Privacy Policy
1. Who we are
HUB2 SAS (“HUB2”, “we”, “us” or “our”), formerly CONNEKT4, is a French simplified joint-stock company (société par actions simplifiée) with its registered office at 29 impasse des Sensitives, Ravine des Cabris, 97432 Saint-Pierre, Réunion, France, registered under number 830 122 404 R.C.S. Saint-Pierre de la Réunion.
HUB2 operates the website www.hub2.io (the “Site”) and the HUB2 payment orchestration platform (the “Platform”).
2. The two roles we play
We are the data controller for the personal data we collect through the Site, for our own prospect and customer relationships, and for the HUB2 LinkedIn application described in section 9.
We act as a processor, on our customers’ instructions, for the personal data processed on the Platform. Businesses in Côte d’Ivoire contract with CONNEKT4 CÔTE D’IVOIRE and businesses in Senegal contract with CONNEKT4 SENEGAL; those companies are the data controllers for their end-users’ data, and they are licensed to provide payment services in their respective jurisdictions. HUB2 SAS operates and maintains the Platform on their behalf.
If your personal data was processed because you used a service provided by a HUB2 group company in Côte d’Ivoire or Senegal, that company is your point of contact, and its own privacy policy applies. We will forward any request we receive to it.
3. What we collect as controller
Information you give us. When you fill in a contact form, request a demo, or sign up for our services, we collect your name, professional email address, telephone number, company and country.
Information collected automatically. When you browse the Site, we collect your IP address, browser type, operating system, pages viewed and time of visit.
4. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Responding to your enquiries | Legitimate interest |
| Managing our customer relationship and providing our services | Performance of a contract |
| Securing the Site and the Platform, preventing fraud | Legitimate interest |
| Measuring website audience | Consent |
| Meeting our accounting, tax and corporate record-keeping obligations | Legal obligation |
| Operating the HUB2 LinkedIn application | Consent of the account holder |
Where we act as a processor, the legal basis is determined by the controller — the HUB2 group company you contracted with.
5. Who we share it with
We do not sell or rent personal data, and we do not share it with third parties for their own marketing purposes.
We share personal data only with:
- MICROSOFT FRANCE SAS, for hosting (see section 7);
- Google Ireland Limited and Google LLC, for website audience measurement (see section 8);
- HubSpot, Inc., for the contact and sign-up forms on the Site and for managing our customer relationship;
- HUB2 group companies, where necessary to operate the Platform;
- financial institutions, payment service providers and mobile money operators, where this is necessary to execute a transaction;
- regulators and public authorities, where we are legally required to do so, or where necessary to investigate fraud or a breach of our terms.
Each of these providers acts on our instructions and is bound by contract to confidentiality and security obligations.
6. How long we keep it
| Data | Retention |
|---|---|
| Contact form and prospect data | 3 years from our last contact with you (CNIL recommendation) |
| Customer relationship data | Duration of the contract, then 5 years (French Commercial Code, art. L110-4) |
| Accounting records | 10 years (French Commercial Code, art. L123-22) |
| Website audience measurement | 13 months maximum (CNIL recommendation) |
| Server logs | 6 months (CNIL recommendation) |
| LinkedIn access token | Until you revoke access, and in any event no more than 60 days (see section 9) |
Personal data we process on the Platform as a processor is kept for as long as the relevant controller instructs, in accordance with the record-keeping obligations that apply to it as a licensed payment services provider in its own jurisdiction.
7. Where it is stored
The Site and the Platform are hosted by MICROSOFT FRANCE SAS, through its Microsoft Azure cloud offering, in data centres located in France (European Union). Microsoft France SAS, 37/45 quai du Président Roosevelt, 92130 Issy-les-Moulineaux, France.
Some Platform data may be replicated in Côte d’Ivoire to meet local regulatory requirements.
Where a transfer outside the European Union is necessary — in particular for website audience measurement, and for the operation of the Platform by our group companies in Côte d’Ivoire and Senegal — it takes place under the European Commission’s Standard Contractual Clauses or an adequacy decision.
8. Cookies and audience measurement
The Site uses cookies that are strictly necessary to its operation, and Google Analytics 4 (measurement ID G-Z0WMHLGXZ4) for audience measurement.
Audience measurement cookies are set only with your consent. Consent is collected through the CookieYes banner available on every page of the Site, and you may withdraw it at any time from that same banner.
9. The HUB2 LinkedIn application
HUB2 operates an internal application that publishes content to HUB2’s own LinkedIn company page and to the LinkedIn profiles of HUB2 representatives who have explicitly authorised it.
What it accesses. With the account holder’s consent, the application receives from LinkedIn the holder’s name, profile picture, email address and LinkedIn member identifier.
What it stores. Only the OAuth access token and the member identifier, in a restricted-access file on a private server operated by HUB2. Access tokens expire after 60 days.
What it does. It creates posts drafted and approved internally. Every post is approved by the account holder before publication.
What it does not do. It does not read connections, messages, or any data belonging to other LinkedIn members. It collects no personal data about third parties. It does not sell, share or transfer LinkedIn data to anyone, does not use it for advertising or profiling, and does not use it to train any model.
Withdrawing access. The account holder may revoke the application at any time from their LinkedIn account settings, under Data privacy > Other applications > Permitted services. Revoking access immediately prevents any further publication.
10. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to withdraw your consent at any time, and to receive your data in a portable format.
To exercise these rights, write to dataprotection.fr@hub2.io, or by post to: HUB2 SAS, 29 impasse des Sensitives, Ravine des Cabris, 97432 Saint-Pierre, Réunion, France. We will respond within one month.
Where we act as a processor, we will forward your request to the controller concerned and assist it in responding.
You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
11. Security
We implement physical, electronic and organisational measures to protect personal data against unauthorised access, alteration, disclosure and destruction. No method of transmission over the internet or of electronic storage is completely secure, however, and we cannot guarantee absolute security.
12. Changes to this policy
We may update this policy. The date at the top of this page indicates the last revision. Material changes will be notified on the Site.
13. Contact
HUB2 SAS — 29 impasse des Sensitives, Ravine des Cabris, 97432 Saint-Pierre, Réunion, France
Data protection contact:
dataprotection.fr@hub2.io
Data Protection Officer:
dpo@hub2.io