Privacy Policy

1. Who is responsible for your data?

D&M GROUP, the company operating Verra and verra.work, is the controller for the processing described here. We are a French SAS registered with RCS Paris under number 921 325 536, at 3 rue du Colonel Moll, 75017 Paris, France. Contact privacy@descartesmauss.ai for privacy questions.

This policy covers website visitors, contact and demo requests, business contacts, applicants and suppliers. It does not replace contractual privacy information for the Verra product or employee notices.

2. Website visits and cookies

Delivering and securing the website involves processing technical information, such as IP address, requested pages, browser details and request times, through our hosting infrastructure. Our legal basis is our legitimate interest in operating and protecting the website (GDPR Article 6(1)(f)). Technical records are retained only as needed for delivery, security and investigating incidents, subject to applicable legal requirements.

Our necessary cookie remembers acknowledgement of the cookie notice for 180 days. Google Forms loads when you visit a contact or demo page, independently of that notice. We do not run website analytics or advertising tracking scripts. Our homepage video is served directly by this website, without a third-party video player. See our Cookie Policy to manage your choices.

3. Contact and demo requests

We use Google Forms for our contact and demo forms. The forms collect first name, last name, email address, company name and job title, and the contact form also offers a message field. Required fields are marked in the form; job title is optional and company name is optional on the contact form. Please avoid submitting sensitive personal data or confidential information about others.

We use your answers to respond to your enquiry, arrange a demo and follow up on that request. The forms ask for your consent to this processing (GDPR Article 6(1)(a)). You can withdraw it at any time by emailing privacy@descartesmauss.ai; withdrawal does not affect processing already lawfully carried out. Without the required details or if you withdraw before we respond, we may be unable to handle the request.

We keep enquiry records for up to two years after your contact, unless a resulting business relationship or a legal obligation justifies further retention as described below. You can also email communications@descartesmauss.ai without using Google Forms. We handle direct email enquiries on the basis of our legitimate interest in responding to you.

4. Google Forms and email updates

The embedded forms load automatically. Your browser connects to Google even if you have not dismissed the cookie notice or submitted a response. Consent to process your request is collected separately within the form. Google receives technical data and may use cookies or account information under its Privacy Policy. Answers you submit are stored through Google Forms and made available to our authorised team.

Each form offers a separate, optional choice to receive Verra news, insights and updates by email. We use that choice as consent for those emails (GDPR Article 6(1)(a)). Declining it does not prevent a contact request or demo. You can unsubscribe at any time through an unsubscribe link or by contacting us. Marketing contact details are retained until withdrawal or for up to three years after your last active contact, whichever comes first. We may keep a limited suppression record for at least three years to respect your refusal.

The cookie notice does not control Google Forms, withdraw consent attached to an existing response or unsubscribe you from emails. Contact us separately for those requests.

5. Other professional relationships

• Clients, prospects and suppliers: we process professional contact details, correspondence, contract information and, where relevant, billing details to manage relationships. The legal basis is our legitimate interest in professional relationship management, performance of a contract where you are a party, or a legal obligation for required records (GDPR Articles 6(1)(f), (b) and (c)). Records are kept for the relationship and then only for applicable statutory retention or limitation periods.
• Applicants: we process CVs, cover letters, interview information and relevant details supplied through recruitment services to assess applications and communicate with candidates, based on our legitimate interest in recruitment. Successful applications become part of the personnel file. Unsuccessful applications may be retained for up to two years after recruitment ends for future opportunities, subject to your rights.

If you share someone else’s personal data with us, ensure that you are entitled to do so and direct them to this policy. Restricted records may be retained longer where necessary to comply with law or establish, exercise or defend legal claims.

6. Who receives data?

Access is limited to authorised staff and service providers who need the information for the relevant purpose. Our website uses Amazon Web Services (AWS Amplify Hosting); Google provides the embedded forms and response storage. We also use providers for business email, recruitment and administration as required by the relationship.

HubSpot forms and YouTube embeds are no longer used on this website. Removing an integration does not itself erase records previously submitted; contact us about access or erasure of earlier records.

We may disclose information to authorities where legally required, to advisers to protect our rights, or to a successor and its advisers in a business transfer, subject to applicable data protection requirements.

7. International processing

Providers such as Google and AWS operate internationally, so personal data may be processed outside the European Economic Area, including in the United States. Where we transfer personal data, applicable safeguards must cover the transfer, such as an adequacy decision or the European Commission’s standard contractual clauses and additional measures where needed. Contact privacy@descartesmauss.ai for information about safeguards applicable to your data or a copy where available.

8. Your rights and how to contact us

Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent at any time without affecting the lawfulness of earlier processing. French law also allows you to give instructions about your data after your death.

Write to privacy@descartesmauss.ai or our registered office. We normally respond within one month. If a lawful extension is needed, we will explain why within that period. We may request information necessary to confirm your identity.

You can complain to your local supervisory authority or the French CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

9. Updates

We publish changes on this page and update the date above. Where a change requires a new consent choice, we will ask for it before enabling the relevant optional service.