Data Protection Policy

Updated: November 2025

Table of contents

1. General Information
2. Data Processing Details: Collected Data, Purposes, Legal Bases
3. Website
4. Pydio Cells Server, Desktop and Mobile App
5. Transfer, Storage Period, and Rights 

1. General Information

1.1 Our Commitment to Data Protection

Abstrium SAS, 40 rue Alexandre Dumas, 75011 Paris, France ("Abstrium" or "we") is committed to protecting your data. With this privacy policy, we inform you about the collection, processing, and use of data in connection with our website ("Website"), apps (“Apps”) and other services (collectively "Abstrium Services").

Abstrium does not rent or sell your data to third parties. Your data is also not used for targeted advertising or other forms of profiling. Any inquiries regarding your data, its protection, and how it is handled by Abstrium can be directed to privacy@wire.com. 

1.2. Scope, Controller

As a company based in France, Abstrium and its data processing activities are subject to French data protection law, particularly the General Data Protection Regulation ("GDPR") and the “Loi Informatique & Libertés” (“LIL”). This privacy policy covers the obligation of Abstrium for information according to Art. 13 and 14 GDPR. 

Unless otherwise stated in this privacy policy, Abstrium, a limited liability company under French law, based in Paris (France), registered in Paris under  number 752.256.966, is responsible for the processing of data related to the use of Abstrium’s Services. You can contact Abstrium as follows:

ABSTRIUM SAS
40 rue Alexandre Dumas
75011 Paris
France
Email: privacy@wire.com

Abstrium's supervisory authority is:

Commission Nationale de l'Informatique et des Libertés (CNIL)

at the following address:

CNIL - 3 place de Fontenoy - TSA 80715 - 75334 Paris cedex 07

2. Data Processing Details: Collected Data, Purposes, Legal Bases

When you use Abstrium Services, the following personal data may be collected and processed for the purposes and on the legal basis specified below.

Please note that below information only applies to the extent that Abstrium is the controller for the relevant data processing. Insofar as Abstrium processes personal data on behalf of and on the instructions of an Abstrium customer (acting as a so-called data processor), Abstrium cannot provide any details on the purposes or legal bases of the data processing. 

2.1 Pydio Forum

When users create a Pydio Forum account, they are required to provide a user name and an email address. This profile data is used to provide and support the service. The user name can be displayed to other Pydio Forum users who search for them. The email address is never shared publicly. Personal data is stored only for the duration of the account usage. The legal basis for this is contract performance according to Art. 6 sec. 1 lit. b GDPR. 

Adding further information to a user profile is optional. Abstrium uses the so-called double opt-in procedure as part of the registration process to verify the provided email address. This means that after a user has registered for the Pydio Forum, an email with a verification link is sent to the user to confirm ownership of the email address. If an email address is not verified, the provided data will be deleted after one month. In addition to the information provided by the user in the registration form, Abstrium may also store the date and time of registration and verification. This data is necessary to prove that the relevant account has been registered by a certain user or to trace the (possible) misuse of a user’s email address later.

The processing is necessary for the provision of the Abstrium Services to the user and, thus, based on Art. 6 sec. 1 lit. b GDPR (contract performance). 

2.2 Payment-Related Data

For Pydio Cells subscription plans, additional billing information may be required and shared with the billing provider. To make purchases, users must provide payment methods and possibly additional account data. Some transaction-related personal information, such as transaction amounts, is also processed.

Abstrium processes the payment-related data for the billing of our customer's purchases and to comply with tax laws. If you are our customer, i.e. our direct contractual partner, the legal basis for the processing of the above-mentioned is contract performance according to Art. 6 sec. 1 lit. b GDPR. 

Insofar as we collect and store data for tax reasons, the legal basis is Art. 6 sec. 1 lit. c GDPR (compliance with legal obligations). Data is deleted within 12 months after contract termination or expiration of legal retention periods.

2.3 Processing Data Upon Requests

When users submit inquiries (e.g., via email or a web form), the data they provide, such as their name, email address, telephone number, affiliation with a company, role in the company or other information, is processed to respond to their request. The legal basis is Art. 6 sec. 1 lit. b GDPR (pre-contractual measures), insofar as the request serves to prepare a contract with the user. Otherwise, the legal basis is Art. 6 sec. 1 lit. f GDPR (legitimate interest), in which case Abstrium’s legitimate interest is to appropriately respond to the user’s request. Data is deleted once the inquiry is fully processed and further communication is unnecessary.

2.4 Newsletter Distribution

If users subscribe to Abstrium's newsletter, their email address and name are processed to send the newsletter. Users can subscribe to Abstrium's newsletter using the form on our Website. Details on the content of Abstrium’s newsletter are available in the declaration of consent or in the newsletter subscription form. 

Abstrium uses the so-called double opt-in procedure as part of the subscription process to verify the provided email address. This means that after a user has registered for the newsletter, an email with a verification code is sent to the user to confirm the subscription and ownership of the relevant email account. If the subscription is not verified, the provided data will be deleted after one month at the latest. In addition to the information provided by the user in the registration form, Abstrium may also store the date and time of registration and verification, and the IP address of the device used in the registration process. This data is necessary to prove that the relevant user has actually subscribed to the newsletter and to trace the (possible) misuse of a user’s email address later.

We evaluate the use of the newsletter emails (e.g., opening rate, clicks) to improve the newsletter content with the help of so-called tracking pixels. Using the embedded tracking pixel, we can recognize whether and when a newsletter email has been opened and which links in the email have been accessed. By analyzing this information, we can draw conclusions about the recipients' interest in our newsletter content and improve and develop the newsletter accordingly.

The legal basis for the data processing as described above is user consent (Art. 6 sec. 1 lit. a GDPR). Users can unsubscribe at any time, i.e. users can freely withdraw their consent at any time and with effect for the future, for example by clicking on the unsubscribe link at the bottom of every newsletter email. User data is only retained while the subscription is active.

2.5 Support Cases 

If you contact Abstrium customer service, the personal data you provide may be stored for the duration of the support case resolution. Abstrium uses Zendesk to process customer enquiries. The legal basis for the processing of your data for processing the support request is a legitimate interest (Art. 6 sec. 1 lit. f GDPR). Our legitimate interest is to provide a support service for our customers. We delete your personal data processed for the processing of the support enquiry after the processing of your enquiry has been completed.

2.6 Cookies

Certain Abstrium Services use cookies and similar technologies (hereinafter collectively referred to as "Cookies"). Cookies are small text files that are stored on your device by your browser or app. They contain various information, e.g. duration of the website visit or user input. They may be set by Abstrium as the provider of the Website (so-called first-party cookies) or by third parties whose services are integrated in the Abstrium Services (so-called third-party cookies). Cookies can be stored for different lengths of time (e.g. duration of page use, several weeks up to a maximum of two years).

Abstrium uses Cookies for various purposes, which can be roughly differentiated as follows:

• Technically necessary Cookies: These Cookies are technically absolutely necessary to use the basic functions and ensure security of Abstrium Services. They do not collect information for marketing purposes or track the user behavior. Abstrium is permitted to use necessary Cookies without consent of the user.
• Optional Cookies for statistics or marketing purposes: These Cookies can, among other things, track the user’s interactions and behavior. These Cookies are used for analysis, for example to help optimize our Website, or marketing purposes. Abstrium uses such Cookies (i.e. their storage on your end device and access to these Cookies) only with the user’s explicit and free consent. Users can freely withdraw their consents at any time with effect for the future, e.g. in the relevant settings of the cookie banner.

Regarding the storage periods, the Cookies used by Abstrium can be roughly differentiated as follows:

• Session Cookies: These Cookies are automatically deleted after a session, e.g. when the browser is closed. They contain a so-called session ID. This allows various requests from a browser to be assigned to the shared session and a computer to be recognized when the user returns to the Abstrium Website.
• Persistent Cookies: These Cookies remain stored on the user’s end device and are automatically deleted after a certain period (depending on the specific Cookie, from a few hours to two years) or at the user’s request.

Further details on the functions and storage periods of the Cookies used by Abstrium can be found in the relevant cookie banner and in the following sections of this privacy policy (in each case for the relevant Abstrium Service and tool that uses the Cookies). 

2.7 Social Media Presence

We maintain a presence (a so-called "Fan Page") on the social media network LinkedIn, which is offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"), to communicate with customers and inform them about services. Only simple links or plugins that do not connect to social networks upon page loading are used.

We use the technical platform and services of LinkedIn to operate the respective Fan Page. We would like to point out that you use our Fan Page and its functions on your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). When you visit our Fan Page, LinkedIn may collect certain technical data (including the IP address of your end device) and other information that is stored on your end device in the form of Cookies. We have no influence on and no details about the processing of your data by LinkedIn. Data processing may differ depending on whether you are registered and logged in to the LinkedIn network or whether you visit the page as a non-registered and/or non-logged-in user. LinkedIn may track your movement on the LinkedIn network or visits on websites with integrated LinkedIn plugins. LinkedIn may assign the collected information to your user profile. This data can be used to personalize content or advertising to you. If you wish to avoid this, you should log out or deactivate the “stay logged in” function, delete the cookies on your device and restart your browser. Please also note that the data collected about you in this context may be transferred to countries outside the European Economic Area (EEA), in particular the USA, by the respective provider of the social network and processed there. Further information on the data processing by LinkedIn are available in their privacy policy at https://www.linkedin.com/legal/privacy-policy. 

We operate our Fan Page to communicate with the users active there and to be able to provide the latest news. We process the data from your use of the Fan Page that you provide to us and that require interaction. For example, if you ask us a question via a Fan Page, we process your information in order to answer your query appropriately.

When you visit our Fan Pages, LinkedIn also processes personal data to provide us with statistics and insights into the use of our Fan Pages. The statistics help us to adapt our Fan Pages according to user needs and thus to continuously optimize them, which can also be done for market research and advertising purposes. We only receive statistical reports that do not allow us to identify individual users of LinkedIn or draw conclusions about them. The processing of data for statistical purposes is carried out by us and LinkedIn under joint responsibility in accordance with Art. 26 GDPR. We have regulated the conditions and obligations as joint controllers with the providers in an agreement, which is available at https://legal.linkedin.com/pages-joint-controller-addendum. 

The aforementioned data processing by us is based on our legitimate interests in the operation of a Fan Page on the LinkedIn network, in the communication and interaction with the LinkedIn users, and in the evaluation of user interactions to improve the Fan Page. The data processing is therefore based in each case on Art. 6 sec. 1 lit. f GDPR.

To exercise your rights as a data subject, you can contact us or the provider of the respective social network. If one party is not responsible for responding or must receive the information from the other party, we or the provider will then forward your request to the respective partner. Please contact the respective provider of the social network directly if you have any questions about the profiling and processing of your data when using the Fan Page. If you have any questions about the processing of your interaction with us on our Fan Page, please write to the contact details provided by us above.

3. Website

3.1 Informative Use of the Website (Logs)

As part of a visit to the Abstrium Website for information purposes only (i.e. use without registration, login or communication with the provider via the website), information is automatically sent to the provider's server by the user's browser and temporarily stored there in a so-called log file. In this context, Abstrium collects and processes the following information and personal data in particular:

• IP address
• Date and time of accessing the Website
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Amount of data transferred
• Browser type and browser settings
• Language and version of the browser software
• Operating system used
• Last page visited by the user
• Access status/HTTP status code.

This information is technically necessary for Abstrium to deliver the Website and to ensure its stability and security. The personal data collected when the website is accessed, in particular the user's IP address, will be deleted no later than thirty (30) days after collection, unless an attack or threat by the user has been recognized.

Insofar as Abstrium collects and processes the user's personal data, in particular the user's IP address, when the Abstrium Website is accessed and visited, the legal basis for this is Art. 6 sec. 1 lit. f GDPR. Abstrium has a  legitimate interest  in providing the Website in a stable, secure, and safe manner. In particular, Abstrium intends to ensure a level of protection appropriate to the risk for the personal data it processes, to ensure network and information security and to optimize the Abstrium Website and protect it from attacks, disruptions and damage.

3.2 HubSpot: Hosting, Cookie Banner, CRM, Analytics

We use tools and hosting services provided by HubSpot, Inc., Cambridge, Massachusetts, US ("HubSpot") with a branch in Ireland (HubSpot European Headquarters, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland) to provide the Website and certain features. In particular:

• We host the Website on EU servers operated by HubSpot to make it available on the internet;
• We have integrated the HubSpot Cookie Banner on our Website to obtain and document visitors’ consent to the storage of Cookies on our Website;
• We have integrated HubSpot Forms on our Website to provide a user-friendly way to contact us via forms;
• We use the HubSpot CRM tool to process requests by visitors, users, or customers properly and efficiently.

When you visit our Website or when you use a service provided by HubSpot (e.g., the HubSpot Cookie Banner or form), certain technical data about your end device (IP address, information about the operating system and browser used, browser language, etc.) and any information entered by you in the respective tool (e.g., cookie settings, entries in the respective forms) are transmitted to Hubspot's servers. We use European server locations (i.e. servers of our partner HubSpot Ireland), so that the data is generally not transmitted to server locations in third countries outside the EU or the EEA. If Hubspot transfers data to the USA in individual cases, this data transfer takes place on the basis of Art. 45 GDPR, as Hubspot is certified according to the so-called EU-US Data Privacy Framework and is therefore subject to an adequacy decision of the EU Commission.

We have concluded a data processing agreement with Hubspot. Hubspot only processes the data in accordance with our instructions and on our behalf. The transfer of data to Hubspot is therefore based on Art. 28 GDPR. Hubspot only uses the data received as part of the CRM system for the technical processing of inquiries and does not pass it on to third parties.

The above data processing is based on Art. 6 sec. 1 lit. f GDPR (legitimate interest). Our legitimate interests are to provide site visitors with our Website featuring a legally compliant and user-friendly cookie banner solution, easy to use contact forms, and to provide us with an efficient CRM system to properly process user requests.

With your consent, HubSpot also uses Cookies to analyze your use of the Website and the use of the newsletter for statistical and marketing purposes. The statistical analyses and evaluations of logged user behavior help us to optimize our Website and further develop it based on user needs.  We also use information to determine which of our company's services are of interest to customers and newsletter subscribers and to contact them for advertising purposes.

The HubSpot Cookies are stored for a maximum period of 12 months and then automatically deleted. If this analytics feature is activated, the data collected with HubSpot (including technical information such as IP address, URL and language of the browser, approximate location, duration of a visit, privacy settings, interactions on the Website) can be linked to the information you provide to us in the forms and evaluated together. We receive the raw data collected and the statistical reports from HubSpot.

We only use these functions of HubSpot and the corresponding Cookies if you have given us your consent to the use of marketing Cookies on the Website or to the evaluation of the use of our newsletter (see the section on newsletters above) and the associated data processing. 

The service is used on the basis of your consent in accordance with Art. 6 sec. 1 lit. a GDPR. You can freely withdraw your consent at any time with effect for the future, e.g. in the cookie banner on our Website.

3.3 Google Fonts and Google Analytics

Our Website uses Google Fonts for the integration of external fonts, a service provided by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter referred to as ‘Google’).

The integration of Google Fonts takes place locally on our own server, so that no direct connection to Google's servers is established when you visit our Website.

Insofar as data processing is carried out, this is done for the purpose of the uniform presentation of fonts and icons. The legal basis is therefore our legitimate interest in the uniform presentation in accordance with Art. 6 sec. 1 lit. f GDPR.

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and Google Inc. Mountain View, USA (‘Google’). The purpose of our use of Google Analytics is to analyse your user interactions on our website and to improve our offering and make it more interesting for you as a user based on the statistics and reports obtained.

Google Analytics uses cookies to enable an analysis of your use of the website. During your visit to our website, the following data, among other things, is transmitted to Google and, if necessary, also to Google servers in the USA: pages accessed, your behaviour on the pages (e.g. length of stay, clicks, scroll depth), your approximate location (country and city), your IP address, technical information such as browser, internet provider, device and screen resolution, the source of your visit (i.e. which website or advertising medium brought you to us) and a randomly generated user ID. However, due to IP anonymisation on this website, your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

Google also processes the data collected via Google Analytics for its own purposes in accordance with its own privacy policy. The data may be stored by Google in usage profiles and processed, for example, for product improvement, the development of new products, measuring the effectiveness of certain advertising and market research, and the personalisation of content and advertisements. If you are logged in to Google, your data will be directly associated with your user account. If you do not want your data to be associated with your Google user account, you must log out before activating Google Analytics. We have no influence on the further processing of your data by Google. For more information, please refer to Google's privacy policy at https://policies.google.com/privacy.

The data collected by Google Analytics is stored for a maximum of 14 months. The storage period for the cookies used by Google can be found in the cookie banner. An overview of the cookies used by Google can be found at https://policies.google.com/technologies/cookies?hl=en.

The legal basis for the collection and further processing of information is your consent in accordance with Art. 6 sec. 1 lit. a GDPR. The legal basis for the use of cookies or similar technologies on your device is also your consent. You may revoke your consent at any time without affecting the lawfulness of processing prior to revocation.

In connection with the above-mentioned functions, Google may also transfer the data processed in this context to servers outside the EU, in particular to Google LLC in the USA, insofar as this is necessary for the provision of these services. For the USA, the EU-U.S. Data Privacy Framework is an adequacy decision by the EU Commission that certifies certified companies as having an adequate level of data protection within the meaning of the GDPR. Google LLC is certified under the EU-U.S. Data Privacy Framework and is also included in the list maintained by the U.S. Department of Commerce (Data Privacy Framework List). When data is transferred to Google LLC servers in the USA, a consistently high level of data protection is therefore guaranteed. Insofar as data is transferred to the USA, such a third-country transfer is based on Art. 45 sec. 1 sentence 1 GDPR.

4. Pydio Cells Server, Desktop and Mobile App

Pydio Cells Server

If you operate our Pydio Cells Server, the system periodically performs an automated check to determine whether updates are available. When your server contacts our update endpoint, we temporarily process your server’s IP address, the associated license number, and the license ID. This data is stored for 90 days and is used solely to verify the validity of your license, ensure compatibility of updates, prevent misuse of licensing keys, and maintain the security and stability of our services.

You can disable the automated update check with one click in the “Cells Console” under the menu item “Disable update checks”.

The legal basis for this processing is Art. 6 sec. 1 lit. b GDPR, as the update mechanism is necessary for the performance and maintenance of the contract between you and us, and Art. 6 sec. 1 lit. f GDPR, reflecting our legitimate interest in ensuring the secure and lawful operation of our software and licensing system.

You can disable the automated update check with one click in the “Cells Console” under the menu item “Disable update checks”.

Pydio Cells Desktop and Mobile App

When downloading the App, the operator of the app shop through which the App is made available (for example Apple, Inc. for the App Store and Google LLC for the Google Play Store) collects personal data required for the download. This data may include your name, your email address and your postal code, time of download, the IP address, and the individual device identification number of your end device (so-called IMEI), crash-logs as well as your payment information, if applicable. This collection and processing of your personal data is, however, basically carried out solely by the respective app shop operator, without participation or influence by Abstrium. Further details on this data processing are available in the privacy policy of the relevant app shop operator.

We process the personal data provided by the app store operator only to the extent necessary for the download and provision of the App. If we process personal data in the course of installation, this is done on the basis of the contract for the download and use of the Pydio Cells App that you have concluded, in accordance with Art. 6 sec. 1 lit. b GDPR.

5. Transfer, Storage Period, and Rights

5.1 Third Parties / Data Transfer to Third Countries

To provide Abstrium services, Abstrium uses the services of its affiliate companies, in particular Wire Germany GmbH, a limited liability company located in Germany.

For processing data of business prospects and business account users, Abstrium uses the following third parties:

Abstrium only shares personal data with third parties if and to the extent necessary to provide the third party's service (e.g., to respond to a support request), if legally required, or if it is necessary to enforce the terms of service and/or protect Abstrium's rights. Abstrium will not disclose your data to public authorities unless Abstrium is required to do so under French law.

Additionally, to the extent permitted by data protection law, Abstrium may disclose your personal data to third parties if we (or our affiliates) are acquired by or involved in a transaction with similar financial implications. In such cases, we will make reasonable efforts to ensure the third party processes your data in accordance with this privacy policy. If your personal data is subsequently used in a manner different from what is described in this policy, we will ask the third party to notify you in advance.

If Abstrium transfers personal data to third parties located outside France (see the list of third parties above), Abstrium ensures that (i) the third party is located in a country recognized by the European Commission as providing an adequate level of data protection, and/or (ii) Abstrium has entered into "Standard Contractual Clauses" with the third party and/or (iii) another safeguard or an exception under GDPR applies.

5.2 Storage Period

Where we have not explicitly stated a retention period in this privacy policy, the following applies: We will only process your personal data for as long as is necessary to achieve the purpose of the processing. As soon as the purpose of the processing no longer applies, we will delete your data immediately, unless there are legitimate reasons within the meaning of the applicable legal regulations (e.g. Art. 17 sec. 3 GDPR), such as in particular legally prescribed retention periods, to prevent deletion. In this case, the data will be deleted immediately after the retention period has expired.

Data that we process on the basis of your consent will be deleted immediately after you withdraw your consent, unless statutory regulations prevent deletion.

5.3 Your Legal Rights as a Data Subject

Under the applicable data protection laws, in particular the GDPR and the French Data Protection Act (LIL), you as the data subject have certain rights in relation to the processing of your personal data. These rights include:

1. Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether we are processing personal data about you. If this is the case, you can request information about the processed data and further information, such as the processing purposes, the categories of data, the recipients and the planned storage period.
2. Right to rectification (Art. 16 GDPR): If your personal data is incorrect or incomplete, you have the right to request the immediate rectification or completion of this data.
3. Right to erasure (right to be forgotten) (Art. 17 GDPR): You have the right to request the erasure of your personal data if one of the following grounds applies
   1. The data is no longer necessary for the purposes for which it was collected.
   2. You withdraw your consent and there is no other legal basis.
   3. The data has been processed unlawfully.
   4. The deletion is necessary to fulfill a legal obligation.
4. Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data if
   1. You contest the accuracy of the data, for a period enabling us to verify the accuracy.
   2. The processing is unlawful, but you request the restriction of use instead of erasure.
   3. We no longer need the data, but you need it for the establishment, exercise or defense of legal claims.
   4. You have objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of us override those of you.
5. Right to data portability (Art. 20 GDPR): You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and to request its transmission to another controller, provided this is technically feasible.
6. right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data, which is based on a legitimate interest. In this case, we will cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.
7. Right to withdraw consent (Art. 7 sec. 3 GDPR ): You have the right to withdraw your consent to the processing of your personal data at any time. The revocation applies to the future and does not affect the legality of the processing up to the time of revocation.
8. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): If you believe that the processing of your personal data violates data protection laws, you have the right to lodge a complaint with a competent data protection supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL).

You can exercise your rights at any time by contacting us via our contact form on pydio.com or by mail to: ABSTRIUM SAS - Attn DPO - 40 rue Alexandre Dumas, 75011 PARIS - FRANCE

You will then need to provide your full name and, if necessary, proof of identity.

5.4 No Automated Decision-Making

We do not use automated decision-making in accordance with Art. 22 sec. 1 and 4 GDPR, i.e. we do not use web-based systems to create user profiles and make automated decisions based on them with legal effect or similar detriment to you.

5.5 No Legal Obligation to Provide Data

You are not contractually or legally obliged to provide personal data on the Website, Fan Pages, or other Abstrium Services. 

5.6 Notification of Changes

This privacy policy may change from time to time, and we will make the updated policy available on the website.