Privacy & Cookies Policy

Last update: July 24, 2025

Preamble

Bamboo SAS (hereinafter "Bambboo", "we", "us", "our"), whose contact details appear in the Legal Notice of this site, attaches great importance to the protection of your personal data. The purpose of this Privacy Policy is to inform you about how we collect, use, share and protect personal data:

Visitors to our public website accessible at www.bambboo.fr (hereinafter "the Website").
Users (representatives of our Business Customers and Collaborators invited by them) of our professional networking platform (hereinafter "the Platform").
Indirectly, Contacts (professional profiles) whose data are processed via the Platform by Bambboo on behalf of our Corporate Clients, following the actions of Employees.

It also describes the data subject's data protection rights and how to exercise them.

We undertake to process all personal data in compliance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "RGPD") and Law No. 78-17 of January 6, 1978 as amended relating to data processing, files and freedoms.

/ ARTICLE 1 - ROLES AND RESPONSIBILITIES

To ensure total transparency, the roles with regard to the RGPD are divided as follows:

Bambboo, Data Controller (User Data): Bambboo alone determines the purposes (technical and administrative management of the Platform, administration of User accounts, billing for Services) and means of processing data relating to Users (Customer representatives, internal or external Collaborators). For these specific processing operations, Bambboo acts as Data Controller.
The Corporate Customer, Data Controller (Contact Data): The Client Company determines the purposes (the animation of its policy of cooptation, recruitment and internal mobility) and the essential means (definition of the offers, invitation and incentive of the collaborators) of the treatment of the data relating to the Contacts. For this activity, it therefore assumes the role of Data Controller.
Bambboo, Subcontractor (Contacts Data): Bambboo processes Contacts data solely on behalf of and on the instructions of the Client Company, in order to provide the technological tools facilitating cooptation. As such, Bambboo undertakes contractually (via a DPA) to comply with the obligations of the RGPD in its capacity as Subcontractor, in particular by implementing appropriate technical and organizational security measures (such as pseudonymization).

Bambboo's contact point for data protection issues is: contact@bambboo.fr.

/ ARTICLE 2 - DATA PROCESSING ON THE WEBSITE

This section concerns only data collected when you visit or interact with our public website.

2.1. Data collected on the Website

Browsing data (via cookies): IP address, browser type, operating system, device, pages visited, date/time, time spent, traffic source, approximate location, cookie identifiers. (See Article 8 for cookies).

Contact form data: Last name, first name, professional email, company name and size (mandatory); phone number (optional); message content.

2.2. Purposes of Processing on the Website

Ensure the technical operation and security of the Website. - Measure audience and analyze usage (anonymized statistics).
Respond to contact requests and manage the commercial relationship initiated.
Send newsletters or commercial information, only with your explicit consent. Ensure the technical operation and security of the Website.

2.3. Legal basis for processing on the Website

Legitimate interest: Security, technical operation, response to requests.
Consent: Deposit of non-essential cookies, commercial prospecting. - Pre-contractual measures: Processing of subscription requests.

2.4. Retention Period on the Website

Cookies: Consent max 13 months; variable lifetime (see Article 8).
Form data: Time required to process request; if no contractual follow-up, max 3 years for prospecting (if consent) or archiving according to legal prescription (e.g. 5 years).

/ ARTICLE 3 - DATA PROCESSING VIA THE BAMBBOO SAAS PLATFORM

This section concerns data processed in connection with the use of our Platform by Business Customers and their Users.

3.1. User Data (Employees and Customer Representatives)

Data concerning Users themselves :

Collected data: Identity (surname, first name, professional email), professional information (position, company), connection data (logs), account preferences.
Purposes: Account creation and management, authentication, service provision, technical support, billing, service notifications.
Legal basis: Contract performance (GTC/Commercial Contract), Legitimate interest (security, service improvement), Legal obligation (invoicing).
Retention period: Duration of contract + 1 year (unless longer retention is required by law).

3.2. Business contact data

Origin and Nature of Data: This data concerns third parties ("Contacts") and comes exclusively from the actions of Collaborators ("Cooperators") using the Platform to animate their professional network. It may come from :

1. From the voluntary and consented connection of the Collaborator's professional network (e.g. LinkedIn): Bambboo then analyzes only the data that Contacts have voluntarily made public or accessible to their network (of which the Collaborator is a part), with the explicit aim of developing their professional visibility and obtaining professional opportunities.This processing is in line with the mission of professional networks (such as LinkedIn), which is to connect professionals for economic opportunities. Bambboo's use of this data to identify a relevant opportunity is therefore strictly aligned with the Contact's initial wishes when publishing his or her profile. Bambboo does not collect any direct data (email, telephone, address) from this source. In accordance with the principle of accuracy (Article 5.1.d of the RGPD) and respect for people's wishes, Bambboo implements technical measures to reflect modifications or deletions made by Contacts directly on their source public profiles (e.g. LinkedIn). Thus, any data modification or profile deletion made at source by the Person Concerned is intended to be taken into account by the Platform during update cycles, resulting in the corresponding update or deletion in our systems.
2. Voluntary import of files (e.g. CV) by the Employee: Under his/her responsibility and with the necessary authorizations .

For all imports, and in particular for non-public or sensitive data (e.g. CV files), the Contributor affirms that he/she holds the rights, 4 authorizations and consents to allow their processing for the purposes of the Services.
Data processed : Data may vary depending on the source initiated by the Collaborator:

1. Connection to the Co-operator's professional network: Public profile URL and, if accessible by the Co-operator or publicly available: Last name, first name, professional experience, training, skills, location, profile photo.

2. Voluntary import of files (e.g. CV) by the employee: Name, first name, professional experience, training, skills, location, e-mail address.
Purposes: This data is processed on behalf of the Client Company in order to help Employees identify, within their own network, relevant profiles for the company's Job Offers (cooptation). Bambboo uses artificial intelligence services to perform this matching analysis.

1. Pseudonymization: Before any personal data is sent to AI, it is systematically pseudonymized to guarantee confidentiality and prevent identification of individuals by the AI service.

2. Alignment with expectations: The use of AI to improve the relevance of professional opportunities is standard and accepted practice on the originating professional networks (as specified in their own policies), ensuring that this treatment does not surprise the reasonable expectations of the individuals concerned.
Legal basis: The legal basis for the processing of personal data associated with AI is Legitimate Interest (Article 6.1.f of the RGPD). This processing has been justified by a rigorous Balancing Test that verifies the following three conditions:
1. Legitimacy condition: The interest pursued by the Data Controller (the Customer) is real and lawful:
- Run an effective and transparent co-optation program.
- Help employees quickly identify contacts in their networks to whom it would be relevant to share professional opportunities.
2. Necessity condition: The use of AI is necessary and proportionate, because the exhaustive and objective analysis of thousands of profiles in relation to multiple offers is impossible for employees to carry out manually.

3. Balancing Condition: The Customer's Legitimate Interest outweighs the rights of the Data Subjects, as the processing is strictly aligned with their reasonable expectations:
- Initial purpose of the Data: The data analyzed is that which Contacts have voluntarily made public or accessible on professional networks (e.g. LinkedIn), in particular to Collaborators, with the explicit aim of developing their network and receiving professional opportunities. This purpose is clearly stipulated in the General Terms of Use of the original networks.
- No Surprise on AI: The use of AI to analyze profiles and improve the relevance of opportunities is a practice documented and accepted by Contacts in the privacy policies of the same networks. Bambboo's processing therefore does not constitute an unpredictable use of data.
- Consented Channel: The approach is made via a means of communication (e.g. LinkedIn messaging) to which the Contact has previously consented to receive this type of opportunity.
Retention period: Duration of the contract with the customer, or according to the customer's specific instructions.

Origin and Nature of Data: This data concerns third parties ("Contacts") and comes exclusively from the actions of Collaborators ("Cooperators") using the Platform to animate their professional network. It may come from :

1. From the voluntary and consented connection of the Collaborator's professional network (e.g. LinkedIn): Bambboo then analyzes only the data that Contacts have voluntarily made public or accessible to their network (of which the Collaborator is a part), with the explicit aim of developing their professional visibility and obtaining professional opportunities.This processing is in line with the mission of professional networks (such as LinkedIn), which is to connect professionals for economic opportunities. Bambboo's use of this data to identify a relevant opportunity is therefore strictly aligned with the Contact's initial wishes when publishing his or her profile. Bambboo does not collect any direct data (email, telephone, address) from this source. In accordance with the principle of accuracy (Article 5.1.d of the RGPD) and respect for people's wishes, Bambboo implements technical measures to reflect modifications or deletions made by Contacts directly on their source public profiles (e.g. LinkedIn). Thus, any data modification or profile deletion made at source by the Person Concerned is intended to be taken into account by the Platform during update cycles, resulting in the corresponding update or deletion in our systems.
2. Voluntary import of files (e.g. CV) by the Employee: Under his/her responsibility and with the necessary authorizations .

For all imports, and in particular for non-public or sensitive data (e.g. CV files), the Contributor affirms that he/she holds the rights, 4 authorizations and consents to allow their processing for the purposes of the Services.
Data processed : Data may vary depending on the source initiated by the Collaborator:

1. Connection to the Co-operator's professional network: Public profile URL and, if accessible by the Co-operator or publicly available: Last name, first name, professional experience, training, skills, location, profile photo.

2. Voluntary import of files (e.g. CV) by the employee: Name, first name, professional experience, training, skills, location, e-mail address.
Purposes: This data is processed on behalf of the Client Company in order to help Employees identify, within their own network, relevant profiles for the company's Job Offers (cooptation). Bambboo uses artificial intelligence services to perform this matching analysis.

1. Pseudonymization: Before any personal data is sent to AI, it is systematically pseudonymized to guarantee confidentiality and prevent identification of individuals by the AI service.

2. Alignment with expectations: The use of AI to improve the relevance of professional opportunities is standard and accepted practice on the originating professional networks (as specified in their own policies), ensuring that this treatment does not surprise the reasonable expectations of the individuals concerned.
Legal basis: The legal basis for the processing of personal data associated with AI is Legitimate Interest (Article 6.1.f of the RGPD). This processing has been justified by a rigorous Balancing Test that verifies the following three conditions:

1. Legitimacy condition: The interest pursued by the Data Controller (the Customer) is real and lawful:
- Run an effective and transparent co-optation program.
- Help employees quickly identify contacts in their networks to whom it would be relevant to share professional opportunities.
2. Necessity condition: The use of AI is necessary and proportionate, because the exhaustive and objective analysis of thousands of profiles in relation to multiple offers is impossible for employees to carry out manually.

3. Balancing Condition: The Customer's Legitimate Interest outweighs the rights of the Data Subjects, as the processing is strictly aligned with their reasonable expectations:
- Initial purpose of the Data: The data analyzed is that which Contacts have voluntarily made public or accessible on professional networks (e.g. LinkedIn), in particular to Collaborators, with the explicit aim of developing their network and receiving professional opportunities. This purpose is clearly stipulated in the General Terms of Use of the original networks.
- No Surprise on AI: The use of AI to analyze profiles and improve the relevance of opportunities is a practice documented and accepted by Contacts in the privacy policies of the same networks. Bambboo's processing therefore does not constitute an unpredictable use of data.
- Consented Channel: The approach is made via a means of communication (e.g. LinkedIn messaging) to which the Contact has previously consented to receive this type of opportunity.
Retention period: Duration of the contract with the customer, or according to the customer's specific instructions.

/ ARTICLE 4 - DATA RECIPIENTS

Your personal data may be communicated to :

Authorized Bambboo personnel: Within the strict limits of their authority.
Subcontractors (acting on behalf of Bambboo): Evolix: Infrastructure and database hosting (Location: France - EU).
Captain Data: technical operations to extract public data (Location: France - EU).
Google Cloud and Mistral AI: AI services for semantic analysis and relevance matching. Data sent is pseudonymized before transfer. Processing and hosting are guaranteed within the European Union.
Customer company : Only for relevant Contact data identified and validated by Employees.
Competent authorities : Only on imperative legal request.

/ ARTICLE 5 - SECURITY AND ACCOMMODATION

Bambboo implements appropriate technical and organizational measures to protect all personal data processed against unauthorized access, loss or alteration.

We guarantee that all data, including that processed by our subcontractors, is hosted and processed exclusively within the European Union (EU).

/ ARTICLE 6 - YOUR RIGHTS REGARDING YOUR PERSONAL DATA

In accordance with the RGPD, any data subject has the following rights: access, rectification, erasure, limitation of processing, portability, opposition, and withdrawal of consent.

Specific terms of information and exercise of rights for "Contacts" :

If your data has been collected from a publicly accessible source (professional network) for the needs of one of our Customers :

Information (Article 14 RGPD): In accordance with the regulations, you are informed of the existence of this processing, its origin and your rights no later than the first communication presenting you with a professional opportunity.
Exercise of rights (Opposition and Deletion): In addition to the possibility of modifying or deleting your data at source on your public profile (which will be reflected on our Platform, see Article 3.2), you may exercise your right to object and request the immediate deletion of your data from our systems. To facilitate this process, Bambboo acts as a centralized point of contact. Simply send your request to contact@bambboo.fr (specifying the URL of the public profile concerned). We will then remove the data from our active systems and inform the customer concerned.

For Users: Certain rights can be exercised directly via account settings (e.g. withdrawal of LinkedIn consent).

For all inquiries: Contact us at contact@bambboo.fr.

Complaints: You have the right to lodge a complaint with the CNIL (www.cnil.fr).