Your personal data

Peppermint keeps an inventory of its IT equipment: knowing who uses which device, tracking its security posture (encryption, firewall, updates) and planning its renewal.

This processing rests on the company's legitimate interest in managing and securing its equipment. The data controller is Peppermint.

• You: your name and your work email address.
• The device: make, model, serial number, machine name, name of the open session, processor, memory, storage, MAC address, operating system version, and the state of encryption, firewall and automatic updates.
• Your answers: site, how it was acquired, owner, asset tag, and the peripherals you add.

Never: your files and documents, passwords, browsing history, applications or messages.

Peppermint's IT team, in the restricted area of this portal and in Snipe-IT, the inventory tool hosted by Peppermint.

For a device model the portal does not know, the make and model alone — for example "Dell Latitude 7440" — are sent to the OpenRouter service to estimate its release year. Nothing that identifies you goes with them.

When you add a peripheral, you can photograph its manufacturer label to have its model and serial number filled in. That photo is sent to the same service, without any name, address or location, and is not kept by the portal. Frame the label only. The step is optional: the fields can always be typed instead.

For the IT team's scrap suggestions, the model, year, specs, condition and note of devices in stock are sent to the same service, without holder, location, tag or serial number.

The IT team has an assistant to help manage the stock. To answer, what the team writes in the conversation is sent to the same service, with what the assistant looks up: for devices, the model, specs, condition, tag, serial number, site, location and note; for people, the name and job title of those searched for and of those holding the devices looked up. Any email address is removed before sending.

• A declaration that was started but never sent is deleted after 7 days.
• A declaration that was sent is kept for as long as the device is part of Peppermint's equipment.

You can ask to access your data, to have it corrected or erased, to restrict its processing, or to object to it. Write to it@peppermint.company.

The asset tag of your devices can be corrected directly from My devices.

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL.