ON GROUP – Privacy policy
Last updated: 15 October 2026
Are you a customer or a prospect who received a quotation from ON GROUP? The follow-up of your quotations and the analysis of your replies by an artificial intelligence assistant are described in part B.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (“GDPR”), in force since 24 May 2016 and applicable since 25 May 2018, sets the rules for collecting, processing and storing personal data. It also gives rights to the people concerned. This policy explains how ON GROUP uses and protects your data when you visit the website https://ongroup.net/, when you contact us (part A) and when you receive our quotations (part B).
It may be amended, in particular to follow changes in the law or in our services. The applicable version is the one published on this page, with its date of last update shown above. If we make a substantial change (for example a new purpose, a new recipient or a new transfer outside the European Union), we will inform you before it applies, through a banner on the website and, if we have your address, by e-mail.
Part A – Website and contact requests
1. Data controller
ON GROUP, SAS with a share capital of 10 950 euros, registered with the Chalon-sur-Saône Trade and Companies Register (RCS) under number 837 547 207, with its registered office at 10 Chemin des Barres, 71530 Crissey, France. Telephone: +33 3 80 64 71 86.
Contact for your data: privacy@ongroup.net, or by post to our registered office.
Data protection contact: Zora TAJEDDINE, who handles your requests about your data, can be reached at privacy@ongroup.net or by post at our registered office.
2. Data collected
You can browse the website without giving us any personal data. Only the website’s two forms collect data about you:
| Form | Required fields (*) | Optional fields |
|---|---|---|
| “Contact us” | Name, e-mail, telephone, subject, message | — |
| “Get a quote” | Company name, name, e-mail, telephone, subject, description of your inquiry | Country |
Required fields are marked with an asterisk in each form: without them, we cannot handle your request. Leaving an optional field blank has no consequence. Please do not send us sensitive data (health, opinions…) in the message field.
When you visit the website, the server hosting it also records technical data (IP address, date and time, pages viewed, browser type) in its logs. Cookies and third-party content (audience measurement, map, social networks) are described in our cookies policy.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering your contact or quotation request and, where applicable, drawing up and following up your quotation (see part B) | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); otherwise, ON GROUP’s legitimate interest in answering the requests it receives (Art. 6(1)(f)) |
| Sending you, as a business contact, information about our offers related to your request | ON GROUP’s legitimate interest in presenting its activities to its business contacts (Art. 6(1)(f)); you can object at any time, without giving a reason |
| Running and securing the website (server logs, protection of forms against automated submissions) | ON GROUP’s legitimate interest in a secure and available website (Art. 6(1)(f)) |
| Measuring the website’s audience, displaying the access map (Google Maps) and the content of our social networks | Your consent, collected through the cookie banner (Art. 6(1)(a) GDPR and Article 82 of the French Data Protection Act); you can withdraw it at any time |
No automated decision-making: no decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR) is taken from the data collected on the website.
4. Recipients of the data
Your data is intended for the ON GROUP departments concerned by your request (sales team, management). It may also be processed by the following service providers, who act only on our instructions, under contracts that comply with Article 28 GDPR:
| Service provider | Role | Data concerned |
|---|---|---|
| Hostinger International Ltd | Hosting of the ongroup.net website (the quotation follow-up application is not hosted there: see part B) | Form messages, server logs |
| Microsoft (Microsoft 365) | E-mail: forms are received by e-mail | Form messages |
| CookieYes Limited | Cookie banner and recording of your cookie choices | Consent choices, IP address |
| Google (Google Analytics, Google Maps) | Audience measurement, map on the Contact page, after your consent | IP address, browsing data |
| Meta (Instagram) | Display of our Instagram posts, after your consent | IP address, browsing data |
Google and Meta may also use this data for their own purposes, under their own privacy policies. Your data is never sold or rented.
5. Retention period
| Data | Retention period |
|---|---|
| Request made through a form, without a quotation | 24 months after our last exchange, then deleted |
| Request followed by a quotation, customer data | Periods of part B (section 7) |
| Data used to inform you about our offers | 3 years after the last contact initiated by you |
| Server logs | 1 year at most |
| Cookie choices and cookies set | 13 months at most; audience measurement data: 25 months at most (see the cookies policy) |
| Objection request | As long as needed to honour it |
6. Your rights
You have the right to access, rectify and erase your data, the right to restrict its processing and, where the processing is based on your consent or on pre-contractual steps, the right to data portability.
Withdrawal of consent: you can withdraw your consent to cookies at any time, as easily as you gave it, from the cookie banner (“Manage cookies” link). Withdrawal does not affect the processing carried out before it.
Right to object: you can object at any time, without giving a reason, to the use of your data for direct marketing. You can also object to the other processing based on our legitimate interest, on grounds relating to your particular situation.
Instructions for after your death: you can give instructions on the retention, erasure and communication of your data after your death. General instructions cover all your data and are registered with a trusted digital third party certified by the CNIL. Specific instructions cover ON GROUP’s processing and are sent to us (section 1). Without instructions, your heirs may, to the extent necessary, access your data to organise and settle your estate, and ask for your file to be closed, object to further processing or ask for your data to be updated (Article 85 of the French Data Protection Act).
To exercise your rights: privacy@ongroup.net, or by post to our registered office. We do not systematically ask for an identity document: we may ask you for proof of identity only if we have reasonable doubts about it.
7. Response time
We reply to any request concerning your rights within one month of receiving it. This period may be extended by two months if the request is complex or if we receive many requests; we will then inform you, with the reasons, within the first month.
8. Transfers outside the European Union
Some of our service providers process your data outside the European Union. Each transfer is covered by one of the safeguards provided for by the GDPR (Articles 44 et seq.):
| Service provider | Country | Safeguard |
|---|---|---|
| Hostinger International Ltd | Server of the ongroup.net website located in the United States | Standard contractual clauses adopted by the European Commission in 2021 |
| Google LLC | United States | Adequacy decision of the European Commission (EU–US Data Privacy Framework) |
| Meta Platforms, Inc. | United States | Adequacy decision (Data Privacy Framework) |
| CookieYes Limited | United Kingdom | Adequacy decision of the European Commission for the United Kingdom |
| Microsoft (Microsoft 365) | Data hosted in the European Union; occasional technical access possible from the United States | Adequacy decision (Data Privacy Framework) and standard contractual clauses |
You can obtain a copy of these safeguards by writing to us (section 1). The transfers related to quotation follow-up are detailed in part B (section 6).
9. Complaints
If you believe your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority): https://www.cnil.fr/fr/plaintes, or with the data protection authority of your country.
Part B – Customers and prospects: quotation follow-up and artificial intelligence assistant
Quotation follow-up and sales correspondence · Version of 15/10/2026
This notice explains how ON GROUP uses the personal data of its business customers and prospects when it sends them quotations, follows them up and handles their replies, in particular with the help of an artificial intelligence assistant running on its own equipment.
1. Who is responsible for your data?
ON GROUP, SAS with a share capital of 10 950 euros, registered with the Chalon-sur-Saône Trade and Companies Register (RCS) under number 837 547 207, with its registered office at 10 Chemin des Barres, 71530 Crissey, France, is the data controller.
Contact for your data: privacy@ongroup.net or by post to our registered office.
Data protection contact: Zora TAJEDDINE, who handles your requests about your data, can be reached at privacy@ongroup.net or by post at our registered office.
2. What data do we use?
- Business identity and contact details: name, job title, company, e-mail address and the details in your e-mail signature.
- Quotation data: reference, amount, validity date and link of the quotation.
- Your replies: content of the e-mails you send us in reply to our quotations, date and subject; for the analysis, only the new part of your message is used, without the quoted history.
- Analysis results: category of the reply (interest, request to postpone, refusal…), one-sentence summary, requested date, reason for declining if you give one.
- Contact preferences: language and time zone inferred from your e-mail domain, so that we write to you in your language and during business hours.
- Optional questionnaire: if you answer our short questionnaire after declining a quotation: the reasons chosen and your comment.
- Objection: if you object to our e-mails, a fingerprint of your e-mail address (not the address itself), only so that we no longer write to you.
We do not ask for any sensitive data. If you mention any spontaneously (for example a medical reason for absence), we do not use it. Your business contact details and the quotation data are necessary to draw up your quotation and follow it up: without them, we could not reply to you. Answering the questionnaire is optional.
3. Why, and on what legal basis?
| Purpose | Legal basis |
|---|---|
| Sending you the quotation you requested, following it up and reminding you on the planned dates | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); ON GROUP’s legitimate interest in following up its offers (Art. 6(1)(f)) |
| Analysing your replies with an AI assistant to route them to the right follow-up (interest, postponement, refusal) and alert your contact | ON GROUP’s legitimate interest in handling your replies quickly and efficiently (Art. 6(1)(f)) |
| Managing the business relationship in our CRM | Legitimate interest (Art. 6(1)(f)); performance of the contract when you are a customer (Art. 6(1)(b)) |
| Offering you an optional questionnaire on why a quotation was not accepted | Legitimate interest in improving our offers (Art. 6(1)(f)); you are free not to answer |
4. The artificial intelligence assistant
To give you attentive follow-up, our sales team is assisted by an artificial intelligence assistant running on our own equipment, in France: your replies are not passed to any artificial intelligence provider. It reads your replies to our quotations, categorises and summarises them, so that your contact handles them at the right time.
- A human stays involved: your replies go straight to your sales contact’s mailbox, and they read them personally. An unclear reply is always referred to them, and they can correct the categorisation at any time.
- No automated decision-making within the meaning of Article 22 GDPR: the assistant applies simple follow-up rules (for example, stopping reminders if you decline the offer, or contacting you again on the date you give). No decision producing legal effects concerning you is taken on this basis.
- Data minimisation: only replies related to a quotation are passed to the assistant; our other correspondence is not. The assistant does not keep your replies and does not learn from them: only the result of the analysis is recorded in our follow-up application.
- Your choice: you can ask at any time that your replies are not analysed by the assistant; your contact then reads them alone (section 8).
5. Who receives your data?
| Recipient | Role | Data concerned |
|---|---|---|
| ON GROUP sales team (your contact and their manager) | Internal | All the data of your follow-up |
| Microsoft (Microsoft 365) | Processor – e-mail | E-mails |
| Sales follow-up tool (Odoo) | Internal (ON GROUP tool) | Contact details, quotation, summary of exchanges, outcome |
Our processors act on our instructions, under contracts that comply with Article 28 GDPR. Your data is never sold or rented.
6. Transfers outside the European Union
The analysis of your replies by the artificial intelligence assistant takes place on our own equipment, in France: it involves no transfer outside the European Union.
Your e-mails are hosted by Microsoft 365 in the European Union. The quotation follow-up application and its artificial intelligence assistant are hosted on ON GROUP equipment located in France.
7. How long do we keep it?
| Data | Retention period |
|---|---|
| Prospect data (contact, quotations, correspondence, summaries) | 3 years from the last contact initiated by you, then deleted or anonymised |
| Customer data | Duration of the business relationship, then statutory periods (e.g. 10 years for accounting records) |
| Text of your replies in the follow-up application | 24 months after the quotation is closed |
| Your replies while the assistant analyses them | Not kept by the assistant: only the category and the summary are recorded in the follow-up application |
| Objection request | Kept for as long as needed to honour it, as a mere fingerprint of your address |
8. Your rights
You have the right to access, rectify and erase your data, to restrict its processing and, where applicable, to data portability. You can also give instructions on the retention, erasure and communication of your data after your death: general instructions, registered with a trusted digital third party certified by the CNIL, or specific instructions, sent to ON GROUP (section 1). Without instructions, your heirs may, to the extent necessary, access your data to settle your estate, and ask for your file to be closed or your data to be updated (Article 85 of the French Data Protection Act).
Right to object: you can object at any time, without giving a reason, to our sales follow-up and reminders. The simplest way: reply “stop” to any of our e-mails, or write to us (section 1). Your objection applies to all your quotations. For the analysis of your replies by the AI assistant, no reason is needed either: on simple request, your replies are no longer passed to it and only your contact reads them. You can also object, on grounds relating to your particular situation, to the other processing based on our legitimate interest.
Right to erasure: at your request, we delete your data or anonymise it irreversibly: only anonymous statistics remain (amounts and outcomes of quotations). If you no longer wish to be contacted, we keep only a fingerprint of your address, so that we do not write to you again.
We reply to any request concerning your rights within one month of receiving it. This period may be extended by two months if the request is complex or if we receive many requests; we will then inform you, with the reasons, within the first month. If we have reasonable doubts about your identity, we may ask you for proof of it. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.
9. Security
We protect your data with appropriate technical and organisational measures: access restricted to authorised staff, with two-factor authentication; the application’s access limited to the mailboxes of the salespeople concerned; encrypted communications; access logging.
10. Changes
We may update this notice. The current version is published at https://ongroup.net/confidential-policy/, with the date of its last update. If we make a substantial change (for example a new purpose, a new recipient or a new transfer outside the European Union), we will inform you by e-mail before it applies.