Personal Data Protection Policy (GDPR)

Commitment to Data Protection

This policy describes how staffngo.com (“we,” “our,” “the application”) collects, processes, shares, and protects your personal data in accordance with the General Data Protection Regulation (GDPR). We act either as a data controller or a data processor depending on the services provided.

Company and Services Overview

The Staff & Go software is a service offered by Digidiz, a simplified joint-stock company (SAS) with a capital of €11,535, registered with the Mulhouse RCS (Trade and Companies Register) under number 882 950 397, headquartered at 6 rue des Alpes, 68490 Hombourg, France.

The Staff & Go platform enables:

  • Secure electronic archiving of personal documents (diplomas, identity documents, driver’s licenses).

  • Access to professional documents (employment contracts, amendments, payslips) provided by your employer.

  • Consultation of internal communications and management of HR administrative processes (reporting changes in personal situation, leave requests, time tracking, expense reports, etc.).

Key Definitions Used in the GDPR Policy

The following terms are defined as:

  • Data Controller: The entity that determines the purposes and means of processing personal data.

  • Data Processor: The entity that processes data on behalf of the data controller.

  • Personal Data: Any information relating to an identified or identifiable natural person.

  • Documents: Various documents (employment contracts, DPAEs, letters to health insurance providers) generated via the Staff & Go solution or uploaded to the Staff & Go e-Safe.

  • Staff & Go e-Safe: A secure digital storage space assigned by Digidiz to the employee.

  • Services: Services provided by Digidiz under the Staff & Go HRIS software.

  • You: User of Staff & Go.

Data Collected and Its Use

Types of Data

  • Identification data: Last name, first name, e-mail address, telephone number.

  • Usage data: Features used, pages viewed, interactions, heatmaps, session logs.

  • Device data: Device model, operating system, unique identifier (IMEI number, IP, etc.).

Data source

  • You, by entering your personal information or downloading documents, Digidiz being the Data Controller.

  • Your employer, when it decides to provide you with documents related to your employment (employment contract, pay slips, company health insurance application form, etc.), Digidiz being a Subcontractor. The Data Controller is your employer.

Use of data

The Data collected by us is processed for the purposes of carrying out operations on the contents of the Service.

You may receive electronic mail (emails) from our Service, particularly in connection with administrative procedures related to your employment or future employment (signature of employment contract, mutual insurance membership, request for supporting documents, etc.).

Digidiz uses the data collected in order to:

  • Provide our Services, which includes, among other things, archiving and securing your data, but also sharing your data when it is necessary for the provision of the Service or when you are the originator of the sharing request.

  • Share your Documents with third parties, with your consent prior to sharing the Documents.

  • Improve and develop the Services

  • Share news and new Staff & Go features.

Sharing your Personal Data

We share your Personal Data with your consent or to carry out a transaction or provide a service that you have requested or authorized.

With whom is it shared?

  • our French or European subcontractors (electronic signature service provider, data hosting, etc.)

  • third parties with whom you decide to share your documents

  • your employer, if it uses Staff & Go software

  • legal organizations when required by law or in response to legal proceedings

  • Staff & Go partner sites and software

Where is it stored?

Personal Data collected and processed by Digidiz is hosted within the European Union by Microsoft Azure in two French data centers (France and France-Sud).

However, in the event that one of Digidiz’s Subcontractors is located outside the European Union, Digidiz, in its capacity as data controller, implements all necessary measures to ensure the security of your Personal Data in compliance with the RGPD.

If you would like to know where your Personal Data is stored or the list of our third-party service providers, please contact us by e-mail at dpo@digidiz.eu.

Your rights under the GDPR

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

  • Right of information: To be informed about the use of your personal data.

  • Right of access: Obtain confirmation that data is being processed and access it.

  • Right of rectification: To correct inaccurate data.

  • Right to erasure: Delete your data under certain conditions. For the deletion of Documents subject to a legal retention obligation, the request must be made to Digidiz.

  • Right to limitation: Temporarily limit processing.

  • Right to object: object to the processing of your data.

  • Right to portability: Receive your data in a structured format.

Data Protection Officer (DPO)

No Data Protection Officer has been appointed, as our obligations do not require us to do so. However, we remain fully committed to protecting your personal data. To exercise these rights, please contact us by email at dpo@digidiz.eu, specifying “Personal Data Request” in the subject line.

We aim to respond to all legitimate requests within one month. This one-month period may be exceeded if your request is particularly complex or if you have made several requests. In this case, we will notify you and keep you informed.

Data retention and processing times

Personal Data is kept until you delete it.

In the event of contract termination,

  • The good news is that you have access to your Staff & Go e-Coffre for 10 years! Your Personal Data necessary for the technical and administrative management of your account will therefore be kept for 10 years after termination to maintain your access.

  • All other Personal Data and Documents will be deleted within 6 months of closing your Staff & Go account.

Processing requiring your consent

Certain specific operations require your prior consent, such as the use of non-essential cookies or the subscription to optional communications.
In these cases, we will explicitly ask for your consent, which you may withdraw at any time without justification.

Changes to the Data Protection Policy

We reserve the right to update this policy in line with regulatory developments.

Contact and complaints

If you have any questions about this policy or wish to exercise your rights, please contact us:
Email : dpo@digidiz.eu
Postal address: 6 rue des Alpes 68490 Hombourg
Competent supervisory authority: https://www.cnil.fr/fr/plaintes/internet.

Last update : 29/04/2025