Privacy policy for the Follow Lab PRO platform

Note: This English version is provided for convenience. The French version remains legally authoritative.

Last updated: 27 November 2025

This policy describes the conditions under which LUTISE, publisher of the Follow Lab PRO software, processes personal data and information entrusted by its professional Clients in connection with use of its services.

In connection with use of Follow Lab PRO:

Client’s role

The professional Client is the data controller (Art. 4.7 GDPR) for:

personal data of its own clients, learners, users, or beneficiaries of coaching services;
content, documents, files, and information stored in Follow Lab PRO in connection with its business.

Role of LUTISE

LUTISE acts:

as Processor (Art. 4.8 and 28 GDPR) for all Client data hosted on the platform;
as Controller for data necessary to manage the contractual relationship with the Client (billing, administration, technical logs, support).

2. Intellectual property

LUTISE’s property

LUTISE remains the sole holder of:

the Follow Lab PRO software,
its trademarks, logos, interfaces, databases, algorithms, source code,
all technical, organizational, or commercial documents provided to the Client.

No intellectual property rights are transferred to the Client.

A non-exclusive, personal, non-transferable, and revocable license to use the software is granted for the duration of the contract.

Client’s property

The Client remains the sole owner of:

its content (documents, notes, files, coaching data),
personal data of its clients/users,
its correspondence, exchanges, and resources hosted on Follow Lab PRO.

LUTISE acquires no rights over this content and may not view, reproduce, or use it without instruction or authorization from the Client, except where required by law.

3. Confidentiality

LUTISE undertakes to maintain strict confidentiality regarding all information entrusted by the Client, and in particular:

coaching content,
files, documents, and uploaded resources,
information about the Client’s clients,
professional, commercial, or strategic data.

Limited access to data

LUTISE accesses Client data only:

At the Client’s explicit request, for example in the context of a limited and documented technical support intervention.
Where required by law, in particular in the event of a judicial request.

No commercial exploitation

No commercial exploitation is carried out. LUTISE does not resell, share, rent, or exploit Client data:

for marketing,
for prospecting,
for commercial analysis,
or for any use not necessary to perform the service.

Commercial reference

The Client may only be cited as a user of Follow Lab PRO with their prior written consent.

4. Personal data processed by LUTISE as Controller

Data collected

To manage the contractual relationship and operation of the service, LUTISE processes only the following data:

identity and contact details of the Client or its users,
billing information,
account settings,
technical logs, security measures, and diagnostic data,
usage statistics for features, without access to detailed data.

Operational communication and service improvement

The Client authorizes LUTISE to contact them by email in order to:

provide information relating to:
- operation of the service,
- developments, improvements, or software updates,
- best practices for use,
- incidents or maintenance operations;
send questions or surveys about use of the services and desired improvements.

These communications are necessary for service quality and are based on performance of the contract or LUTISE’s legitimate interest (Art. 6.1.f GDPR).

Purposes and GDPR legal bases

Account management, billing, contract performance: Art. 6.1.b
Support and technical assistance: Art. 6.1.b
Platform security and integrity (logs): Art. 6.1.f
Compliance with legal obligations (accounting, anti-fraud): Art. 6.1.c
Service improvement (statistical analysis without detailed access to data): Art. 6.1.f

5. Data processed by LUTISE on behalf of the Client

LUTISE processes on behalf of the Client:

personal data of the Client’s users/clients;
documents, files, and uploaded content;
educational, professional, or coaching-related information.

Instructions

LUTISE acts only on documented instruction from the Client.

Where instructions are manifestly contrary to the GDPR, LUTISE informs the Client without delay.

Security

LUTISE implements technical and organizational measures in accordance with Art. 32 GDPR:

encryption of data in transit,
hosting on secure servers located in France,
regular backups,
access control and secure authentication.

6. LUTISE’s subprocessors

LUTISE uses certain subprocessors to ensure the operation, hosting, security, billing, and improvement of the Follow Lab PRO service.

The categories of subprocessors used are as follows:

Hosting, infrastructure, and databases

Providers ensuring secure hosting of the application, backups, networking, and maintenance of the technical infrastructure.

Providers concerned: Microsoft Azure, Scaleway.

Data is hosted in data centers located in France.

Payments and subscription management (subscription only)

Provider ensuring secure processing of bank transactions and subscription management.

Provider concerned: Stripe.

Where necessary for payment processing, certain technical data may be processed outside the European Union.

These processing activities are governed by guarantees compliant with the GDPR.

Artificial intelligence providers (AI use only)

Providers supplying automated analysis models or writing assistance within optional service features. These providers are not engaged if AI-related features are not used.

Provider concerned: Groq (Mixtral and LLaMA models).

Certain processing may be carried out from infrastructure located outside the European Union.

These processing activities are governed by guarantees compliant with the GDPR.

LUTISE’s commitments regarding its subprocessors

LUTISE ensures that all subprocessors involved in the operation of Follow Lab PRO:

apply appropriate security measures;
use data only for purposes necessary to the service;
offer a level of protection compliant with the GDPR, including where processing takes place outside the European Union.

7. Third-party integrations activated by the Client

The Client may choose to connect third-party services to Follow Lab PRO (e.g., Calendly).

In this case, these services act as subprocessors of the Client, and not of LUTISE.

LUTISE has no access to accounts used by the Client and acts only as a technical intermediary to enable synchronization.

8. Retention periods

For personal data stored by the Client in Follow Lab PRO, LUTISE applies the retention periods defined by the Client as data controller.

By default, data is retained for a period of 5 years from:

its archiving by the Client,
termination of the subscription.

This period may be adjusted on request at contact@followlab.io

9. In the event of an incident

LUTISE takes all actions necessary to protect Client data. Nevertheless, in the event of a personal data breach, LUTISE undertakes to:

notify the Client as soon as possible after becoming aware of it,
communicate all information necessary to comply with its obligations,
implement corrective measures as quickly as possible.

10. Rights of data subjects

Data subjects have the following rights:

access,
rectification,
erasure,
restriction,
objection,
portability,
withdrawal of consent.

These rights may be exercised with LUTISE for processing for which it is Controller: contact@followlab.io

The Client is informed that they may lodge a complaint with the supervisory authority.

11. Changes to the policy

LUTISE may amend this policy in order to:

comply with regulations,
improve its practices,
integrate new services.

The Client will be informed of any material change.

12. Contact

For any question relating to this policy: contact@followlab.io

1. Data controllers and role of the parties (GDPR)