At FAKS, protecting your personal data is a priority.
When you use the faks.co website (hereinafter the “Website”) and the Faks app (hereinafter the “App”), we collect personal data about you.
The purpose of this policy is to inform you about how we process this data in accordance with Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”)
The data controller is COMMANDES PHARMA, a simplified joint-stock company registered with the Paris Trade and Companies Register under No. 881 529 861, with its principal place of business located at 78 avenue des Champs-Élysées, Suite 326, 75008 PARIS (hereinafter “We” ) when you use the Website and/or the App, when you create your customer account, or when we manage our contractual relationship with you.
However, when our client pharmacies and laboratories use our services, we may need to process personal data on their behalf and for their account, particularly with regard to their own staff. In such cases, our clients act as data controllers in accordance with Article 4 of the GDPR, and we act as a data processor in our capacity as a service provider.
We also act as a processor, in the name and on behalf of our payment service provider Treezor, which acts as a data controller in connection with the management of payment transactions (hereinafter the “Payment Service Provider”)
You may notify Treezor directly regarding any request to exercise your rights (access, correction, objection, etc.) or to inform them of a potential data breach. This notification may be made:
Personal data is any data that allows an individual to be identified directly or by cross-referencing with other data.
We collect data regarding pharmacists and laboratory staff who use the Website and the App.
This data falls into the following categories:
● Identification data (including your last name, first name, email address, landline number, and cell phone number);
● Data related to your professional life (including the name and address of the pharmacy or laboratory where you work);
● Data related to orders placed with laboratories (photos of invoices and delivery notes);
● Data contained in communications between pharmacists and laboratories;
Required data is indicated when you provide us with your information. It is marked with an asterisk and is necessary for us to provide our services to you.
Objectives
Legal Basis
Shelf life
Allow you to create and manage your account
Performance of a contract you have entered into
The data is retained for the duration of the contractual relationship
Perform customer management tasks related to contracts, invoices, and customer relationship management
Performance of a contract you have entered into
Personal data is retained for the duration of the contractual relationship.
In addition, your data is archived for evidentiary purposes for a period of 5 years.
Build a database of customers and prospects
Our legitimate interest in developing and promoting our business
For customers: Data is retained for the duration of the contractual relationship and is deleted three years after the relationship ends, for marketing purposes. For prospects: Data is retained for three years from the date of your last contact.
Process your requests for demos or information
Our legitimate interest in responding to your requests for demos or information
The data is retained for as long as necessary to process your request for a demo or information and is deleted once it has been processed.
Comply with the legal obligations applicable to our business
Comply with our legal and regulatory obligations
Regarding invoices: Invoices are retained for a period of 10 years. Transaction data is retained for 5 years.
Manage requests to exercise rights
Comply with our legal and regulatory obligations
If we ask you to provide proof of identity, we will retain it only for as long as necessary to verify your identity. Once the verification is complete, the proof of identity will be deleted.
Compile usage statistics for the app
Our legitimate interest in improving our services and, in certain cases, sharing these statistics with pharmacy groups in order to analyze how their members use the App
The data is retained for a period of three years from the date of collection.
The following will have access to your personal data:
(I) Our company’s staff;
(II) Our subcontractors: hosting provider, transactional email service provider, CRM tools, payment service provider;
(III) Our partner pharmacies, pharmacy groups, and pharmaceutical companies
(IV) Where applicable: public and private entities, exclusively to fulfill our legal obligations.
Your data is retained and stored for the entire duration of processing on the Heroku platform, hosted on AWS servers located in Ireland within the European Union.
As part of the tools we use (see the section on recipients regarding our processors), your data may be transferred outside the European Union. The transfer of your data in this context is secured using the following tools:
● either this data is transferred to a country that has been deemed to offer an adequate level of protection by a decision of the European Commission;
● or we have entered into a specific contract with our processors governing the transfer of your data outside the European Union, based on the standard contractual clauses between a data controller and a processor approved by the European Commission;
● or we rely on the appropriate safeguards provided for by applicable regulations.
You have the following rights regarding your personal data:
- Right to information: this is precisely why we have drafted this policy. This right is provided for in Articles 13 and 14 of the GDPR.
- Right of access: You have the right to access all of your personal data at any time, pursuant to Article 15 of the GDPR.
- Right to rectification: You have the right to rectify your inaccurate, incomplete, or outdated personal data at any time in accordance with Article 16 of the GDPR
- Right to restriction: You have the right to obtain the restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
- Right to erasure: you have the right to request that your personal data be erased and to prohibit any future collection thereof for the reasons set forth in Article 17 of the GDPR
- Right to lodge a complaint with a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data constitutes a violation of applicable laws. (Article 77 of the GDPR)
- Right to establish guidelines regarding the retention, erasure, and disclosure of your personal data after your death, in accordance with Article 40-1 of the French Data Protection Act.
- Right to withdraw your consent at any time: for processing based on consent, Article 7 of the GDPR provides that you may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.- Right to data portability: under certain conditions specified in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a standard, machine-readable format and to request its transfer to a recipient of your choice.
- Right to object: pursuant to Article 21 of the GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue to process your data despite this objection, for legitimate reasons or to defend our legal rights.
You may exercise these rights by writing to us at the address below. We may ask you to provide additional information or documents to verify your identity.
You can contact our Data Protection Officer (DPO), Mr. Michel Leclerc, regarding the processing of your data by email at the following address: dpo@faks.co
Or by mail to the following address: COMMANDES PHARMA, 78 avenue des Champs-Élysées, Suite 326, 75008 PARIS
We may modify this policy at any time, in particular to comply with any regulatory, legal, editorial, or technical changes. These modifications will take effect on the date the revised version becomes effective. We therefore encourage you to review the latest version of this policy regularly. However, we will notify you of any significant changes to this privacy policy.
Effective Date: July 9, 2026
