Confidentiality and data protection agreement

1. Data controller

Medical Logistics Europe (EURL), 204 Avenue de Colmar, 67100 Strasbourg, France, SIRET 103 690 046 00018, represented by its managing director, is the data controller. Contact for any question relating to data: contact@mleurope.fr, +33 (0)3 66 66 58 97.

2. Data collected

• Quotation request form and “Buyback offers” portal: identity (surname, first name, position), professional contact details (e-mail, telephone), facility (name, address, telephone, website), equipment description (manufacturer, model, year, serial number, counters, condition, availability), transmitted photographs and documents, messages, password (stored in hashed form), preferences (language, notifications), one-time sign-in codes (hashed), trusted devices.
• Customer area: name, e-mail address, hashed password, language, references entered on the equipment.
• Logistics access by link: hashed password of the link, references and comments entered.
• Seller portal: name and contact details of the invited contact, equipment records, photographs and documents.
• For all portals: IP addresses, browser, dates and pages viewed, log of sign-ins and actions, version and date of acceptance of these terms.

No patient data must be transmitted. Photograph metadata (geolocation, device) is removed on receipt.

3. Purposes

• Answer quotation requests and prepare buyback offers.
• Manage accounts and accesses, authenticate users and secure the Service (two-factor authentication, attempt limits, logging).
• Provide logistics tracking of the entrusted equipment and inform customers.
• Evaluate equipment, including with an automated analysis service for photographs and descriptions.
• Notify users by e-mail of events concerning them (codes, status changes, acknowledgements).
• Maintain the business relationship, comply with MLE's legal obligations and handle requests to exercise rights.

4. Legal bases

The performance of pre-contractual measures and of the contract (quotation request, offer, logistics tracking); MLE's legitimate interest in securing the Service, preventing fraud and managing its business relationship; compliance with legal obligations (accounting, responses to authorities); consent for optional notifications, which the user may withdraw at any time in their preferences.

5. Retention periods

• “Buyback offers” and customer area accounts: until the account is deleted by the user or by MLE, then immediate deletion or anonymisation of personal data.
• Quotation requests, equipment, photographs and documents: for the duration of the business relationship and three years after the last contact; data required as evidence of transactions is kept for the statutory limitation period.
• Log of sign-ins and actions (IP addresses, browser): thirteen months; log of logistics access openings: twelve months.
• Sign-in codes: ten to thirty minutes; trusted devices: thirty days; access links: until their expiry or revocation.
• Transmitted files not attached to a request: forty-eight hours.
• Acceptances of these terms: five years after the end of the relationship, without e-mail address after deletion of the account.

6. Recipients and processors

The data is accessible to MLE's authorised staff. It is processed by the following processors, bound by contract: OVH SAS (hosting of the website and database, European Union); an artificial intelligence service for the analysis of photographs and equipment descriptions (photographs and descriptions are transmitted without the user's identity; this provider may be established outside the European Union, in which case the transfer is governed by the European Commission's standard contractual clauses); an e-mail sending service for notifications.

Data may be disclosed to the authorities where required by law. It is neither sold nor transferred to third parties for commercial purposes.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent and to define directives on the fate of your data after your death. These rights are exercised at contact@mleurope.fr or by post at the address above; proof of identity may be requested. Response within one month.

Users of the “Buyback offers” portal update their contact details (“My details” page) and preferences themselves.

8. Account deletion

The user of the “Buyback offers” portal may delete their account from the “My account” page, after confirmation by password and a code received by e-mail. Deletion results in: the erasure of the account, codes and trusted devices; the deletion of the photographs and documents transmitted from the portal; the anonymisation of their identity and messages in the quotation requests; the deletion of their contact record if it is not linked to any other operation, otherwise the anonymisation of their personal data.

The facility's data (legal entity) and the anonymised quotation requests are kept. A confirmation e-mail is sent before the address is erased. MLE performs the same deletion, on request, for the accounts of the other portals.

9. Security

MLE implements appropriate technical and organisational measures: encryption of exchanges (HTTPS), hashing of passwords and codes, two-factor authentication, attempt limits, logging, role-based access control, encrypted backups, removal of photograph metadata, content security policy. In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with the regulations.

10. Mutual confidentiality of commercial information

The commercial information exchanged via the Service (requests, quotations, buyback offers, prices, conditions, condition of equipment, logistics information, packing lists) is confidential. Each party undertakes to use it only for the purposes of the intended or concluded relationship, not to disclose it to third parties without the written agreement of the other party and to protect it with the same care as its own confidential information, for the duration of the relationship and three years thereafter.

Information that is public, already known to the receiving party or lawfully received from a third party, and information whose disclosure is required by law or an authority, is not covered.

11. Complaints and contact

For any question or complaint relating to your data: contact@mleurope.fr or Medical Logistics Europe, 204 Avenue de Colmar, 67100 Strasbourg, France. If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

This agreement may be updated; the version in force, identified by its number and date, is presented for acceptance at the next sign-in.