DATA PROTECTION
Privacy policy.
How SALCIFI, trading as monRH@moi, handles website, prospect, client-contact and client HR data.
1. Controller and contact
For its own website, prospect, contract and billing activities, the controller is SALCIFI, a French SAS with share capital of €100, registered office at 34 chemin du Routoir, 67400 Illkirch-Graffenstaden, France, SIREN 807 521 729. Data-protection questions and rights requests: dpo@monrhamoi.fr.
When SALCIFI handles employee, former-employee, candidate, manager, representative or beneficiary data on a client’s documented instructions, the client remains controller and SALCIFI acts as processor. The accepted quotation and applicable professional terms define that processing.
2. Data handled
For SALCIFI’s own purposes
Depending on the relationship, data may include names, roles, organisation and contact details; enquiry and quotation content; contract, billing and payment records; security logs and IP information; limited cookie-less audience data with two-byte IP masking; and privacy choices.
Do not use a public form to send sensitive data or detailed information about an identifiable employee. Use only the secure channel agreed for an HR engagement.
For clients
The data required by the agreed HR mission may include identification and employment records, contracts, working time, leave and absence, pay and benefits, career and training, employee relations, health-and-safety administration and strictly necessary special-category data. A French social-security number or special-category data is handled only when necessary for the mission and legally permitted. SALCIFI does not use client HR data for its own purposes.
3. Purposes, legal bases and main retention periods
| Purpose | Legal basis | Main period |
|---|---|---|
| Answer an enquiry and prepare a quotation | Pre-contract steps requested by the person | For the request, then up to three years after the last active contact if no contract follows |
| Manage and deliver client services | Contract; legitimate interests for professional contacts | During the relationship, then five-year evidential archive unless another legal period applies |
| Accounting and tax records | Legal obligation | Ten years from the relevant financial-year close |
| Relevant B2B service information | Legitimate interests, with a simple free right to object | Up to three years after the last active contact |
| Website security and incident diagnosis | Legitimate interests | Strictly necessary period; logs currently accessible to SALCIFI at the host are retained for three days |
| Aggregated audience measurement | Legitimate interests, using an exemption-compatible Matomo configuration | Raw visit data deleted after 180 days |
For client HR data, the client determines purposes, legal bases and retention. SALCIFI returns or deletes data under documented instructions and the contract, subject to legal retention duties.
4. Required information
Fields marked as required are needed to handle the request. Without them, SALCIFI may be unable to respond. Other information is optional.
5. Recipients and service providers
Access is limited to authorised SALCIFI personnel and strictly necessary providers for hosting, professional email, maintenance, security and forms, plus advisers bound by confidentiality. Identified environments include AMEN for EU-based website hosting, self-hosted Matomo for aggregated analytics, Google Workspace for professional email and collaboration with the “Europe” data region activated for covered data at rest, and Cloudflare Turnstile for form security.
For client HR files, information may be disclosed on the client’s instructions or as required by law to authorised client personnel, French social bodies, administrations, occupational-health services, the client-appointed payroll producer, insurers, retirement and benefit bodies, banks and professional advisers.
6. Transfers outside the EEA
SALCIFI prefers EEA processing where practicable. The Google Workspace Europe setting concerns covered data at rest; some metadata, technical functions or support operations may still involve processing outside the EEA. Any unavoidable transfer must rely on a GDPR mechanism such as an adequacy decision or standard contractual clauses, supplemented where necessary. As processor, SALCIFI follows the agreed client instructions and safeguards.
7. Your rights
Subject to the GDPR conditions, you may request access, rectification, deletion, restriction or portability, object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Email dpo@monrhamoi.fr and identify the request. Identity evidence is requested only where reasonably necessary. SALCIFI normally responds within one month, extendable by two months for complex or numerous requests with notice during the first month.
You may complain to the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
8. Public French case-law data
The French website may display selected employment-law decisions from the official open JuriLibre dataset. SALCIFI uses the decision text and public metadata only to select, summarise and link to relevant rulings. It does not seek to re-identify pseudonymised persons, profile judges or parties, or use the data for decisions about individuals. If residual personal data appears in a published decision, contact dpo@monrhamoi.fr so the situation can be reviewed.
9. Security and automated decisions
SALCIFI applies technical and organisational measures proportionate to risk and requests appropriate provider safeguards. Public forms do not make decisions producing legal effects about a person.
10. Changes
This policy may change when the website, processing or law changes. The latest revision date appears at the top.
This English policy explains the same operating framework as the French privacy policy. Links to French-language official or legal material are labelled where displayed.