1. Who is responsible for your data
Berenger.dev SRL, Rue Sainte Anne, Termes 8, 6813 Chiny, Belgium, enterprise number 0787.693.448, which publishes Swimlane (“we”), is the controller of the data described in this policy.
For any question or request about your data: hello@getswimlane.com. We have not appointed a data protection officer; this address is read by the person who holds that responsibility.
This policy concerns visitors to getswimlane.com, users of the Swimlane application and people who write to us. If you are a person whose data has been imported into Swimlane by one of our customers, go directly to section 9 below.
2. What we process, why and for how long
2.1 Your account
- Data: first name, last name, email address, password (stored in hashed form), language, profile photo, Organization and role, invitations sent and received; when you log in and when the account is created, IP address, browser and approximate location inferred from the IP address; verification codes sent by email; date and version of the General Terms and Conditions accepted.
- Why: to create your account, authenticate you and manage your Organization.
- Legal basis: the performance of the contract.
- Duration: as long as your account exists; 24 hours for verification codes.
2.2 Your LinkedIn account and the operation of the Service
- Connection data: the email address of your LinkedIn account and the LinkedIn session (cookies), stored in encrypted form; your LinkedIn member identifier; the technical characteristics of the browser used for the session; the country and region you specify. Your LinkedIn password passes through our servers for the time it takes to open the session, but is not stored.
- Data from your LinkedIn account: your profile, your connections, your conversations and messages, your invitations, the visitors to your profile and the interactions with the posts you choose to analyze.
- Data you create: notes, tags, lists, pipelines, reminders, campaigns, message templates, the description of your ideal customer profile, answers to questions about your business and your context, and a tone profile inferred from the messages you have sent.
- Activity log: the actions performed by the Service for you (imports, invitations, messages), in order to apply the daily limits and prepare the team recap.
- Why: to provide the Service (synchronization, CRM, automations).
- Legal basis: the performance of the contract.
- Duration: the LinkedIn session until you disconnect your LinkedIn account; the rest as long as your account exists. Technical logs of calls made to LinkedIn are kept for 7 days.
The data of the people you prospect is processed on your behalf: see section 9 and the Data Processing Agreement.
2.3 Artificial intelligence features
- Data: the information needed for the requested task, for example a contact’s profile, conversation excerpts, your notes and the context of your business.
- Why: to analyze your contacts, suggest replies and messages, generate the messages of the campaigns you configure, and read what the replies you receive mean (interested, contact later, question, not interested) so as to sort your inbox and adapt what a campaign does next — for instance stopping a sequence when the person declines.
- Legal basis: the performance of the contract.
- Duration: results are kept in your account for as long as it exists. Our artificial intelligence providers retain requests only for the period indicated on the Sub-processors page and do not use them to train their models.
2.4 Service emails
- Data: email address, first name, language, content of the message.
- Why: to send you the emails needed for the Service: verification codes, password resets, invitations, daily or weekly team activity recaps when your Organization enables them, a warning before a deactivated Organization is deleted, and an acknowledgment of receipt of a withdrawal.
- Legal basis: the performance of the contract. We do not send newsletters or advertising emails.
- Duration: sending logs are kept by our email provider for the period indicated on the Sub-processors page.
2.5 Invoicing
- Data: name, email address, billing address, VAT number, subscription and payment history, invoices, number of Members billed; where applicable, the organization that referred Swimlane to you and the related commissions. Card data is processed exclusively by Stripe.
- Why: to collect payments, issue invoices and comply with our accounting and tax obligations.
- Legal basis: the performance of the contract and our legal obligations.
- Duration: 10 years for invoices and accounting records, as required by Belgian law; the rest as long as your account exists.
2.6 Consumer withdrawals
- Data: name, email address, contract concerned, date and time of the withdrawal.
- Why: to process your withdrawal, refund you and be able to provide evidence of it.
- Legal basis: our legal obligations.
- Duration: until the applicable limitation periods expire, at most 10 years.
2.7 Security and abuse prevention
- Data: IP address, browser, API call logs, rate-limiting counters, technical error reports.
- Why: to protect the Service, our customers and our users against fraud, abuse and attacks, and to fix errors.
- Legal basis: our legitimate interest in securing the Service.
- Duration: 12 months at most; one hour for rate-limiting counters.
2.8 Usage statistics
- Without cookies or trackers: our servers record a few key events linked to your account (account creation, LinkedIn connection, contact creation, message sending, automation execution, subscription changes) in order to understand how the Service is used and to improve it. Legal basis: our legitimate interest. You can object by writing to us.
- With your consent: audience measurement for the website and the application, heatmaps and masked session recordings, detailed in the Cookie Policy. You can withdraw your consent at any time.
- Duration: the period indicated for our statistics tool on the Sub-processors page.
We also use aggregated statistics, which do not allow anyone to be identified, to run our business.
2.9 Support
- Data: name, email address, photo, Organization, subscription, language, LinkedIn identifier, content of your exchanges with us.
- Why: to answer your questions and solve your problems.
- Legal basis: the performance of the contract for our customers, and our legitimate interest in replying to visitors.
- Duration: 3 years after the last exchange.
2.10 The contact form and the emails you send us
- Data: name, email address, subject, message, language; your IP address, used solely to limit the number of submissions.
- Why: to reply to you.
- Legal basis: our legitimate interest in replying to requests, or the pre-contractual steps you request.
- Duration: 3 years after the last exchange; one hour for the submission limit. Messages sent through the form reach us by email and are not recorded in our database.
3. Who receives your data
- Our team, to the extent it needs to.
- The Members of your Organization, who share the workspace’s data.
- Our processors (hosting, storage, email, artificial intelligence, statistics, support, payment), bound by contract and listed on the Sub-processors page.
- Stripe, which also acts as controller for its own obligations (fraud prevention, legal obligations).
- LinkedIn, when the Service performs on your LinkedIn account the actions you trigger.
- The tools you connect (webhooks, public API, integrations), which receive the data you choose to send them.
- Authorities, only when the law requires us to do so.
- An acquirer, if Swimlane is transferred; the acquirer is then bound by this policy.
We do not sell your data and do not share it for advertising purposes.
4. Transfers outside the European Economic Area
Our servers and our database are located in France, and our files in the Netherlands. Some processors are established outside the European Economic Area, in particular in the United States. These transfers are governed by an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for certified companies, or by the Commission’s standard contractual clauses. The Sub-processors page states the mechanism applicable to each of them. You can ask us for a copy of the safeguards.
5. Security
Encrypted connections, LinkedIn session and email address encrypted at rest, hashed passwords, restricted access to production, segregation of data by Organization, backups kept for 14 days: the measures are detailed in the annex to the Data Processing Agreement. If a data breach presents a high risk to your rights, we inform you without undue delay.
6. Deletion of your account and deactivation
- Deletion by you. The owner of an Organization can delete the account and all its data from the Organization’s settings; a Member can delete their own profile. Deletion from our database is immediate and ends billing; backup copies disappear no later than 14 days afterwards. The LinkedIn session and the associated connection data are deleted from our servers.
- Deactivation. An Organization without an active subscription (non-payment, termination, trial not converted) is deactivated: its data is retained so that it can come back. After 12 months of deactivation, it is deleted automatically, after a warning sent at least 30 days in advance.
- What remains after deletion: invoices and accounting records for the legally required period, the record of any withdrawal, our support and email exchanges for the period indicated in section 2, aggregated statistics that do not allow anyone to be identified, and data already sent to our processors until the end of their own retention period.
7. Your rights
At any time, you can:
- access your data and obtain a copy of it;
- have it rectified or erased;
- request the restriction of its processing;
- object to processing based on our legitimate interest;
- obtain its portability in a structured format;
- withdraw your consent to cookies, without affecting what was done before.
Write to hello@getswimlane.com. We reply within one month, which may be extended by two months for a complex request, and may ask you to confirm your identity if we have reasonable doubts.
You can also lodge a complaint with the Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be), or with the supervisory authority of your country of residence.
8. Automated decisions
We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The scores and analyses calculated in the Service help our customers organize their prospecting; they do not decide anything in their place.
9. If your data is in a customer’s Swimlane
Our customers use Swimlane to manage their prospecting on LinkedIn. When a customer imports your profile, exchanges messages with you or sends you automated messages, that customer is the controller of your data: they decide to contact you and must inform you, in particular of the source of your data. We act as their processor and process your data only for them.
- Exercising your rights: first contact the customer who contacted you. If you write to us at hello@getswimlane.com, we forward your request to the customers concerned where we can identify them.
- Tracked links: if you click on a link contained in a message sent with Swimlane, we record, for the customer, the link concerned and the date and time of the click, without storing your IP address. Your browser is examined at the time of the click, without being recorded, solely to distinguish a person from a preview bot.
- Data processed and retention periods: described in the Data Processing Agreement. We do not reuse your data from one customer to another, do not sell it and do not use it to train artificial intelligence models.
10. Minimum age
Swimlane is reserved for people aged 18 or over.
11. Changes
We may amend this policy. The date of the last update appears at the top of the page; if a change affects you significantly, we will notify you by email before it takes effect.