Privacy Policy

1. Data controller

The GDM software works on a multi-organisation model: a user has a single personal account that can be linked to several companies/organisations.

Responsibilities are shared as follows:

• The user is responsible for the data of their personal account
• The organisation (the structure using GDM) is responsible for the data it enters in its workspace (roles, teams, third-party data)
• GDM acts as a technical processor and is not responsible for the data entered by users or organisations

2. Data collected

GDM distinguishes two types of data according to who they belong to:

2.1 Personal account data (belonging to the user)

This data is linked to the user’s single account and belongs to them:

• Last name and first name
• Email address
• Password (encrypted)
• Phone number
• Postal address
• Profile photo
• Date of birth
• Social security number (optional)
• Congés Spectacles number (French entertainment-industry holiday fund)

2.2 Organisation-related data (belonging to the organisation)

This data is specific to each organisation and belongs to it:

• Role / position in the organisation
• Team / department
• Access rights and permissions
• Data of non-user third parties (technicians, freelancers, contractors)

2.3 Technical data

• Login information (timestamps, IP addresses)
• Logs of actions performed in the application
• Last browser used

3. Purposes of processing

Data is processed for the following purposes:

• User account management and authentication
• Administration of inventory, bookings, projects and schedules
• Tracking of technical operations and equipment movements
• Generation of documents (dispatch notes, preparation sheets, etc.)
• Ensuring the security and traceability of actions
• Provision of technical support and maintenance

4. Legal basis for processing

The processing of data is based on:

• Performance of the contract between the Client and GDM for the provision of the service
• Legitimate interest for aspects relating to security and maintenance
• Legal obligation where applicable (retention of certain data)

5. Data recipients

Data is accessible only to:

• The Client’s authorised users, according to the configured access rights
• GDM’s technical administrators, exclusively for maintenance and support

GDM does not sell, rent or transmit any personal data to third parties.

GDM does not use any sub-processor with access to personal data. Emails sent from the application use the SMTP server configured by the Client itself.

6. Hosting and security

All data is hosted in France, on OVH servers compliant with European standards.

Security measures in place:

• Password encryption – Secure hashing (no password is stored in plain text)
• Secure connections – HTTPS/TLS required
• Automatic backups – Every 30 minutes
• Redundancy – Storage in 3 separate locations in France
• Backup retention – 30 days (restoration possible)
• Access control – Mandatory authentication, per-user rights management
• Logging – Traceability of logins and actions

7. Data transfers

No data is transferred outside the European Union.

All data remains hosted on servers located in France.

8. Retention period

Data is kept as follows:

• While the service is in use – Data is kept as long as the Client uses GDM
• After termination – Read-only access for 1 year
• Permanent deletion – Within 90 days after the end of read-only access
• Early deletion – Possible at the Client’s request at any time

At the end of the contract, the Client may request the return of its data in Excel format before its permanent deletion.

9. Rights of data subjects

In accordance with the GDPR, any person whose data is processed has the following rights:

• Right of access – Obtain a copy of the data concerning you
• Right to rectification – Correct inaccurate or incomplete data
• Right to erasure – Request the deletion of your data
• Right to restriction – Restrict processing in certain cases
• Right to portability – Receive your data in a structured format
• Right to object – Object to processing in certain cases

10. Cookies

The GDM application only uses technical cookies required for the service to work properly:

• Session cookie (authentication)
• User preference cookies (such as the display language)

No tracking, advertising or social network cookies are used.

11. Data concerning third parties

The GDM software allows the organisation to enter information about people who are not direct users of the software (technicians, freelancers, external contractors, etc.).

In this case, the organisation alone is responsible for:

• Informing these people of the collection of their data
• Ensuring the lawfulness of the processing
• Responding to requests from these people to exercise their rights

Note: if a third party later becomes a GDM user (account creation), their profile data then becomes personal account data and belongs to them.

12. Changes to this policy

This privacy policy may be modified at any time. Users will be informed of significant changes.

The current version is always available on this page.

13. Contact

For any question regarding this privacy policy or to exercise your rights, you can contact:

In the event of an unresolved dispute, you may also lodge a complaint with the CNIL (the French data protection authority).