Privacy Policy

1. Data controller

The controller of the personal data collected on www.metteuraupoint.fr is its publisher, a sole trader operating under the trade name metteuraupoint.fr, whose identification details are set out in the legal notice.

For any question about your data or to exercise your rights, please write to: contact@metteuraupoint.fr

2. Data collected

Metteur au Point is a professional platform connecting HVAC commissioning engineers (heating, ventilation, air conditioning) with clients. The data processed depends on how you use the platform:

Experts (commissioning engineers, technicians, subcontractors)

• Identity and contact details: first name, surname, email address, telephone number, company, town or city, SIRET number (French company registration number).
• Professional profile: specialisms, certifications, service areas and geographical location, day rate, availability, years of experience, website, logo, social media profiles, professional indemnity/liability insurance certificate.
• Activity on the platform: subscription plan, quotes issued, site visit reports, subcontracting requests and responses, equipment listings, messages, forum posts, calibration requests, invited team members (name, email address), referrals.

Clients

• Identity and contact details: first name, surname, email address, telephone number, company, town or city.
• Project requests posted: title, site name and address, dates, technical description, attachments; quotes received and the decision taken (accepted or declined).

CV database candidates

• First name, surname, email address, telephone number, town and region, job title and type of position sought, skills, years of experience, availability, personal summary, CV, photo, LinkedIn profile URL.

Calibration laboratories

• Company name, SIRET number, contact person's first name and surname, email address, telephone number, postal address, website, logo, services offered, equipment calibrated, accreditations, service area, subscription payment information.
• Calibration requests sent by experts: the expert's name, email address and telephone number, and the instrument concerned.

Equipment suppliers

• When booking a featured slot on the Marketplace: company, email address, telephone number, brand, product, description, photo, purchase link.

Newsletter subscribers

• Email address and date of subscription.

All users and visitors

• Account login log: date, IP address, browser, name, company and role.
• Traffic source statistics, recorded once per browsing session: landing page, referring site, campaign parameters (UTM), IP address, browser, date.
• Real-time presence: a random identifier and the page being viewed, held in server memory for 90 seconds to count visitors currently online, and never written to a database.
• Web server technical logs: IP address, page requested, date, browser.
• Browsing data collected by the analytics and advertising tools described in section 8.

Payment: payments are processed by Stripe. Card numbers are entered directly with Stripe and are never received or stored by this site, which keeps only the Stripe customer identifier, the amounts and the payment status. Passwords are stored in hashed form only.

3. What other users can see

• Public expert map: subscribed experts are shown with their town, location, specialisms, certifications, areas covered, availability, day rate, years of experience, rating, number of assignments and a verified-insurance badge. On the Discovery plan, the name, company, logo, website and social media profiles are hidden; they are displayed on the Premium plan or during a paid featured listing.
• Public project request map: only the town (without the address), the type and the dates of project requests are displayed, together with their title where they are open to the whole network. The client is never named.
• Project requests: once approved by the administrator, the project request is shared with the experts in the network, or only with the company chosen by the client: title, site address, dates, description and attachments in a version anonymised by the administrator. The client's name and contact details remain hidden.
• Quotes: the client receives quotes in anonymised form (without the expert's name, company, town or contact details) until they accept them.
• Introductions: when the client accepts a quote, the client's and the expert's contact details are shared with each other free of charge. If the client declines the quote, they may obtain the expert's contact details by paying a flat introduction fee of €100; in that case the expert does not receive the client's details.
• CV database: profiles of candidates with an active subscription can be viewed by subscribed experts, including name, contact details, town, CV, photo and LinkedIn profile. As soon as an application is withdrawn, the contact details, CV, photo and LinkedIn profile are no longer shared and the surname is reduced to its initial.
• Metrology laboratories: listings of subscribed laboratories, including their contact details, can be viewed by logged-in experts and technicians.
• Members' area: forum posts (with the author's first name and surname) and equipment listings (with telephone number) are visible to logged-in members; messages are visible only to the participants in the conversation. A product featured by a supplier is displayed publicly with the supplier's company name.

4. Purposes and legal bases

• Creating and managing accounts, introductions, project requests, quotes, messaging, forum, CV database, subcontracting, Marketplace and metrology directory; sending service emails (registration confirmation, password reset, project request and quote alerts, renewal reminders) — legal basis: performance of a contract (the terms of use and sale you have accepted).
• Managing subscriptions, payments and invoices — legal basis: performance of a contract; retention of accounting records: legal obligation.
• Verifying professionals (SIRET number, insurance certificate), moderating project requests, listings and posts, anonymising attachments — legal basis: legitimate interest in ensuring the reliability of the network.
• Security of the site and of accounts: login log, login attempt limits, session revocation, server logs — legal basis: legitimate interest in protecting the service and its users.
• Internal traffic source statistics and real-time presence counter — legal basis: legitimate interest in understanding how the site is used.
• Sending the newsletter — legal basis: consent, which may be withdrawn at any time.
• Audience measurement (Google Analytics), browsing behaviour analysis (Microsoft Clarity) and advertising campaign measurement (LinkedIn) — these trackers are subject to consent (see section 8).

Your data is never sold, rented or transferred to third parties for marketing purposes.

5. Recipients and processors

Data is accessible to the site publisher for the administration of the service and, within the limits described in section 3, to other users. It may be disclosed to competent authorities where legally required. The site uses the following service providers:

• OVH SAS (France): hosting of the site, database and uploaded files on a server located in France; mail servers used to send emails.
• Stripe: online payment of subscriptions and fees (name, email address, amount, card details entered with Stripe).
• Google: Google Analytics 4 audience measurement.
• Microsoft: Microsoft Clarity browsing behaviour analysis.
• LinkedIn: LinkedIn Insight Tag, measuring visits and conversions from LinkedIn campaigns.
• Mapbox: address geocoding and address suggestions while typing (address text and the browser's IP address).
• OpenStreetMap: fallback geocoding through the Nominatim service (address text, sent from our server) and map tiles served by OpenStreetMap France (the browser's IP address).
• Cloudflare (cdnjs): delivery of the mapping library used by the maps (the browser's IP address).

The URLs of the site's public pages are notified to search engines via the IndexNow protocol; no personal data is transmitted in the process.

6. Transfers outside the European Union

Some providers (Stripe, Google, Microsoft, LinkedIn, Mapbox, Cloudflare) are established in the United States or belong to US groups, so data may be transferred to or accessed from the United States. Depending on the provider, these transfers rely on its certification under the EU–US Data Privacy Framework and/or on the standard contractual clauses adopted by the European Commission. The OpenStreetMap Foundation is established in the United Kingdom, which benefits from a European Commission adequacy decision.

7. Retention periods

• Expert, client and candidate accounts: for as long as the account exists, then 3 years after the last activity for inactive or non-subscribed accounts, except for data that must be kept to meet a legal obligation.
• Project requests, quotes and messages: for as long as the account exists, then 5 years from the end of the relationship, the limitation period applicable to disputes.
• CV, photo and LinkedIn profile: shared with experts until the application is withdrawn; deleted when the account is closed or upon request.
• Metrology laboratory listings and supplier bookings: for the duration of the subscription, then 3 years.
• Invoices and accounting records: 10 years, as required by the French Commercial Code.
• Newsletter: until you unsubscribe.
• Login log: 1 year.
• Traffic source statistics: 13 months.
• Web server logs: 14 days (automatic rotation).
• Real-time presence: 90 seconds, in memory only.

8. Cookies and trackers

Strictly necessary for the site to function

• map_session login cookie for your account (signed token, not accessible to scripts), 7 days.
• admin_session administration session cookie, 2 hours (administrator only).
• map_lang cookie storing your chosen language, 12 months.
• presence_id random identifier kept in the browser's local storage, used by the online visitor counter.
• track_visit_done session storage entry preventing the same visit from being counted more than once, cleared when the tab is closed.
• presence_banner_reduit, miseaupoint_reviewed display preferences kept in the browser's local storage (collapsed banner, reviews already given in the client area).

Analytics and advertising

• Google Analytics 4 — _ga and _ga_* cookies (up to 13 months): pages viewed, visit duration, traffic source, events such as registration or payment. IP address anonymisation is enabled.
• Microsoft Clarity — _clck and _clsk cookies and cookies on the clarity.ms domain: recording of clicks, scrolling and mouse movements, used to replay browsing sessions and produce heatmaps.
• LinkedIn Insight Tag — cookies set by LinkedIn (including on the linkedin.com domain): measurement of visits and conversions (registration, checkout started, purchase) and, where applicable, building advertising audiences on LinkedIn.

These tools are only loaded once you have given your consent, which you give or refuse in the banner shown on your first visit; refusing is as easy as accepting and the site remains fully usable without them. Your choice is kept for 6 months in your browser's local storage (cookie_consent), after which you are asked again. You can change it at any time:

Manage my cookie choices

The technical services listed in section 5 (map tiles, mapping library, address suggestions, Stripe payment page) receive your browser's IP address when they are used.

9. Your rights

Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your data:

• the right of access, rectification and erasure;
• the right to restriction of processing and the right to object, in particular to processing based on legitimate interest;
• the right to portability of the data you have provided to us;
• the right to withdraw your consent at any time, in particular for the newsletter;
• the right to give instructions regarding the handling of your data after your death.

You can update most of your information from your account area. You can also delete your account yourself from your account area (“Delete my account” section): your personal data is then erased or anonymised, and only records that must be kept by law (quotes, invoices) are retained in anonymised form. To exercise your other rights or unsubscribe from the newsletter, write to contact@metteuraupoint.fr. You will receive a reply within one month; proof of identity may be requested if there is any doubt about your identity. Monthly or annual subscriptions can be cancelled from your account area.

If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL): www.cnil.fr.

10. Security

• HTTPS encryption across the entire site.
• Passwords stored only in hashed form (bcrypt), never in plain text.
• Login sessions held in a cookie that scripts cannot access, and revoked automatically when the password is changed or the account is blocked.
• Limits on the number of login attempts.
• Documents containing personal data (project request files, quotes, CVs, certificates) are served only to authorised persons, after their access rights have been checked.

11. Changes to this policy

This policy may be amended to reflect changes to the service or to the law. The date of the latest update is shown at the top of the page.