BPS - Biodiversity Performance Score
FR EN

Privacy Policy

Data Controller

The data controller for data collected through the biodiversity-performance.com platform is:

IRICE - Simplified Joint Stock Company (SAS), share capital of 20,000 euros
Aix-en-Provence trade register 835 324 112
Registered office: Espace Wagner Building A2, 10 rue du Lieutenant Parayre, 13290 Aix-en-Provence, France
DPO contact: dpo@irice.fr

IRICE operates the BPS tool and is, as such, the sole data controller for all processing described below: user accounts, evaluations, score attestations and contact forms. NORMATYS, which owns the BPS framework, does not act as a data controller on this platform. NORMATYS and IRICE belong to two separate legal entities within the NORMAXIS group.

Data Collected

When using the BPS platform, IRICE collects the following categories of data:

  • Identification data: surname, first name, email address, phone number, position, company.
  • Project data: project name, site address, area, ecological data entered as part of BPS assessments.
  • Connection data: IP address, access timestamps, browser used (security logs).

Processing Purposes

Data is processed for the following purposes:

  • Creation and management of user accounts.
  • Entry, calculation and reporting of BPS scores.
  • Generation of score attestations and reports within IRICE evaluation processes.
  • Management of Biodiversity Partner qualifications.
  • Service-related communications (notifications, updates).
  • Platform security and fraud detection.

Legal Basis

Processing relies on the performance of the service contract (Article 6.1.b of the GDPR) for account management and assessments, and on IRICE legitimate interest (Article 6.1.f) for platform security and service improvement.

Data Retention

Personal data is retained for the duration of the contractual relationship, then archived in accordance with applicable legal obligations (5 years for billing data, 1 year for connection logs). Project data is retained for the validity period of the associated score attestation, where applicable.

Recipients

Data is accessible to authorised IRICE staff, strictly within the scope of their duties. It is not shared with third parties for commercial purposes. It may be disclosed to accreditation or supervisory bodies during audits, where legally required.

Processors

IRICE uses the following processors, each bound by a contract compliant with Article 28 GDPR:

  • Infomaniak Network SA (Switzerland) - platform hosting and email.
  • Matomo Analytics, self-hosted on NORMAXIS group infrastructure (matomo.normaxis.group) - audience measurement. Traffic data never leaves the group's infrastructure and is not passed to any advertising network.
  • Mosparo, self-hosted on NORMAXIS group infrastructure (spam.normaxis.group) - anti-spam protection of the contact form.

Data Hosting and Transfers

The BPS platform data is hosted by Infomaniak Network SA in Switzerland, a country recognised by the European Commission as ensuring an adequate level of personal data protection (adequacy decision). IRICE does not transfer personal data to third countries that do not ensure an adequate level of protection. Should a processor located outside the European Economic Area and outside an adequate country be engaged, appropriate safeguards (EU Commission standard contractual clauses) are implemented.

Cookies and audience measurement

The platform uses cookies strictly necessary for service operation (session, authentication, CSRF protection). No advertising cookie and no third-party commercial tracker is placed.

Audience measurement is provided by Matomo, self-hosted on NORMAXIS group infrastructure. The resulting statistics are used solely to improve the service (legitimate interest, Article 6.1.f GDPR); they are neither resold, nor combined with advertising data, nor shared outside the group. This self-hosted configuration falls within the consent exemption set out in the CNIL guidelines for audience-measurement trackers.

Your Rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

  • Right to access your personal data.
  • Right to rectification of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"), subject to legal obligations.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.

To exercise these rights, contact us at dpo@irice.fr. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

Updates

This privacy policy may be updated at any time. The applicable version is the one accessible on the website at the time of consultation.

Last updated: April 2026.