Privacy policy

1. Data controller

LSKSoft, Appart 39, Street 8301, Montplaisir, Tunisia, is the controller of the personal data processed in the client portal. Contact for any question about your data: contact@lsksoft.com.

2. People and data concerned

Client users and prospects: first name, last name, business e-mail, job title, company, country, language, time zone, password (stored in irreversibly encrypted form), two-factor authentication if enabled, and your exchanges in the portal (requests, messages, uploaded documents, absence acknowledgements).

Consultants: first name, last name (never shown to clients), photo (with their consent), CV (title, level, skills, languages, assignments, education), leave and assignments, and the salary agreed for each assignment (visible to LSKSoft's administrators only). The reason for an absence and private notes are never shown to clients; the company of a past assignment is known only to LSKSoft.

No ID number or health data is recorded. Technical data (IP address, security logs) is processed to protect the portal.

3. Purposes and legal bases

Providing the client portal and managing the relationship: performance of the contract or, for a prospect, pre-contractual steps (estimate, reply to a request).

Keeping invoices: legal obligation.

Calculating an assignment's rate from the consultant's salary: performance of the employment or partnership contract with the consultant and LSKSoft's legitimate interest in setting its prices. The salary is never shown to clients or to other consultants.

Securing the portal (two-factor authentication, attempt limits, log of sensitive actions): legitimate interest of LSKSoft and its clients.

Showing a consultant's photo and CV to the clients they are assigned to: the consultant's consent, which they can withdraw at any time (their photo is then replaced by initials).

Sending service e-mails (confirmation, invitations, absences, proposals, invoices): performance of the contract. Non-essential notifications can be set in the settings.

4. Recipients

LSKSoft's teams, who run the portal from Tunisia. Members of your organization, according to the rights set by its owner. Clients a consultant is assigned to, for their first name, photo and published CV. Each organization sees only its own data; this separation is enforced by the database itself.

Technical providers acting on behalf of LSKSoft: Supabase (database, accounts and files, servers in Frankfurt (Germany)), Vercel (application hosting, servers in Frankfurt) and Google Workspace (e-mail delivery).

No data is sold or used for advertising.

5. Transfers outside the European Union

LSKSoft's teams access the data from Tunisia, a country not covered by a European Commission adequacy decision. These transfers are governed by the European Commission's standard contractual clauses.

Vercel, Supabase and Google belong to groups established in the United States; any transfers to that country are governed by the EU–US Data Privacy Framework and/or the standard contractual clauses in their data processing agreements.

6. Retention periods

Client account: for the whole relationship. When it ends, the organization is archived and its access cut; its data is kept 10 years (legal retention period for invoices), then deleted automatically with its files and accounts. A client without invoices can be deleted immediately on request.

Prospect without a business relationship: at most 3 years after the last contact. Sign-up never confirmed: 30 days.

Consultant: during the collaboration; afterwards, their data is deleted on request, files included (except during an ongoing assignment). The salary entered for an assignment is deleted with it.

Technical security data: as long as needed to protect the portal; attempt counters are erased daily.

7. Security

Encrypted connection (HTTPS), data hosted in the European Union, strict separation between organizations, private files reached through temporary links, two-factor authentication mandatory for administrators, content checks on uploaded files, log of sensitive actions.

8. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as to withdraw your consent and to set instructions for what happens to it after your death.

To exercise them, write to contact@lsksoft.com. Proof of identity may be requested. We reply within one month.

You can also lodge a complaint with the CNIL (cnil.fr) or the data protection authority of your EU country, or with Tunisia's national personal data protection authority (inpdp.tn).

9. Cookies

The portal uses only strictly necessary cookies, which require no consent: the sign-in session (Supabase, valid until you sign out or after a period of inactivity) and the chosen language (NEXT_LOCALE, for the browsing session).

No audience measurement, advertising or social network cookie is used.

10. Changes

This policy may change; the last update date is shown at the top of the page. In case of a significant change, users are informed in the portal or by e-mail.