Privacy policy

This policy explains how Le Groupe Croo inc. ("Croo", "we") processes personal data when you visit croo.io or write to us through its contact form. It is written for visitors in the United Kingdom, under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

Who is responsible

The controller is Le Groupe Croo inc., a company incorporated under the laws of Québec, Canada, located at 33 rue Prince, Montréal, Québec H3C 2M7. You can reach us about your personal data at hello@croo.io.

What this policy covers

This policy covers the croo.io website only. The applications that Croo designs, builds or hosts for its clients are governed by the agreement made with each client.

What we collect and why

When you browse the site

• Technical data. Our host, Vercel, receives your IP address, details about your browser, the page you ask for and the time of your request, as every web server does. It uses them to deliver the site and to protect it against abuse.
• Your country and language, on your first visit. When you open croo.io without choosing a region, the site uses the country that Vercel derives from your IP address and the language preferences of your browser to show you the right region and language. Neither is stored.
• Strictly necessary cookies. croo_consent records your choice about audience measurement, for 6 months. NEXT_LOCALE remembers the region and language you pick in the selector, for 1 year; it is set only if you use the selector. These cookies need no consent and are not used to follow you across sites.

Audience measurement, only with your consent

If you accept audience measurement, the site loads Google Analytics 4, a Google service. It sets the _ga and _ga_<ID> cookies, kept for up to 2 years, and records the pages you view, the calls to action you click, a change of region or language, and the fact that a contact message was sent, never its content. Google uses your IP address to estimate your approximate location. Advertising features are turned off.

Until you accept, no Google script is loaded. You can change your choice at any time with the Cookie preferences link at the bottom of every page. If you withdraw your consent, the analytics cookies are deleted.

When you write to us

The contact form asks for your name, email address, organisation, country and what you are trying to change. Your role, phone number, where the work lives today and who is affected are optional. When you send the form:

• the site emails your message, with the region and language of the page, to cec@croo.io through Courier, an email delivery service; the site itself keeps no copy;
• we use your message only to reply to you and to follow up on your request; we do not use it for marketing and we do not add you to any mailing list;
• to keep automated spam out, the form uses Cloudflare Turnstile, which loads only once you start filling in the form and uses technical data such as your IP address and browser details to tell a person from a bot. A hidden field serves the same purpose.

If sending fails, the error is recorded in our host's logs with technical codes only, never the content of your message.

Legal bases

• Replying to your message: our legitimate interests in answering the people who write to us and, where you ask about working with us, steps taken at your request before a contract (UK GDPR, Article 6(1)(f) and (b)).
• Audience measurement: your consent (Article 6(1)(a)), which you may withdraw at any time without affecting the processing carried out before.
• Hosting, security and spam protection: our legitimate interests in running a secure website (Article 6(1)(f)).

We make no decision about you based solely on automated processing.

Who processes your data

We do not sell or rent personal data. It is processed on our behalf by these processors:

• Vercel Inc. (United States): hosting of the website;
• Cloudflare, Inc. (United States): the Turnstile anti-spam check;
• Courier (United States): delivery of the contact form email;
• Google (United States): audience measurement, only with your consent;
• our email provider, which hosts the cec@croo.io inbox.

Transfers outside the United Kingdom

Croo is established in Canada, which UK adequacy regulations recognise as offering an adequate level of protection for commercial organisations. Our processors may handle data in the United States: we rely on the UK Extension to the EU-US Data Privacy Framework where the provider participates in it, and otherwise on the International Data Transfer Addendum to the European Commission's standard contractual clauses.

How long we keep it

• Contact messages stay in the cec@croo.io inbox for as long as needed to follow up on your request and any relationship that results from it, and are then deleted.
• croo_consent lasts 6 months and NEXT_LOCALE 1 year.
• Google Analytics keeps event data for at most 14 months.
• Server logs are kept by Vercel for the short period its service provides.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to object to processing based on our legitimate interests, to receive the data you gave us in a portable format, and to withdraw your consent at any time. Write to hello@croo.io; we will answer within one month.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Security

The site is served over encrypted connections (HTTPS) only, and access to the inbox and to the services above is limited to the people at Croo who need it.

Children

The site is intended for organisations and is not directed at children.

Changes to this policy

We update this policy when the site or the law changes. The date at the top of the page shows the latest version.

Contact

For any question about this policy or your personal data: hello@croo.io, or Le Groupe Croo inc., 33 rue Prince, Montréal, Québec H3C 2M7.