RGPD et traitement des données

Dernière mise à jour 16 October 2026

La politique de confidentialité couvre ce site web. Cette page couvre ce que votre service juridique doit réellement évaluer : ce qu’il advient des données personnelles au sein d’une mission, quand nos équipes travaillent dans vos systèmes.

This page describes our intended approach, not a finished legal document, and has not yet been reviewed by counsel. It is not legal advice and is not a binding representation. Specific terms, the DPA itself, the breach-notification window, the sub-processor list as it stands at signature, are set by the signed agreement, not by this page — raise them on the first call rather than relying on what is written here.

Qui est responsable de traitement et qui est sous-traitant

Dans une mission type, vous êtes le responsable du traitement des données personnelles présentes dans vos systèmes, et LebSource agit comme sous-traitant, sur vos instructions documentées. Lorsque nous déterminons nous-mêmes les finalités, notre propre recrutement, notre propre correspondance client, nous sommes responsable du traitement et la politique de confidentialité s’applique.

L’accord de traitement des données

We intend to sign a DPA before any engagement that involves personal data, covering the subject matter and duration, the nature and purpose of processing, the categories of data subject and personal data, and the obligations on both sides, as Article 28 requires.

A LebSource standard DPA is in preparation with counsel and is not yet finalised. Until it is, we work from the client's own DPA, which in practice is the more common path this early in an engagement in any case. Ask us at contact@lebsource.com for where that stands, and raise it on the first call rather than assuming the terms from this page.

Transferts internationaux

Data is hosted and stored in European regions rather than exported to Lebanon. Our team works from Lebanon, outside the EEA and without a current adequacy decision, so their access to it is a transfer in its own right. Our intended mechanism for that is the European Commission's Standard Contractual Clauses, together with a transfer impact assessment and the supplementary measures it identifies, finalised as part of the signed agreement rather than in place in advance of one. We would rather raise this early in a procurement conversation than have it surface late.

Comment nous limitons l’exposition en pratique

• Les accès sont limités à ce que la mission exige réellement, et retirés à la clôture
• Les personnes travaillent dans vos systèmes sous vos contrôles d’accès plutôt que de recopier des données chez nous
• Les données personnelles de production ne servent pas aux tests quand un jeu synthétique ou masqué suffit
• Les changements d’accès sont documentés pour que vous puissiez en apporter la preuve lors d’un audit

Sous-traitants ultérieurs

Our current sub-processors are Vercel, which hosts and serves this website from European regions; Supabase, which stores applications submitted to our hiring portal; Resend, which delivers transactional email; and Google, which runs the calendar behind the booking page. We intend to notify you before any addition or replacement, with the opportunity to object, once that commitment is captured in a signed DPA. This list is the same one named in our privacy policy, so the two cannot drift apart.

Notification de violation de données

If we become aware of a personal data breach affecting your data, our intention is to notify you within 48 hours so you can meet your own obligations, and to support your assessment and any notification you have to make. That window is deliberately shorter than the 72 hours the GDPR gives you to notify a supervisory authority, so the clock we start still leaves you time to act, but it becomes a contractual commitment only once it is written into the signed agreement, not from its appearing here.

Posez-nous les questions gênantes tôt

Si votre fonction conformité a une exigence stricte que nous ne pouvons pas satisfaire, par exemple une localisation des données dans l’UE, le bon moment pour le découvrir est le premier appel. Nous vous le dirons, et si la conclusion est qu’un partenaire basé dans l’UE vous convient mieux, nous le dirons aussi.