Privacy policy

Version dated 7 September 2026 - effective from: 7 September 2026

1. Purpose and scope

This Policy explains how SAND 360 processes personal data in connection with www.experts-du-patrimoine.fr, the professional directory, accounts, Starter, Pro and Premium plans, wealth review tools and simulators, and administrative and commercial communications.

It applies to visitors, listed professionals, account holders and users, prospects, customers and people exercising their rights. It supplements the General Terms and the Cookie Policy.

2. Data controller and contact

The controller for the processing described in this Policy is SAND 360, a French simplified joint-stock company (SAS) with capital of 30 000 €, registered with the Paris Trade and Companies Register under number 904 383 932 R.C.S. Paris, whose registered office is at 91 rue du Faubourg Saint-Honoré, 75008 Paris.

Questions or requests concerning personal data may be sent to [email protected] or by post to the registered office. Data Protection Officer: Antoine ROGER.

3. Data processed and sources

• Identification and professional data: surname, first name, role, company, SIREN, business address, contact details, photograph, biography, specialisms, authorisations and Profile content.
• Account data: identifier, email address, access rights, preferences, administration history and security information.
• Contract and billing data: selected plan, orders, invoices, payment status and contract-related communications. SAND 360 does not retain full payment-card details.
• Technical data: IP address, connection and security logs, device, browser, pages viewed, technical events and, depending on the user's choices, audience measurement data.
• Data entered in the wealth review or simulators: wealth, financial, tax, family or objective-related information, strictly to the extent necessary for the calculations offered.
• Enquiry data: correspondence sent directly to SAND 360, support requests, complaints and exercise of rights.

This data is obtained directly from the person, their representative or organisation, service providers involved in the service, or public professional sources such as official registers, institutional websites and professionals' websites. The specific source is documented when data was not collected directly.

4. Purposes, legal bases and recipients

Processing activity	Purpose	Legal basis	Recipients
Account and access	Create and secure the account, manage rights and Profiles	Contract performance or pre-contractual steps	Authorised staff; hosting provider; maintenance
Professional profile	Create, verify, publish and index a Profile	Contract for claimed Profiles; legitimate interests for public professional data	Public; search engines; technical providers; partners
Subscriptions	Subscription, payment, billing, overdue payments and evidence	Contract; legal obligations; legitimate interests for evidence and debt recovery	SAND 360; Stripe; authorised advisers and authorities
Wealth review and simulators	Provide calculations, display results, secure and improve the tool	Performance of the requested service; legitimate interests for security; explicit consent if sensitive data is essential	SAND 360 and strictly necessary processors.
Mailto link	Open the email application and, where applicable, measure button activation	No processing of content by SAND 360; legitimate interests or consent for statistics depending on the tracker used	Selected Professional; email providers chosen by correspondents
Browsing and security	Operation, abuse prevention, logging and diagnosis	Legitimate interests; legal obligation where applicable	Hosting provider; maintenance; security; authorised authorities
Audience measurement	Compile statistics and improve the Website	Consent, unless a solution validly qualifies for an exemption	Audience measurement provider (Google Analytics)
B2B marketing	Present services related to professional activities	Legitimate interests, with a right to object; consent where required	SAND 360; mailing provider; championship partners
Support and rights	Respond to enquiries, complaints and rights requests	Legal obligation; legitimate interests for follow-up and evidence	Authorised staff; advisers; competent authorities

5. Profiles created from public sources

Some Profiles may be created or enriched using publicly accessible professional information. SAND 360 documents the source, collection date and legal basis, checks data relevance and informs the person concerned under Article 14 of the GDPR, normally no later than one month after obtaining the data or at first contact or disclosure, unless a documented statutory exception applies.

The person may request correction of inaccurate information and object, on grounds relating to their particular situation, to processing based on legitimate interests. SAND 360 then examines the request and whether compelling legitimate grounds justify continuing the processing.

6. Wealth review and simulators

Entered information is used to produce the requested result. Fields, parameters and any optional data must be clearly identified when entered. SAND 360 applies data minimisation and does not request data unrelated to the calculation.

Unless stated otherwise before entry and following an affirmative action by the user, data and results are not sent to a Professional or reused for marketing.

Users are asked not to enter passwords, banking details, full identity documents or sensitive data not expressly necessary. If the tool actually processes a special category of data within Article 9 of the GDPR, its necessity, legal basis and enhanced safeguards must be documented before activation.

7. Contact through a mailto link

The contact button uses a “mailto:” link that opens the visitor's email application. The email is composed and sent directly to the Professional through the visitor's chosen service. There is no intermediary contact form operated by SAND 360.

SAND 360 does not receive the email, know its subject or content, access any attachments or confirm that a message was sent or received. The recipient Professional becomes responsible for processing carried out in the correspondence.

SAND 360 may only count button activations or process associated technical data if that feature is actually implemented. The nature of recorded events, their legal basis and retention period appear in this Policy and, where trackers are used, in the Cookie Policy.

8. Recipients and processors

Data is accessible only to SAND 360 staff who need it for their duties and providers acting on documented instructions: hosting, maintenance, security, payment, billing, email delivery and audience measurement.

Public Profile data is accessible to visitors, search engines and services that may index the web. Information entered in the tools is not made public.

No data is sold. Disclosure to a partner for independent marketing requires an appropriate legal basis, specific information and, where required by law, separate prior consent. Data may also be disclosed to authorities and advisers where required by law or to establish, exercise or defend a right.

9. Transfers outside the European Economic Area

Some providers may process data from a country outside the European Economic Area. SAND 360 records these transfers in its register and ensures they rely on an adequacy decision, European Commission standard contractual clauses or another recognised safeguard, supplemented where necessary by additional measures.

10. Retention periods

Data is retained for a period proportionate to each purpose, then deleted or archived separately where a legal obligation or the defence of a right requires it. The following periods are a draft subject to technical and legal validation.

Category	Period
Account and claimed Profile	During the relationship; deletion or anonymisation on closure
Professional data from public sources	Periodic review and for the period justified by legitimate interests
B2B prospects	3 years from collection or the last contact initiated by the prospect
Customer data used for marketing	During the relationship and for 3 years after it ends
Invoices and accounting records	10 years from the financial year-end
Wealth review and simulators	Wealth review 15 days / Simulators: session only
Technical and security logs	3 months
Cookie choices	1 year
Rights requests	While the request is processed, then archival for evidence

11. Cookies and other trackers

Trackers strictly necessary for operation, authentication, security or remembering choices may be placed without consent where the legal conditions are met. Other trackers are used only after freely given, specific, informed and unambiguous consent.

The banner allows acceptance and refusal with equal ease and choices by purpose. Continuing to browse does not constitute consent. Choices may be changed at any time through a “Manage my cookies” link accessible on the Website.

A separate policy lists each tracker, its provider, purpose, lifespan, data retention period and any transfers. Browser settings alone do not replace a consent mechanism where one is required.

12. Marketing and communications

Messages necessary to manage the account, Profile or Subscription are not marketing communications and are based on contract performance or legitimate interests according to their purpose.

Marketing to professionals may rely on legitimate interests when it concerns their activity and they have been informed. Each message identifies the sender and provides a simple, free opt-out. Consent is obtained where required by regulations. A suppression list may be retained solely to prevent further contact.

13. Individuals' rights

Depending on the processing and its legal basis, anyone may request access to their data, rectification, erasure, restriction of processing and portability of data provided. They may object to processing based on legitimate interests, particularly marketing, and withdraw consent at any time without affecting the lawfulness of prior processing.

The person may also give instructions for handling their data after death under French law. SAND 360 does not make decisions producing legal effects based solely on automated processing.

Requests are sent to [email protected] or SAND 360's registered office. Identity evidence may be requested only where there is reasonable doubt and to a proportionate extent. SAND 360 normally responds within one month, which may be extended under the conditions provided by the GDPR.

Anyone may lodge a complaint with the French data protection authority, Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07, www.cnil.fr.

14. Security and data breaches

SAND 360 implements technical and organisational measures appropriate to the risks, including access-right management, authentication, logging, backups, component updates, secure communications and contractual safeguards for processors.

As no measure eliminates all risks, SAND 360 maintains an incident-management procedure. A data breach is documented and, where the legal conditions are met, reported to the CNIL and communicated to affected individuals within the applicable deadlines.

15. Policy updates

The Policy may be amended to reflect legal, technical or functional developments. The update and effective dates appear at the start. Where required, affected individuals are informed of material changes by appropriate means before they take effect. A new version does not retroactively change a processing activity's legal basis.

16. Contact

SAND 360 - 91 rue du Faubourg Saint-Honoré, 75008 Paris - [email protected]