Privacy Policy: SAS SWEB

Last updated: September 9, 2026 Version: 3.3 Canonical URL: https://pro.sweb.so/en/policies/privacy

SAS SWEB, hereinafter referred to as "SWEB", is a simplified joint-stock company with share capital of EUR 1,000, whose registered office is located at 6 rue d'Armaillé, 75017 Paris, France, and which is registered with the Paris Trade and Companies Register under number 105 241 699. SWEB attaches particular importance to protecting its users' personal data.

This Privacy Policy explains how SWEB collects, processes and protects personal data relating to users of the SWEB Platform, in accordance with Regulation (EU) 2016/679 of April 27, 2016, hereinafter referred to as the "GDPR", and the amended French Data Protection Act No. 78-17 of January 6, 1978.

1. Data controller

• Company name: SAS SWEB
• Address: 6 rue d'Armaillé, 75017 Paris, France
• Trade register: Paris 105 241 699
• Email: hello@sweb.so
• Data protection contact: Mr Nathan RUTILY
• Contact: hello@sweb.so

SWEB is not legally required to appoint a Data Protection Officer under the criteria set out in Article 37 of the GDPR. Mr Nathan RUTILY acts as SWEB's data protection contact and not as a Data Protection Officer within the meaning of the GDPR. SWEB will formally appoint a Data Protection Officer if and when the conditions of Article 37 of the GDPR are met.

2. Data collected

2.1 Professionals, meaning subscribed customers

2.2 End Customers, meaning booking users

2.3 Potentially sensitive data

Professionals may enter information concerning End Customers' health when using the Service, including allergies, hair treatments and contraindications. This information is special category data within the meaning of Article 9 of the GDPR.

Its processing is based on the Data Subject's explicit consent under Article 9(2)(a) of the GDPR, which must be obtained by the Professional. The Professional is the Data Controller for this data and is responsible for obtaining the required consent.

2.4 Sources of End Customer data under Article 14 GDPR

End Customer data is collected:

• Directly from the End Customer when they create an account or make an online booking through the Platform;
• Indirectly when a Professional, meaning the studio, enters the data in their management area, for example when manually adding a customer to their customer records.

When data is collected indirectly, the Professional, acting as Data Controller, must inform their customers about the collection and processing of their data in accordance with Article 14 of the GDPR. SWEB then acts as a Data Processor on behalf of the Professional.

2.5 Professionals listed in the directory who are not SWEB customers

SWEB publishes a public directory of tattoo artists, accessible from sweb.so/tatoueur, which lists business listings for tattoo professionals operating in France, including those who are not, or not yet, SWEB customers.

This data comes exclusively from public sources, including Google Maps business listings, professional directories and public registers. SWEB never republishes third-party reviews, ratings or photographs. No residential address is ever published: professionals who work from home are excluded from this processing from the moment listings are compiled.

Legal basis and balancing of interests. This processing is based on SWEB's legitimate interest, Article 6(1)(f), in listing tattoo professionals in France, following the model of professional directories already common in this market. The purpose, sources and balancing test against the interests of the Data Subject are detailed on the dedicated page /tatoueur/a-propos-annuaire in French.

Information provided to Data Subjects, Article 14 GDPR. Each listing explicitly states that it was compiled from public sources and links to the dedicated page above. Proactive individual notice to each listed professional, for example by email, is not implemented: given the volume of professionals concerned and the strictly factual nature of the published data, such an approach would be disproportionate to the purpose pursued.

Right to object, Article 21 GDPR. Any listed professional may request removal of their listing at any time, with no justification required, using the dedicated link on each listing or by emailing hello@sweb.so. The request is handled within a maximum of 72 business hours. Removal is final: it is recorded in a dedicated register that prevents any future republication of the same listing, including after a source update.

Retention period. Listing data is kept for as long as the professional has neither joined SWEB, nor requested removal of their listing, nor ceased to meet the publication criteria. A removal request is kept indefinitely, solely to prevent any future republication.

2.6 Use of information received from Google Workspace APIs

The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail message data. When a Professional chooses to connect their Gmail inbox to SWEB, from Settings then Messaging, we access messages received and sent from that inbox, together with their attachments. This access serves a single purpose: displaying their customer conversations in their unified SWEB inbox, and letting them reply from SWEB, with the reply sent from their own address.

This access is strictly limited to that purpose. SWEB never deletes messages, never changes labels, never accesses drafts or Google account settings, and never discloses this data to any third party outside the Processors listed in Section 4. Only the inbox the Professional explicitly connects is concerned.

The connection can be revoked at any time, from the Google account settings or from the SWEB workspace. Revocation immediately stops any further synchronisation.

Artificial intelligence. SWEB uses an artificial intelligence service for its online help assistant. Questions submitted to this assistant are sent to Mistral AI, a company established in France, and answers rely on public help articles.

Data from connected mailboxes, including Gmail, as well as time slots from connected calendars, are never sent to an artificial intelligence model. It is never used to develop, improve or train any model, whether internal or provided by a third party. It is likewise never used for advertising purposes, and never disclosed or sold.

2.7 External calendar synchronisation with Google Calendar

A Professional may connect their personal Google Calendar to the Platform from the Connections screen. The feature is optional and disabled by default. It relies on their explicit consent under Article 6(1)(a) GDPR, collected through a dedicated checkbox that is separate from acceptance of the Terms of Use and unticked by default. Connection is not possible until that box is ticked.

Once the Professional grants authorisation on the consent screen displayed by Google, SWEB accesses the following data, and nothing else:

What SWEB never reads. Synchronisation reads busy times only. The title, description, location and attendees of events in the Professional's calendar are never requested, never received and never stored. Those fields are explicitly excluded from the request sent to the Google API.

What SWEB never writes. Events created in the Professional's calendar carry the label "Occupé", meaning busy, together with a link to the appointment record, which can only be opened after authentication. They contain neither the customer's full name nor any amount.

Withdrawing authorisation. The Professional may withdraw authorisation at any time from the Connections screen, or from the security settings of their Google account. Withdrawal stops synchronisation immediately and deletes, within SWEB's systems, the tokens and the imported busy slots.

What SWEB removes from the Professional's calendar. On withdrawal, SWEB deletes from the Professional's calendar the events it had created there for their upcoming appointments. This deletion is made on a best-effort basis: if the provider refuses it, or if the calendar concerned is no longer reachable, the number of remaining events is shown to the Professional at the time of withdrawal, for them to delete. Events belonging to appointments that have already taken place are not removed: they block no availability, and the Professional alone controls the contents of their own Google Calendar.

What SWEB keeps in order to account for it. Where an event could not be removed, SWEB keeps its identifier at the provider, without any appointment or customer data. This is kept solely to answer a Professional who notices remaining events and to evidence the attempt. It does not rest on consent, which has just been withdrawn, but on SWEB's legitimate interest in documenting how the request was carried out, and it is limited to 90 days.

3. Purposes of processing

4. Data recipients

Personal data may be disclosed to the following recipients:

4.1 Authorised SWEB personnel, including the technical team, customer support and management, strictly within the scope of their duties.

4.2 Processors, meaning the technical providers listed in the List of Subprocessors in French, which is appended to the DPA in French. The current list is as follows:

Each Processor acts on documented instructions from SWEB under a contract that complies with Article 28 of the GDPR.

4.3 Professionals. End Customer data is accessible to the Professional with whom an appointment was booked, to the extent necessary to provide the service.

4.4 Authorities. Data may be disclosed to competent authorities, including the CNIL, tax authorities and judicial authorities, where required by law.

4.5 External calendar providers. Where a Professional enables the synchronisation described in section 2.7, data is exchanged with Google LLC. Google does not act here as a processor on SWEB's behalf but as an independent controller: the calendar data belongs to the Professional's Google account and Google processes it under its own privacy policy, over which SWEB has no control. The only data SWEB transmits to Google is the start and end times of the Professional's appointments, the label "Occupé", meaning busy, and an authenticated link to the appointment record.

SWEB does not sell, rent or disclose personal data to third parties for commercial or advertising purposes.

5. International transfers

Some of SWEB's Processors are located outside the European Union, particularly in the United States. These transfers are governed by:

• The EU-US Data Privacy Framework, based on the European Commission adequacy decision of July 10, 2023, where the Processor is certified;
• The Standard Contractual Clauses adopted by the European Commission under Decision 2021/914;
• Additional technical safeguards, including TLS 1.3 encryption in transit and encryption at rest.

The transfer mechanism applicable to each Processor is as follows:

Further details about the transfer mechanism for each Processor are available in the DPA in French and the List of Subprocessors in French. Any Data Subject may request a copy of the safeguards implemented by contacting SWEB.

6. Data security

SWEB implements the following technical and organisational measures:

• Encryption of data in transit using TLS 1.3 and encryption at rest;
• Secure authentication using hashed passwords;
• Regular automated backups;
• Logging of access and critical actions;
• Regular security testing;
• Strict access control based on the principle of least privilege;
• Cyber insurance and professional liability insurance arranged through Assurup.

7. Data Subject rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

To exercise your rights:

• Email: hello@sweb.so
• Postal address: SAS SWEB, 6 rue d'Armaillé, 75017 Paris, France

SWEB will respond within thirty days of receiving the request together with proof of identity.

If you are not satisfied with the response, you may lodge a complaint with the French Data Protection Authority, the CNIL:

• Website: www.cnil.fr
• Address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

8. Cookies and tracking technologies

The Platform uses cookies and tracking technologies. To learn which cookies are used, understand their purposes and manage your consent, please refer to SWEB's Cookie Policy in French.

9. Protection of children's data

The Platform is not intended for people under the age of sixteen. SWEB does not knowingly collect data relating to children under 16.

Under Article 8 of the GDPR and Article 45 of the French Data Protection Act, where processing is based on consent, the consent of a child under the age of 15 must be given or authorised by the holder or holders of parental responsibility.

If SWEB becomes aware that it has collected data relating to a child without the required parental consent, it will delete the data as soon as reasonably possible.

10. Profiling and automated decision-making

SWEB does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect Data Subjects within the meaning of Article 22 of the GDPR.

SWEB may use automated processing for recommendations, such as suggesting appointment slots or services based on booking history, and for aggregated analytics, such as anonymised business activity statistics. This processing does not result in automated decisions that produce legal effects concerning Data Subjects.

If SWEB were to carry out profiling within the meaning of the GDPR, Data Subjects would be informed in advance and would have the right to object under Article 21 of the GDPR.

11. Changes to this Policy

SWEB may amend this Privacy Policy at any time. Users will be notified of any material change by email or through an in-Service notification at least thirty days before it takes effect.

The version available on the Platform at any given time is the version then in force.

12. Data protection remedies

If you experience any difficulty concerning the processing of your personal data, please contact SWEB first using the details in Section 7 so that an amicable solution can be sought.

Under Article 77 of the GDPR, if you believe that the processing of your data infringes applicable law, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés, or CNIL, the competent French supervisory authority:

• Website: www.cnil.fr
• Address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Consumer mediation under Articles L. 611-1 et seq. of the French Consumer Code is governed by the Terms of Sale and Terms of Service and not by this Privacy Policy.

SAS SWEB
6 rue d'Armaillé, 75017 Paris, France
Paris Trade and Companies Register 105 241 699

This Privacy Policy is permanently available at https://pro.sweb.so/en/policies/privacy.