specifically notified.
Questions / rights: contact@orchesia.com