Privacy Policy


1. Data controller
This website is published by MOBROS, a French Société par Actions Simplifiée (SAS) registered with the RCS of Angers under number 979553393, with its registered office at 790 Route d'Étriché, 49140 Montreuil-sur-Loir, France. Email: legal@mo-bros.fr

2. What personal data we collect
We collect personal data in the following situations:

  • Newsletter and free resources: your email address and, where provided, your first name.
  • Client portal: when you create and use a client account, we collect your identification and contact details (surname, first name, company name, postal address, email address, telephone number), your login credentials (your password is stored only in encrypted, hashed form and is never readable by us), the documents you upload to the portal, and the history of your projects, quotes, agreements and invoices.
  • Payments: billing details and transaction information (amount, date, payment status). Your card or bank details are entered directly with our payment provider, Stripe, and are never stored on our servers.
  • Electronic signatures: your name, email address, signature, and the technical data associated with the signing process (date, time, IP address, audit trail).
  • Technical data: connection logs (IP address, date and time of access, actions performed) needed to secure the portal.

3. Purpose and legal bases

  • Creating and managing your client account, hosting your documents, and delivering our services: performance of a contract or pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
  • Sending service emails (account confirmation, password reset, notifications about your projects, confirmations of payments or signatures): performance of a contract (Article 6(1)(b) GDPR). These emails are necessary for the service and are not marketing; you cannot unsubscribe from them while your account is active.
  • Processing payments and issuing invoices: performance of a contract and compliance with our legal obligations in accounting and tax matters (Article 6(1)(b) and (c) GDPR).
  • Electronic signature of quotes and agreements: performance of a contract (Article 6(1)(b) GDPR) and our legitimate interest in keeping evidence of our agreements (Article 6(1)(f) GDPR).
  • Securing the portal and preventing fraud (connection logs): our legitimate interest in protecting our systems and your data (Article 6(1)(f) GDPR).
  • Sending our newsletter and free resources: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in each email.

We do not make any decision about you based solely on automated processing.

4. Recipients and processors
Your data are accessible only to authorised MOBROS staff, and to the following service providers, strictly for the purposes described above:

  • Team Blue Internet Services uk limited, Action House, Perdiswell park, Worcester WR3 7GD, UK: hosting of the client portal, your account data and uploaded documents, acting as a data processor on behalf of MOBROS. Servers located in UK.
  • Migadu-Mail GmbH, Rohnen 587, CH-9414 Schachen, Switzerland, contact@migadu.com: delivery of service emails (signup, notifications, confirmations), acting as a data processor on behalf of MOBROS.
  • Stripe Payments Europe, Limited (Ireland) and its affiliates: payment processing. Stripe acts as a data processor when it processes payments on our behalf, and as an independent data controller for its own purposes, notably fraud prevention and compliance with its legal and regulatory obligations. See Stripe's privacy policy: https://stripe.com/privacy
  • Docsketch, LLC (SignWell), Oregon, United States: electronic signature of quotes and agreements, acting as a data processor on behalf of MOBROS.
  • Kit.com, whose registered agent is Corporation Service Company 1305 12th Avenue Road Nampa, Idaho 83686: newsletter delivery, acting as a data processor on behalf of MOBROS.

Your data may also be disclosed to our accountant, legal advisers, or public authorities where required by law. We never sell your data or share it with third parties for their own marketing.

5. Retention periods

  • Client account data and uploaded documents: for the duration of our business relationship, then 3 years from the end of the relationship or your last activity, unless you request earlier deletion (subject to the legal retention periods below).
  • Quotes, agreements, and signed documents: for the duration of the contract, then 5 years (statutory limitation period).
  • Invoices and accounting records: 10 years from the end of the financial year (Article L.123-22 of the French Commercial Code).
  • Payment data: kept by Stripe according to its own obligations; we do not store card data.
  • Connection logs: 12 months.
  • Newsletter: until you unsubscribe.
  • At the end of these periods, data are deleted or anonymised.

6. Your rights
Under GDPR and French law, you have the right to access, correct, or delete your data, withdraw consent, and request portability or restriction. You may contact us at legal@mo-bros.fr. If you believe your rights have been violated, you may lodge a complaint with the CNIL (www.cnil.fr).

Please note that we may be unable to delete certain data immediately where we are legally required to keep them (for example, invoices). In that case, the data are archived with restricted access until the end of the applicable period. You may also give instructions regarding the fate of your data after your death (Article 85 of the French Data Protection Act).

7. Security
Access to the client portal is protected by a personal password, stored only in encrypted (hashed) form. Communications with the portal are encrypted (HTTPS). You are responsible for keeping your password confidential and must inform us without delay of any suspected unauthorised use of your account. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the CNIL in accordance with Articles 33 and 34 GDPR.

Quotes and agreements may be signed electronically via SignWell. When you sign, SignWell records your name, email address, signature, IP address, and the date and time of each step, in order to produce an audit trail proving the integrity of the document and the identity of the signatory, in accordance with Regulation (EU) No 910/2014 (eIDAS) and Article 1367 of the French Civil Code.

8. Transfers outside the EU
Some of our providers (in particular Stripe, SignWell, and Kit) are located in, or may access data from, the United States. These transfers are made on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, or failing that, under the European Commission's Standard Contractual Clauses (Article 46 GDPR). Data hosted in the United Kingdom benefit from an adequacy decision of the European Commission. You may obtain a copy of the applicable safeguards by contacting us.

9. Updates
We may update this Privacy Policy from time to time. Any changes will appear on this page with a revised update date.

Last updated: September 2026