Renaissance SAS
Version 2.3 of 20 October 2026 (replaces version 2.2 of the same day)
1. Purpose and Scope
This policy describes the commitments of Renaissance SAS, trading under the "Verifiables" brand ("we"), as regards the protection of personal data, under Regulation (EU) 2016/679 (the "GDPR") and French Law No. 78-17 of 6 January 1978 as amended.
It covers the processing we carry out for our own purposes: the commercial relationship, contracts and billing, support, recruitment, human resources, the website, and the security of our systems.
Two documents supplement it:
•the application and services privacy policy, which describes, service by service, the processing carried out by means of our thirteen services;
•the data processing agreement entered into with each client, which governs the processing we carry out on their behalf and prevails over this policy for that processing.
2. Who We Are
Renaissance SAS is a French company specialising in digital identity and verifiable attestations. We provide a trust infrastructure aligned with the revised eIDAS Regulation: the verification and issuance of electronic attestations, a mobile wallet, the verification of visible digital seals and document analysis, the reading of the chip in identity documents, facial biometrics, telecom verification, the identification and ongoing monitoring of legal entities, screening, identity services for software agents, registries and lists, and strong authentication by wallet, all of it accessible through application programming interfaces, software development kits and the Dashboard.
Controller
Renaissance SAS, société par actions simplifiée (a French simplified joint-stock company)
78 rue Notre-Dame de Nazareth, 75003 Paris, France
RCS Paris 911 608 222 (Paris trade and companies register)
Data protection contact: dpo@verifiables.com
This address is the single point of contact for any question relating to data protection and for the exercise of rights.
3. Processing Carried Out as Controller
| Purpose | Categories of Data | Legal Basis | Retention |
|---|
| Commercial relationship and business prospecting | Surname, first name, business email address, telephone, role, company | Legitimate interest in developing our business with professionals | Three (3) years from the last contact |
| Access to documents shared by link | Recipient name, email address where applicable, IP address, browser data, opening timestamps | Legitimate interest in following up the commercial relationship and in the security and evidence of access | Twelve (12) months |
| Contracts, billing and accounting | Client identification details, contact details of the signatories, billing data, contractual history | Performance of the contract, then accounting legal obligation | Duration of the contract, then ten (10) years under the French Commercial Code (Code de commerce) |
| Accounts and authorised users | Identifiers, email address, passwordless access keys, roles, connection logs | Performance of the contract | Duration of the contract, then one (1) year |
| Support and assistance | Name, email address, content of the exchanges, technical material attached | Performance of the contract | Duration of the relationship, then one (1) year |
| Recruitment | Curriculum vitae, covering letter, contact details, interview notes | Pre-contractual steps taken at the candidate's request, and consent for retention beyond the recruitment concerned | Two (2) years from the last contact, unless erasure is requested |
| Human resources | Identification, contractual, administrative and payroll data of staff | Performance of the employment contract and legal obligations | The statutory periods applicable to each category |
| Website | Server logs, IP address | Legitimate interest in ensuring the security and availability of the site | Twelve (12) months |
| Usage statistics of our online services (public verifier and in-browser integrations) | Network the request comes from, the IP address being truncated before anything is stored (/24 for IPv4, /48 for IPv6), operator or organisation holding that network and country, browser type, referring page without its parameters | Legitimate interest in measuring the use of our services and knowing which organisations use them | Thirty (30) days for the network, browser and referring page; twelve (12) months for the operator and country |
| Improving document reading (public verifier) | Files sent to the public verifier whose code could not be read or took more than three (3) seconds to read, whose comparison with the text failed or was slow, or whose identity certificate could not be validated, and their names, encrypted; recognised document type or reason for the failure, duration and steps of the check, operator of the originating network | Legitimate interest in fixing reading failures and slowness | Twenty-four (24) hours, then deletion |
| Management of suppliers and partners | Business contact details of the persons dealt with | Performance of the contract and legitimate interest | Duration of the relationship, then three (3) years |
| Security of our systems and prevention of abuse | Access and event logs, IP addresses, technical identifiers | Legitimate interest in protecting our systems, and legal obligation where applicable | Twelve (12) months |
Source of the data. The data of business contacts comes from the person themselves, from their employer, or from accessible public or professional sources (the company's website, public registers, professional networks). Any person may object to its processing at the address given in section 10.
Principles. We collect only the data necessary for each purpose, we retain it for the period indicated and then erase or anonymise it, we inform the data subjects, and we take no automated decision producing legal effects.
4. Processing Carried Out as Processor
For the processing carried out by means of our services, on behalf of our clients, we are the processor within the meaning of Article 28 of the GDPR. Our commitments are set out in the data processing agreement signed with each client; the main ones are as follows.
•Instructions. We process the data only on documented instructions from the client, and we alert the client where an instruction appears to us to infringe the regulations.
•No reuse. We never use this data on our own account, nor for prospecting, nor for training or evaluating machine learning models.
•Confidentiality. The persons authorised to process the data are bound by confidentiality and access it only within the limits of their duties.
•Security. We apply the technical and organisational measures described in Annex B to the data processing agreement.
•Sub-processors. The client gives a general written authorisation for the list in force. Any addition or replacement is notified to the client at least thirty (30) days in advance, ten (10) days in a justified emergency, and the client may object, giving reasons, within fifteen (15) days.
•Assistance. We forward to the client the requests to exercise rights that we receive and we assist it in responding to them, as well as with its impact assessments and its prior consultations.
•Personal data breaches. We notify the client of any breach affecting its data within twenty-four (24) hours of becoming aware of it.
•Audit. The client may audit our processing one (1) time per year, on a documentary basis or on site, with a notice period of thirty (30) business days and an auditor that is not a competitor, and also after a breach affecting it or at the request of a supervisory authority. Clients subject to financial regulation have extended rights.
•End of the service. The data remains exportable during a recovery period of at least thirty (30) days, and is then erased; a written attestation of erasure is issued on request.
In accordance with Article 30(2) of the GDPR, we maintain the record of the categories of processing activities carried out on behalf of our clients. It is provided on request.
5. Recipients and Processors
•Our authorised personnel, within the limits of their duties and under an obligation of confidentiality.
•Our technical processors, by category: the hosting and infrastructure of the platform, located in the European Union; internal tools for sales management, email, collaborative work and development, some of which are supplied by companies established in the United States. These internal tools handle no data submitted to our services by our clients.
•Our advisers: accountants, statutory auditors and lawyers, bound by professional secrecy.
•The competent authorities, where the law so requires. We examine the lawfulness of each request, challenge it where there are reasonable grounds to do so and limit disclosure to the strict minimum.
We do not sell any data and we disclose none of it for advertising purposes. The named list of the sub-processors involved in providing our services, with their country of processing, is set out in Annex 4 to our Terms of Service: it is made available to our clients in their Dashboard and provided on request.
6. Security
•Encryption in transit by TLS and at rest for databases, backups and stored objects.
•Access control on the principle of least privilege, passwordless authentication by access key, periodic review of authorisations, logging of administrative access.
•Partitioning of the development, test and production environments, and of data by client organisation.
•Management of signing keys in a key management service located in France, with no possibility of export.
•Monitoring of availability and errors, with a documented incident procedure.
•Backups that are encrypted, with rotation and tested restoration.
•Development with code review, automated tests, dependency analysis and vulnerability management; coordinated disclosure contact point at
security@verifiables.com.
•Awareness training for our staff on information security.
Our security policy draws on the requirements of the ISO/IEC 27001 standard and of the ETSI EN 319 401 standard. We claim no certification and no approval on that basis to date. The independent audits and penetration tests we hold are provided in summary form to those of our clients that ask for them.
7. Location and Transfers
The data processed by means of our services is hosted in the European Union, in France, and our processors process it in the European Union or in a country recognised as adequate by the European Commission.
The data of our internal processing (the commercial relationship, email, collaborative work, development) may be processed by providers established in the United States. Those transfers are covered by an instrument under Chapter V of the GDPR: an adequacy decision where the provider falls under one, failing that the European Commission's standard contractual clauses, supplemented where necessary by additional measures.
Two routings lie outside our control and do not constitute transfers on our part: the use of our services from a third country by the person themselves, and the routing of a short message by the operator serving a foreign number.
8. Personal Data Breach
In the event of a personal data breach, we contain it and assess its risk without delay, and then:
•where we are the controller, we notify the CNIL (the French data protection authority) within seventy-two (72) hours where the breach is likely to result in a risk, and we inform the data subjects where the risk is high;
•where we are the processor, we notify the client concerned within twenty-four (24) hours of becoming aware of the breach, with an update within seventy-two (72) hours and a final report within one (1) month;
•in all cases, we document the incident, its effects and the corrective measures.
9. Cookies
The verifiables.com site is a static site. It sets no analytics, profiling or advertising cookie, and embeds no third-party tracker. The only cookies that may be set are those strictly necessary for the operation of a service you request, which do not require your consent.
The Dashboard, accessible after authentication, uses a session cookie strictly necessary for your login.
10. Your Rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time where the processing is based on it, without affecting the lawfulness of the processing carried out beforehand.
These rights are exercised with [dpo@verifiables.com](mailto:dpo@verifiables.com), or by post to the address in section 2. We may ask for proof of identity in the event of reasonable doubt. We respond within one month, which may be extended by two months where the request is complex, and we give reasons for any refusal.
Where your data is processed by our services on behalf of a client, that client is the controller: address your request to it. If you write to us, we forward your request to that client without delay.
You may lodge a complaint with the CNIL, the Commission nationale de l'informatique et des libertés, www.cnil.fr, 3 place de Fontenoy, 75007 Paris.
11. Changes
This policy is revised at least once a year and on every significant change to our processing. The version in force and its date appear at the head of this document. Material changes are notified to our clients by email and in the Dashboard.
Renaissance SAS
Version 2.3 of 27 October 2026 (replaces the version of 16 October 2026)
1. Purpose and Scope
This policy describes how Renaissance SAS, trading under the "Verifiables" brand ("we"), processes personal data in the context of its applications and services:
•the verification of attestations presented from an identity wallet, remotely, in the browser or in proximity;
•the issuance of attestations on behalf of our clients;
•the Verifiables Wallet, a mobile application for individuals;
•Verifiables Docs, a mobile verification application for front desks;
•the verification of visible digital seals (2D-DOC, VDS) and document analysis;
•the reading of the chip in identity documents;
•biometric verification and liveness detection;
•telecom verification;
•the identification of legal entities and ongoing monitoring;
•screening against sanctions lists and lists of politically exposed persons;
•the identity bridge for artificial intelligence agents;
•relying party registration, private registries and status lists;
•payments and strong authentication by wallet;
•the Dashboard, the API and the software development kits.
It supplements the company privacy policy, which covers the commercial relationship and our internal activities, and the data processing agreement entered into with each client, which prevails over it for the processing we carry out on their behalf.
2. Who Is Responsible for What
The following distinction governs how you exercise your rights.
Our clients are controllers and we are the processor for almost all of the services: when a company verifies your identity, your age, a supporting document or a telephone number, it is that company that decides on the purpose and that answers for the lawfulness of the processing. We carry out that verification on its instructions. A request for access, rectification or erasure must be addressed to that company; we forward it to them if you write to us.
We are the controller for: the Verifiables Wallet in our direct relationship with you; the management of client accounts, billing and support; the security of the platform and its technical logs; aggregated, non-identifying usage statistics; the copies of public registers that we build for the services relating to legal entities; our reference database of politically exposed persons; the trust lists that we maintain.
We act as an intermediary when we receive an attestation presentation on behalf of a verifier, within the meaning of the revised eIDAS Regulation: we retain no information about the content of the transactions for our own account, and we neither cross-reference nor profile the data received.
3. Principles Applied
•Selective disclosure. The formats we implement (SD-JWT VC, mdoc ISO 18013-5) make it possible to reveal only the attributes requested. A proof of age returns the "adult" result alone, without a date of birth.
•Verification without an intermediary. The validity of an attestation is checked cryptographically, without contacting its issuer: the issuer does not learn where you present it.
•No retention by default. The attributes presented during a verification are erased at the end of the window for retrieving the result. Document files are deleted after processing.
•No profiling. We build no database of faces, no database of numbers and no database of identity documents, and we never use your data to train or evaluate machine learning models.
•Keys on the device. In the Wallet, attestations and private keys stay in the device, protected by the hardware, out of our reach.
4. Processing by Service
The periods below are those that apply by default. Our clients may shorten them, and extend them within the limits we document, under their own responsibility.
4.1 Verification of Attestations
| Data | Source | Retention |
|---|
| Attributes you choose to disclose | Your wallet | Erased at the end of the retrieval window, sixty (60) seconds remotely |
| Result of the checks, timestamp, fingerprints, session identifier | Our servers | 90 days |
In proximity (Bluetooth), the exchange takes place between your device and the verifier's device: nothing is retained on our servers. We do not know which attributes an attestation we never receive contains.
4.2 Issuance of Attestations
The attributes provided by our client are used to build the signed attestation, which is delivered to your wallet. We retain the proofs of issuance (identifier, template, fingerprint, position in the status list, timestamp) for the validity period of the attestation plus the statutory period. Public status lists contain no personal data: they carry only a position and a state.
4.3 Verifiables Wallet
We are the controller for this application, which is governed by its own terms of use.
•Your attestations, your private keys and your identity document data are kept in your device, in an encrypted database whose keys are protected by the hardware. We have no access to them.
•The wallet attestation service receives a key identifier and a device integrity proof, and issues a token valid for twenty-four (24) hours. It processes no identity data.
•Encrypted backup and synchronisation, in preview, store only opaque payloads that we cannot decrypt. If you lose your local key, we can neither recover it nor restore the backup.
•The application stores and the integrity services of Apple and Google operate under their own terms. They receive no identity data from us.
4.4 Visible Digital Seals and Document Analysis
The file you submit (image or PDF) is processed for the time of the request, then deleted. For the extraction of fields by optical character recognition, it is transmitted to our document analysis provider, established in the European Union. The raw extracted text is neither returned nor retained. We retain the result, the matching scores and the indicators intended for human review for ninety (90) days. No copy of the document is retained. These services may not be used to decide on the granting of credit, employment or housing.
4.5 Reading the Chip in Identity Documents
Reading is carried out from the mobile application, with your active participation. The chip access keys are processed in memory. The data groups read, including your portrait, and the security file are kept on our servers for no more than fifteen (15) minutes, for the time needed to authenticate them against the state certificate lists and, where applicable, to issue an attestation. We then retain the status of the verification alone, with no data from the identity document, for ninety (90) days. No data from the identity document is transmitted to a third party.
4.6 Biometric Verification and Liveness Detection
This service processes biometric data, a special category of personal data within the meaning of Article 9 of the GDPR. It is enabled only if our client has signed the corresponding addendum, carried out its impact assessment, obtained the required legal basis and put in place an alternative, non-biometric journey.
•The video and the images captured, the reference photograph and the analysis results are deleted twenty-four (24) hours after the verdict by default, and no later than ninety-six (96) hours.
•We keep no biometric template and build no reference database.
•The media are transmitted, with the session identifier alone and without any civil status data, to our European forensic analysis partner, which detects manipulations and synthetic media.
•The session report, without the media, is retained for ninety (90) days.
•The service is provided in preview, without certification, and does not replace a certified remote identification means. An unfavourable result cannot, on its own, lead to an automatic refusal.
4.7 Telecom Verification
We pass your number to our provider, established in the European Union, which queries the mobile network to prove that the device does control that number, or sends a code by short message. Depending on the service subscribed for, a match between the identity details declared and those of the holder of the line may be requested: we receive only the field-by-field result, never the operator's data in the clear. Verification identifiers are retained for ten (10) minutes, results for ninety (90) days with no identity data. A short message is routed by the operator serving your number, which may be established outside the European Union if your number is a foreign one.
4.8 Legal Entities and Ongoing Monitoring
These services rely on public registers: the national business register, civil and commercial announcements, the Sirene directory, the business directory. They process the data of company officers and, where applicable, of beneficial owners, as published by those registers. We are the controller for the copies we build from them. The life events of the companies monitored are retained for the duration of the monitoring and for ninety (90) days afterwards, or for five (5) years where our client configures this in respect of its due diligence obligations. This data is never used for marketing purposes.
4.9 Sanctions and Politically Exposed Persons Screening
This service is reserved for clients subject to anti-money laundering obligations or able to demonstrate a documented legitimate interest. It compares a subject's identity details against official sanctions lists and against a database of politically exposed persons that we build from official sources and for which we are the controller. The results, the alerts and the replayable log are retained for five (5) years from the end of the business relationship as declared. A match is a lead for our client to qualify, never a decision.
4.10 Identity Bridge for Artificial Intelligence Agents
Where a conversational agent requests a proof from your wallet, the verification follows the rules in section 4.1. The result may be cached for the period set by our client, not exceeding ninety (90) days, so that you are not asked for the same proof again. That cache is partitioned by organisation and by purpose, and is never shared between clients. You are informed that the party you are dealing with is an agent, and no decision producing legal effects is taken without human intervention.
4.11 Registration, Private Registries and Lists
These services process the professional data of the entities enrolled and of their representatives: identity, powers, declared uses. For a private registry, our client is the controller; for the lists that we maintain ourselves, we are. Published status lists contain no personal data.
4.12 Payments and Strong Authentication
Where the wallet serves as an instrument of strong authentication, the transaction data displayed before you approve it (amount, payee) is cryptographically bound to your signature. We retain no transaction content for our own account. The proofs are retained in our client's space, for the period our client sets and, failing that, for five (5) years, in respect of its regulatory obligations.
4.13 Dashboard, API and Software Development Kits
For our clients' authorised users we process: account identifiers, email address, passwordless access keys, roles, connection and action logs. The technical logs of API calls, which hold no identity data, are retained for twelve (12) months. We produce aggregated, non-identifying usage statistics.
4.14 Verifiables Docs
Verifiables Docs is a mobile verification application for an organisation's front-desk staff. It reads visible digital seals (2D-DOC), the QR code of the France Identité identity certificate, an attestation presented in proximity from an identity wallet, and the chip of a passport or identity card. The data read remains under the responsibility of the organisation or person using the application.
•Verifications take place in the device. The signature, the certification chain and the content are checked locally, against trust lists that we sign and that the application downloads. The code read and the attributes received from a wallet are not transmitted to us. Data read from a chip are transmitted only for the presence proof described below.
•Chip presence proof. When the application is attached to an organisation and has a connection, it asks our servers to verify that the chip was present at the time of the read, rather than copied beforehand. To do so, it transmits the document's security file, the identity data group (surname, given names, date of birth, sex, nationality, document number and expiry date) and the chip's public key, never the portrait. These data are kept for at most two (2) minutes, the time of the exchange with the chip; only the result is then kept, with a fingerprint of the identity data, for ten (10) minutes. We act on behalf of the organisation.
•The portrait received from a wallet or read from a chip is displayed for comparison with the person present, then erased when the result screen is closed. It is never stored.
•The history keeps in the device, for thirty (30) days, the result of each verification and the data read, except portraits. We have no access to it.
•When not linked to an organisation, the application sends us anonymous statistics about its verifications. For each one: the kind of reading, the result, the document type and its issuing country, the date and time, and the platform, version and language of the application. They contain neither the content of the document nor the identity of the person. No identifier of the device is included, and each event carries its own random identifier, so two events cannot be linked. We keep them for thirteen (13) months to measure how the application is used.
•The text of a 2D-DOC code the application could not verify is also sent to us when it is linked to no organisation, with the document type and the reading time, so that we can improve the reader. This text repeats the data written in the code, which may include a name, an address or an amount. The camera image stays on the device. We keep this text for twenty-four (24) hours, without IP address or device identifier, then it is deleted.
•The application also downloads the trust lists, its settings and its updates: our servers then receive the device's IP address and technical headers, kept in our logs (section 9).
•When linked to an organisation, the application sends it, through our servers, a report of each verification: document type, result, number of checks passed and failed, reason for failure, duration and timestamp, without the data of the document or of the person. The organisation is the controller of these reports, which we keep on its behalf for ninety (90) days. When the application verifies a code online for the organisation, or a PDF is imported, processing follows section 4.4.
•The camera, NFC and Bluetooth are used only during a reading started by the user.
5. Legal Bases
| Processing | Legal Basis |
|---|
| Verifications and issuances carried out for a client | Determined by that client: performance of the contract, legal due diligence obligation, or legitimate interest |
| Biometric processing | The condition under Article 9(2) of the GDPR chosen by the client, in principle explicit consent |
| Age verification | Legal obligation of the client, or legitimate interest in protecting minors |
| Sanctions and politically exposed persons screening | Legal obligation of the client, and public interest for our reference database |
| Verifiables Wallet | Performance of the terms of use you have accepted |
| Client accounts, billing, support | Performance of the contract |
| Platform security and logs | Legitimate interest, and legal obligation where applicable |
| Aggregated statistics | Legitimate interest in improving the service |
6. Security
Encryption in transit by TLS and at rest for databases, backups and stored objects. Signing keys generated and held in a key management service located in France, with no possibility of export. Passwordless authentication for the Dashboard, separate keys for each organisation for the API, partitioning of data by organisation applied to every request. Logging of administrative access, least privilege, review of authorisations. Separate environments, code review, automated tests, vulnerability management and a coordinated disclosure contact point at security@verifiables.com. The detail is set out in Annex B to our data processing agreement.
7. Recipients
•Our authorised personnel, within the limits of their duties and under an obligation of confidentiality.
•Our clients, as controllers, who access the results of their own operations.
•Our technical processors, by category: hosting and infrastructure (Scaleway, France), distribution of mobile application updates, document analysis by artificial intelligence, forensic analysis of media for biometrics, telecom verification. Each is bound by a contract compliant with Article 28 of the GDPR. The named list, with the country of processing and the transfer instrument of each one, is set out in Annex 4 to our terms of service: it is made available to our clients in their Dashboard and provided on request.
•The verifier you choose, during an attestation presentation: it receives only the attributes you disclose, on your initiative.
•The competent authorities, where the law so requires. We examine the lawfulness of each request, challenge it where there are reasonable grounds to do so and limit disclosure to the strict minimum.
We do not sell any data and we disclose none of it for advertising purposes.
8. Location and Transfers
The data we process is hosted in the European Union, in the Paris region of our hosting provider. Our processors process data in the European Union or in a country recognised as adequate by the European Commission. Any transfer to a third country is covered by an instrument under Chapter V of the GDPR, an adequacy decision or standard contractual clauses, and is flagged in the list referred to in section 7. Two situations lie outside our control: the use of our services from a third country, and the routing of a short message by the operator serving a foreign number.
9. Retention Periods
| Category | Default Period |
|---|
| Attributes presented during a verification | Window for retrieving the result, then erasure |
| Biometric artefacts | 24 hours, 96 hours at most |
| Data read from the chip in an identity document | 15 minutes |
| Chip data transmitted by Verifiables Docs for the presence proof | 2 minutes, then the result alone for 10 minutes |
| Verifiables Docs history | 30 days, in the device |
| Verifiables Docs anonymous statistics | 13 months |
| Text of unverified 2D-DOC codes sent by Verifiables Docs | 24 hours |
| Telecom verification identifiers | 10 minutes |
| Verification results and reports | 90 days |
| Technical logs | 12 months |
| Cases falling under our clients' due diligence obligations | 5 years |
| Proofs of issuance | Validity of the attestation, plus the statutory period |
| Accounts and contractual data | Duration of the contract, then the statutory limitation period |
10. Your Rights
You have the rights of access, rectification, erasure, restriction, portability and objection provided for by the GDPR.
•For a verification carried out by a company, address your request to that company, which is the controller. If you write to us, we forward it to that company without delay and assist it in responding.
•For the Verifiables Wallet, address your request directly to us. As your attestations are kept in your device, you delete them yourself from the application.
•For the account data of an authorised user, address your request directly to us.
We respond within one month, which may be extended by two months where the request is complex. You may lodge a complaint with the CNIL (the French data protection authority), www.cnil.fr.
11. Automated Decision-Making
Our verdicts, scores and signals are decision aids. We take no decision producing legal effects or significantly affecting you. Our clients undertake contractually to provide for human intervention before any final refusal, and for a means of redress. You have the right to obtain from the company concerned an explanation of a refusal and its review by a person.
12. Changes
This policy is revised at least once a year and on every significant change to our services. Material changes are notified to our clients by email and in the Dashboard. The version in force and its date appear at the head of this document; earlier versions are retained.
13. Contact
Data protection contact: dpo@verifiables.com
Renaissance SAS, 78 rue Notre-Dame de Nazareth, 75003 Paris, France
Security vulnerabilities and incidents: security@verifiables.com
