Privacy and data protection policy
Last updated: September 2026
Only the French version of this policy is legally binding; this English translation is provided for convenience. Rate A Company cares about the protection of your personal data. This policy explains which data we collect, why, how long we keep it, with whom we share it and what your rights are, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi n° 78-17 of 6 January 1978, as amended).
1. WHO IS RESPONSIBLE FOR YOUR DATA?
The data controller is Rate A Company, a French simplified joint-stock company (SAS) with share capital of
€45,000, registered with the Lyon Trade and Companies Register under number 808 980 569, with its
registered office at 66 rue Cuvier, 69006 Lyon, France, publisher of the website rateacompany.com.
For any question about your personal data or to exercise your rights, write to us at
contact@rateacompany.com.
Rate A Company has not appointed a data protection officer, as this is not mandatory for its activity.
2. WHICH DATA DO WE COLLECT, AND WHY?
We only collect the data needed for the services you use.
When you create a user account
Data: title, username, first name, last name, date of birth, email address, password (stored in hashed
form, never in clear text), preferred language and, if you choose to provide them, profile picture,
address, country, nationality and interests. If you sign up through Facebook, Google or LinkedIn, we
receive your identifier, name and email address from that service.
Purpose: to create and manage your account, allow you to publish reviews, and send you the emails needed
to operate the service (registration confirmation, password reset, notifications about your reviews).
Legal basis: performance of the contract (the Terms of Use you accept when registering).
When you rate or comment on a company
Data: ratings given, comments, replies, publication date, displayed username, declared relationship with
the company (customer, employee, supplier, etc.).
Purpose: to publish your review on the company’s page, calculate aggregated scores, and moderate
content in accordance with the Terms of Use.
Legal basis: performance of the contract; Rate A Company’s legitimate interest in ensuring the
reliability of reviews and preventing fake reviews.
When you represent a company (professional user)
Data: identity and position of the representative, professional email address and telephone number,
company identification data (company name, registration number, address, size, sector), information
provided in connection with an audit, labelling, training or the rental of a communication space.
Purpose: management of the company page, performance of the services ordered, invoicing, business
relationship.
Legal basis: performance of the contract or pre-contractual measures; legal obligations (accounting,
invoicing).
When you take part in a CSR audit as a stakeholder
Data: name, email address, relationship with the audited company, questionnaire answers, choice regarding
the publication of your review.
Purpose: to carry out the audit requested by the client company, produce the report and, with your
agreement, publish your review.
Legal basis: legitimate interest of Rate A Company and of the audited company in carrying out the audit;
consent for the online publication of your review.
When you contact us (contact form, email)
Data: name, email address, content of the message.
Purpose: to answer your request.
Legal basis: legitimate interest (answering requests) or pre-contractual measures.
When you browse the site
Data: IP address, browser type, pages visited, date and time, cookies (see section 8).
Purpose: security and proper operation of the site (technical logs, protection of forms against bots),
audience measurement.
Legal basis: legitimate interest (security, prevention of abuse) for technical logs and form protection;
consent for audience measurement.
3. WHO HAS ACCESS TO YOUR DATA?
Your data is processed by Rate A Company’s authorised staff, within the limits of their duties. It may
be transmitted to the following providers, who act on our behalf and on our instructions (processors
within the meaning of Article 28 of the GDPR):
- o2switch (Clermont-Ferrand, France): hosting of the site and database, sending of service emails;
- Google Ireland Ltd / Google LLC: audience measurement (Google Analytics), only if you have accepted audience-measurement cookies; protection of the registration and contact forms against bots (reCAPTCHA);
- Meta Platforms Ireland, Google Ireland Ltd and LinkedIn Ireland: only if you choose to log in with your Facebook, Google or LinkedIn account.
Your reviews and ratings are, by nature, published on the site and therefore visible to all visitors, under your username. We do not sell or rent your data to third parties. It may be disclosed to the authorities where required by law.
4. DOES YOUR DATA LEAVE THE EUROPEAN UNION?
Your data is hosted in France. Audience measurement (Google Analytics), form protection (reCAPTCHA) and
social login may involve a transfer of data to the United States. These transfers are governed by the
European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, to
which these companies have subscribed, and by the European Commission’s standard contractual clauses.
Audience measurement only takes place if you have accepted the corresponding cookies.
5. HOW IS YOUR DATA PROTECTED?
Rate A Company implements appropriate technical and organisational measures: encrypted connection
(HTTPS), passwords stored in hashed form, restricted and password-protected database access, regular
backups, security updates, and access to data limited to those who need it. No system is infallible,
however. In the event of a data breach likely to result in a high risk to your rights and freedoms, we
will inform you in accordance with the regulations.
6. HOW LONG DO WE KEEP YOUR DATA?
| Data | Retention period |
|---|---|
| User account | For as long as the account exists, then deleted within one month of its closure |
| Inactive accounts | Deleted after 3 years without login, following a warning email left unanswered |
| Reviews, ratings and comments | Published for as long as the account exists; when the account is closed they are anonymised (the username is removed and the link with your account is severed) and kept for the calculation of company scores |
| Data of professional users and customers | Duration of the contractual relationship, then archived for 5 years (commercial limitation period); invoices and accounting records are kept for 10 years (Article L. 123-22 of the French Commercial Code) |
| Data of audit stakeholders | Duration of the audit and of the label’s validity, then 3 years |
| Contact form messages | 1 year from the last exchange |
| Technical logs (IP address, logins) | 12 months maximum |
| Consent cookie | 6 months |
| Google Analytics cookies | 13 months maximum; associated statistical data: 14 months |
7. WHAT ARE YOUR RIGHTS?
Under the GDPR and the French Data Protection Act, you have the following rights over your data:
- access: obtain confirmation that your data is being processed and receive a copy of it;
- rectification: have inaccurate or incomplete data corrected (you can edit most of your information directly from your account);
- erasure: request the deletion of your data, within the limits provided by law (you can delete your account directly from your personal area);
- restriction: request that the processing of your data be temporarily frozen in certain cases;
- objection: object, on grounds relating to your particular situation, to processing based on our legitimate interest;
- portability: receive the data you have provided to us in a structured, machine-readable format;
- withdrawal of consent: withdraw any consent given at any time (for example for cookies, via the "Manage my cookies" link at the bottom of every page), without affecting the lawfulness of processing carried out before the withdrawal;
- post-mortem instructions: set out instructions regarding the fate of your data after your death.
To exercise these rights, write to us at contact@rateacompany.com.
We may ask you for proof of identity where there is reasonable doubt about your identity. We will reply
within one month, which may be extended by two months for complex requests.
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with
the French data protection authority, the Commission nationale de l’informatique et des libertés
(CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France –
www.cnil.fr.
8. COOKIES
A cookie is a small text file placed on your device by your browser when you visit a website. The
rateacompany.com site uses the following cookies:
| Name | Issuer | Purpose | Duration | Consent |
|---|---|---|---|---|
| PHPSESSID | rateacompany.com | Session identifier: keeps you logged in and remembers your preferences (language) while browsing | Session (deleted when the browser is closed) | Not required (strictly necessary) |
| REMEMBERME | rateacompany.com | Keeps you logged in if you ticked "Remember me" | 7 days | Not required (strictly necessary, at your request) |
| rac_consent | rateacompany.com | Stores your choice regarding audience-measurement cookies | 6 months | Not required (strictly necessary) |
| _ga, _ga_* | Google Analytics | Audience measurement: distinguishing visitors, measuring page views and journeys on the site | 13 months | Required – only set if you click "I accept" |
| _GRECAPTCHA | Google reCAPTCHA | Protection of the registration and contact forms against bots | 6 months | Not required (security), only set on those forms |
On your first visit, a banner lets you accept or refuse audience-measurement cookies. Refusing is as easy as accepting and has no effect on your browsing. Your choice is kept for 6 months; you can change it at any time via the "Manage my cookies" link at the bottom of every page. You can also set your browser to refuse or delete cookies (see our Cookie policy).
9. MINORS
The site is intended for people aged 16 or over. If you are a parent or guardian and believe that a minor
has provided us with data without authorisation, please contact us so that we can delete it.
10. CHANGES TO THIS POLICY
We may amend this policy to reflect changes to the site, the services or the regulations. The date of the
last update appears at the top of this document. In the event of a substantial change, we will inform you
by a notice on the site or by email if you have an account.
