Privacy Policy

Legal Notice – Privacy Policy – Terms of Use – Licence – Cookie Policy

Updated on January 20th 2026

1. Introduction

This Privacy Policy explains how personal data is collected, used, stored and protected when you access or use the FlexUp website, platform, application and related services (the “Platform”). FlexUp is committed to processing personal data in a transparent, lawful and proportionate manner, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable data protection laws.

FlexUp applies the principles of the GDPR as a baseline standard for the protection of personal data. Where users are located outside the European Union, FlexUp applies equivalent protections to the extent required by applicable local data protection laws.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

FlexUp is a business initiative and platform operated as a subaccount of Cosys S.C., a société civile incorporated under French law, having its registered office at 10 rue Saint Paul, 75004 Paris, France, registered under RCS Paris number 519 072 417, operating the FlexUp ecosystem (“FlexUp”, “we”, “us”).

For the purposes of applicable data protection laws, Cosys S.C. acts as the data controller for personal data processed in connection with the FlexUp platform.

3. Categories of Personal Data Collected

FlexUp collects only personal data that is necessary for the operation of the Platform and the provision of its services. This may include:

· Identification and contact data: name, email address, phone number, professional role or organisation.

· Account and contractual data: account identifiers, contractual roles, commitments, orders, deliveries, acceptances and related records.

· Transactional and economic data: payments, credits, tokens, commitments, distributions and related accounting information.

· Technical data: IP address, access logs, device and browser information, security and audit logs.

· User-generated content: information you choose to publish or share within the FlexUp ecosystem.

· Providing certain data is necessary to create an account or enter into contracts on the Platform. Failure to provide such data may prevent access to some features or services.

4. Purposes and Legal Bases of Processing

FlexUp processes personal data for the following purposes and legal bases:

· Provision and operation of the Platform.

· Management of contracts, projects, orders and economic relationships within the FlexUp ecosystem.

· Compliance with legal and regulatory obligations, including accounting and record-keeping.

· Platform security, fraud prevention and system integrity.

· Communication with users regarding their accounts, contracts, or important operational.

· Improvement of the Platform through analysis of usage and feedback.

FlexUp does not process personal data for automated decision-making or profiling producing legal or similarly significant effects.

Processing of personal data is based, as applicable, on the performance of a contract, compliance with legal obligations, FlexUp’s legitimate interests, or the data subject’s consent.

5. Data Sharing and Recipients

FlexUp does not sell personal data.

Personal data may be shared only with:

· Service providers and technical partners acting as data processors (such as hosting, cloud infrastructure, email and security providers), under appropriate contractual safeguards.

· Other users of the Platform, where you choose to make data public or where disclosure is necessary for the execution of contracts or transactions within the FlexUp ecosystem.

· Public authorities or courts, where required by law or to protect legal rights.

Where users expressly consent, FlexUp may publish certain personal data (such as name, role, organisation, testimonials or contributions) in articles, case studies, communications or other public materials related to the FlexUp ecosystem.

Such publication is always subject to the user’s prior consent and may be withdrawn at any time.

6. International Data Transfers

Where personal data is transferred outside the European Economic Area, FlexUp ensures that appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses or equivalent mechanisms.

7. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, including:

· Account and contractual data: for the duration of the contractual relationship and applicable legal retention periods.

· Transactional and accounting data: in accordance with statutory retention obligations.

· Technical and security logs: for a limited period proportionate to security and audit needs.

Retention periods generally start from the end of the contractual relationship or the last active use of the Platform, unless a longer retention period is required by law or necessary for the establishment, exercise or defence of legal claims.

8. Data Security

FlexUp implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These measures are proportionate to the nature of the data processed and the stage of development of the Platform, and are continuously reviewed and improved.

9. Cookies and Similar Technologies

The Platform may use technical cookies and similar technologies that are strictly necessary for its operation, security, authentication and fraud prevention. These technologies do not collect information for advertising or profiling purposes and do not require user consent under applicable law.

10. Your Rights

Subject to applicable law, you have the right to:

· Access your personal data;

· Request rectification of inaccurate or incomplete data;

· Request erasure of your data;

· Request restriction of processing;

· Object to processing based on legitimate interests;

· Request data portability, where applicable;

· Withdraw consent, where processing is based on consent.

You also have the right to lodge a complaint with a competent supervisory authority, in particular in the EU Member State of your habitual residence or place of work.

11. Contact for Data Protection Matters

FlexUp has not appointed a Data Protection Officer within the meaning of Article 37 GDPR. For any questions or requests relating to personal data or this Privacy Policy, you may contact:

Email: privacy@flexup.org

12. Changes to this Privacy Policy

FlexUp may update this Privacy Policy from time to time. The latest version will always be published on the FlexUp website and will apply from the date of publication.