TOROW protects the personal data of its clients, candidates, partners and website visitors. This policy explains what data we process, why, for how long, and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Last updated: 28 September 2026
This English version is provided for convenience. This policy is governed by French law, in particular the GDPR and the French Data Protection Act (Loi Informatique et Libertés of 6 January 1978). In the event of any discrepancy, the French version prevails.
The data controller is TOROW SAS, a French simplified joint-stock company (SAS) with share capital of €100,000, registered with the Paris Trade and Companies Register under number 904 893 054, with its registered office at 14 avenue de l'Opéra, 75001 Paris, France.
For any question about your data: rgpd@torow.eu, or by post to our registered office.
We only collect the data needed for each purpose:
We do not collect any special category data within the meaning of Article 9 GDPR (health, opinions, origin, etc.), unless required by law.
| Purpose | Legal basis |
|---|---|
| Responding to your enquiries | Legitimate interest or pre-contractual measures |
| Sending the newsletter | Consent |
| Reviewing submitted pro bono projects | Legitimate interest |
| Managing recruitment | Pre-contractual measures and legitimate interest |
| Managing client relationships and project delivery | Performance of a contract |
| B2B marketing | Legitimate interest |
| Invoicing and accounting | Legal obligation |
| Website analytics | Consent |
| Website security and abuse prevention | Legitimate interest |
Data processed. Identity and contact details, CV, cover letter, qualifications, experience, skills, salary expectations, availability, interview notes and, with your consent, feedback from your referees.
Source of data. Direct applications, referrals, job boards, professional networks such as LinkedIn, schools or recruitment agencies. When your data does not come from you, we inform you no later than one month after collecting it, or at first contact.
Purposes. Assessing your application for a position or project, organising interviews and, unless you have objected, offering you other opportunities matching your profile later on, from our candidate database.
Access. Only the people in charge of recruitment (HR team and relevant managers) can access your file. It is never transferred or sold.
Retention. If your application is not successful, your data is kept for two years from the last contact, then deleted or anonymised. You can request its deletion at any time. If you are hired, it becomes part of your personnel file.
Data processed. Name, job title, company, business contact details, history of exchanges and meetings, commercial proposals, contracts, completed projects and billing data.
Source of data. Your exchanges with our teams, signed contracts, trade shows and events, referrals and public professional sources.
Purposes. Managing the business relationship, preparing and monitoring projects, invoicing, measuring satisfaction and informing you of offers that may be relevant to your business.
Marketing. Our marketing messages are aimed at professionals and relate to offers linked to their role. Every message includes a simple way to opt out, and you can write to us at any time to stop receiving them.
Retention. Client data is kept for the duration of the business relationship, then for three years for marketing purposes. Prospect data is kept for three years from the last contact. Accounting records and contracts are archived for ten years, in accordance with the French Commercial Code.
| Data | Period |
|---|---|
| Enquiries and pro bono projects | 3 years from the last exchange |
| Newsletter subscribers | Until unsubscription |
| Unsuccessful candidates | 2 years from the last contact |
| Clients | Duration of the relationship, then 3 years |
| Prospects | 3 years from the last contact |
| Contracts, invoices, accounting records | 10 years |
| Analytics cookies | 13 months maximum |
Your data is intended only for the TOROW teams who need it. It may be shared with our technical providers (hosting, CRM tool, recruitment software, email, newsletter delivery), who act on our instructions and are bound by a contract compliant with Article 28 GDPR. It may also be disclosed to the authorities where required by law.
TOROW never sells or rents any personal data.
We favour providers that host data within the European Union. If a transfer outside the EU is necessary, it is covered by a European Commission adequacy decision or by the standard contractual clauses it has adopted.
TOROW applies an Information Systems Security Policy: need-to-know access management, protection of sensitive data, backups, incident prevention and business continuity. GDPR compliance indicators are tracked regularly. In the event of a data breach posing a risk to your rights, we notify the CNIL (the French data protection authority) and, where necessary, the people concerned.
You have the following rights over your data:
To exercise these rights, write to rgpd@torow.eu or by post to our registered office. We respond within one month, which may be extended by two months for complex requests. If we have reasonable doubts about your identity, we may ask for proof.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.
The website uses cookies that are strictly necessary for it to work, which do not require consent. Analytics cookies are only set after you agree, via the banner shown on your first visit. Your choice is kept for six months and you can change it at any time using the “Manage cookies” link at the bottom of the page. Cookies have a maximum lifespan of thirteen months.
This policy may change, in particular when a new service is introduced or regulations change. The date of the last update is shown at the top of this page.
We use cookies that are necessary for the website to work. With your consent, we also use analytics cookies to understand how the site is used and improve it. You can change your mind at any time via “Manage cookies” at the bottom of the page. Learn more
Essential for the website to work and to remember your choices. They do not require your consent.
Anonymous visit statistics: pages viewed, visit duration, source. Maximum lifespan: 13 months.
