Privacy policy
This privacy policy aims to inform users of the site about how GREENBUDDY collects, uses and protects their personal data, in accordance with the General Data Protection Regulation (GDPR).
Data controller
Personal data is processed by:
GreenBuddy SAS ("Sopht")
24 boulevard Eugène Réguillon, 69100 Villeurbanne, France
Contact: dpo@sopht.com
Data Protection Officer (DPO)
For any question about the processing of your data: dpo@sopht.com
Data processed through this site
Contact form: The sopht.com contact form collects your first name, last name, email address, company, phone number and profile. Fields marked with an asterisk (*) are required to process your request. The other fields are optional. Form submissions are hosted by Webflow and sent to Outlook, where the Sopht teams process them.
Marketing communications: If you tick the optional box on the form, we use your contact details to send you information about Sopht's offers, content and events. If you leave the box unticked, your request is still sent.
B2B prospecting: Outside the website, Sopht processes professional contact data (name, job title, company, professional email and phone number) to prospect companies that may be interested in its services. This data is managed in HubSpot (CRM), Sillage (sales intelligence) and Allo (business telephony). Some calls made through Allo are recorded. You are informed at the start of the call and can object to the recording.
Browsing data: With your consent, cookies and similar trackers collect data about your visit for audience measurement and advertising (see "Cookies and trackers").
Technical logs: Our host, Webflow, keeps technical logs (IP address, browser type, timestamp) for security and to keep the service running.
Purpose and legal basis
Responding to your contact request: Art. 6(1)(b) GDPR, pre-contractual steps taken at your request.
Sending marketing communications after you opt in on the form: Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time.
B2B commercial prospecting (HubSpot, Sillage, Allo): Art. 6(1)(f) GDPR, Sopht's legitimate interest in developing its business. You can object at any time.
Recording of prospecting calls (Allo): Art. 6(1)(f) GDPR, legitimate interest (training and quality of exchanges). You are informed at the start of the call and can object.
Audience measurement and advertising (Google Analytics, Google Ads, LinkedIn Ads): Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act, your consent.
Retention of technical logs by the host: Art. 6(1)(f) GDPR, legitimate interest (security of the service).
Recipients
Your data is accessible only to authorized Sopht teams (sales, marketing, customer success, support) and to the following processors, each within the limits of its role:
Webflow, Inc. (USA): website hosting and form handling
Google Ireland Ltd / Google LLC: audience measurement (Google Analytics) and advertising (Google Ads). LinkedIn Ireland Unlimited Company: advertising measurement and audiences (LinkedIn Ads)
Sphynx: management of our advertising campaigns
Allo: business telephony and call recording. Allo uses OpenAI as a sub-processor. Your data is not used to train its models.
Leto: portal for exercising your data protection rights
HubSpot: CRM for managing prospects and customers
Sillage: sales intelligence
Microsoft Ireland Operations Ltd: professional email (Microsoft 365)
Transfers outside the European Union
Some of our providers, including Webflow, Google and LinkedIn, are US companies or belong to US groups. Even when data is stored in the EU (as with Google Analytics), these companies may access it from the United States. Such transfers are covered by the provider's certification under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, where that does not apply, by the European Commission's Standard Contractual Clauses.
Retention period
Contact requests: 3 years from the last contact you initiated, unless a contract follows.
Marketing communications: until you withdraw your consent, or 3 years without any interaction.
B2B prospecting data: 3 years from the last contact or interaction.
Call recordings (Allo): 6 months.
Host technical logs: kept by Webflow, our hosting provider acting as processor, for up to 12 months, for security and proper functioning of the service.
Analytics data: 14 months.
Cookies and trackers: 12 months (see "Cookies and trackers").
Cookie consent choice: 12 months.
Your rights
Under Articles 15 to 22 of the GDPR, you have the right to: access, rectify and erase your data; restrict its processing and receive it in a portable format; object at any time to its processing, including for commercial prospecting; withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal; and set directives for the storage, erasure and communication of your data after your death (Article 85 of the French Data Protection Act).
To exercise these rights, email dpo@sopht.com or use our portal: app.leto.legal/portal/sopht
You may also file a complaint with the CNIL: www.cnil.fr
Cookies and trackers
When you first visit sopht.com, our own consent banner (built and hosted by Sopht, no third-party consent service) asks for your choice before any non-essential tracker is placed. Non-essential trackers stay blocked until you accept them. You can accept all, reject all, or choose by category. Rejecting is as easy as accepting. Trackers are grouped into three categories:
Essential: needed for the site to work and to store your cookie choices. They do not require consent.
sopht_consent (Sopht, sopht.com): stores your choice for each category (audience measurement, advertising) and the date of that choice. Duration: 12 months.
_cfuvid (Cloudflare, via our host Webflow): protects the site against abuse and excessive traffic. Duration: session (deleted when you close your browser).
Audience measurement: Google Analytics measures traffic and how the site is used. It loads only if you accept this category. This data is pseudonymous, not anonymous: it is linked to an identifier stored in your browser. Analytics data is stored in the EU.
_ga (Google): distinguishes visitors. Duration: 13 months.
_ga_HBV43MNVDY (Google): keeps the session state. Duration: 13 months.
Advertising: Google Ads (loaded through Google Tag Manager) and the LinkedIn Insight Tag load only if you accept this category. They measure the performance of our campaigns, which our agency Sphynx manages, and build advertising audiences (retargeting) on Google and LinkedIn.
_gcl_au (Google): measures ad conversions. Duration: 90 days.
li_fat_id (LinkedIn, sopht.com): links a click on one of our LinkedIn ads to a visit or conversion on our site. Duration: 30 days.
bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory (LinkedIn, linkedin.com): identify your browser for LinkedIn ad measurement and audience building. Duration: from 24 hours (lidc) to 1 year (bcookie).
How long your choice lasts: Your consent is valid for 12 months. After that, or if we add new trackers, we ask again.
Changing your choices: You can change or withdraw your consent at any time with the “Cookie settings” link at the bottom of every page. To exercise your other rights, use app.leto.legal/portal/sopht. Withdrawing consent stops new data collection and deletes the tracking cookies set on sopht.com. Cookies that LinkedIn sets on linkedin.com can be deleted in your browser settings.
Security
Sopht has been ISO 27001 certified since November 2025. We implement appropriate technical and organizational measures to protect your data.
Policy changes
GreenBuddy SAS ("Sopht") reserves the right to modify this privacy policy at any time in order to ensure compliance with applicable legislation.
Last updated : 09/10/2026