Personal data protection policy of the while service
Version of November 1, 2026, effective as of that date.
This English version is a translation provided for information only. In the event of any discrepancy, the French version, published at https://while.sh/fr/confidentialite/2026-11-01/, prevails.
Article 1 – Controller
The processing described in this policy is carried out by NXT Initiative, a French simplified joint-stock company (société par actions simplifiée) with a share capital of €2,000, registered with the Paris Trade and Companies Register under number 818 451 114, whose registered office is at 106 rue de Patay, 75013 Paris, France, trading under the name “Nextmap” (hereinafter “Nextmap”), as controller.
Any question or request regarding this policy may be sent to hello@while.sh.
Article 2 – Scope
2.1. This policy applies to the personal data of persons who visit the while.sh website, have an account on the while service (hereinafter the “Service”), use the Service without an account on a trial basis, join the waiting list, communicate with Nextmap’s team or are contacted by it.
2.2. It does not apply to the personal data that Nextmap’s customers process by means of the Service. For such data, each customer acts as controller, and Nextmap as processor, under the conditions of the data processing agreement annexed to the general terms of the Service.
Article 3 – Data processed, purposes, legal bases and retention periods
| Situation | Data | Purposes | Legal basis | Retention period |
|---|---|---|---|---|
| Visit to the while.sh website | IP address, pages viewed, in the technical logs of the website | operation and security of the website | legitimate interest | period necessary for the security of the website |
| Account | name, email address, login identity, organization, role | provision of the Service | performance of the contract | term of the account; then, with restricted access, one (1) year for account data and five (5) years for identity data, under the legal retention obligation of hosting providers |
| Login and security | IP addresses, login logs, actions performed in the Service | security of the Service, evidence, responses to requests from authorities | legal obligation and legitimate interest | one (1) year from each creation, modification or deletion of content, under the legal retention obligation of hosting providers; for other data, period necessary for the security of the Service |
| Invoicing and payment | billing identity, SIREN number or VAT identification number, invoices, payment transactions | invoicing, collection, bookkeeping | performance of the contract and legal obligation | ten (10) years for accounting records; one (1) year after the end of the contract for payment transactions |
| Trial without an account | IP address and the country derived from it, abuse prevention data, trial usage measurements | provision of the trial, abuse prevention, improvement of the Service | performance of the contract (conditions of the trial); legal obligation; legitimate interest (abuse prevention, measurement of the trial) | trial content: twenty-four (24) hours after its end; trial measurements: ninety (90) days, then anonymization; full IP address of each deployment: one (1) year, under the legal retention obligation of hosting providers |
| Waiting list | email address, date of consent | informing the person when a spot becomes available | consent | six (6) months, or until consent is withdrawn |
| Communications with the team | messages, contact details | responding to requests, support | legitimate interest | three (3) years from the last communication |
| Prospecting | name, position, company, business contact details | presenting the Service to professionals | legitimate interest | three (3) years from the last contact, unless the person objects |
The legitimate interests pursued are the security of the Service and the prevention of abuse, evidence of transactions, the presentation of the Service to professionals and the improvement of the trial. Data marked as mandatory is necessary for the conclusion of the contract; without it, the account cannot be created.
Article 4 – Recipients
4.1. Personal data is intended for the members of Nextmap’s team, to the extent required by their duties.
4.2. It may be disclosed to Nextmap’s providers in charge of its infrastructure, payment, accounting and invoicing, as well as to the providers of the team’s work tools. These providers are established in the European Union, except in the cases provided for in Article 5.
4.3. It may be disclosed to administrative or judicial authorities, where required by law.
4.4. Nextmap does not sell personal data and does not use it to train an artificial intelligence model.
Article 5 – Transfers outside the European Union
Personal data is processed within the European Union, with the exception of the data processed by certain work tools of the team. These transfers are governed by an adequacy decision of the European Commission, in particular the decision of July 10, 2023 on the EU-U.S. Data Privacy Framework, or by the standard contractual clauses adopted by the Commission. A copy of these safeguards is provided upon request sent to hello@while.sh.
Article 6 – Cookies and trackers
The while.sh website does not set any cookies and does not measure its audience. The Service sets only cookies necessary for its operation, which are not subject to consent: those of the login session and of the ongoing trial, and those that remember display choices, such as the last organization and the last app opened, kept for thirteen (13) months at most.
Article 7 – Rights of data subjects
7.1. Every data subject has the right of access, rectification, erasure and restriction of processing of their data, as well as the right to data portability. They may object to any processing based on legitimate interest, in particular to prospecting, and withdraw their consent at any time. They may also set instructions regarding what happens to their data after their death.
7.2. These rights are exercised by email to hello@while.sh. Nextmap responds within one (1) month, which may be extended under the conditions provided for by Regulation (EU) 2016/679. Data whose retention is required by law cannot be erased before the end of the legal period.
7.3. Every data subject may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
Article 8 – Changes
Nextmap may change this policy. The version in force and its date are published on the while.sh website.