Your data, handled with precision

Personal Data We Collect

1. Data you provide directly

When you submit a contact form, request a demo, subscribe to our newsletter, or interact with us, we may collect:

• Identity data: first name, last name, job title
• Contact data: professional email address, phone number
• Professional data: company name, industry sector, country
• Message content: any information you choose to include in your message

2. Data collected automatically

When you browse our website, we automatically collect the following data, subject to your cookie preferences:

• Technical data: IP address (anonymised), browser type and version, operating system, referral URL
• Usage data: professional email address, phone number
• Professional data: pages visited, time on page, links clicked, scroll depth (via Google Analytics 4)
• Marketing data: ad interactions, LinkedIn campaign data (via LinkedIn Insight Tag)ad interactions, LinkedIn campaign data (via LinkedIn Insight Tag)
• CRM tracking: email open/click tracking, form submissions (via HubSpot)

Purposes & Legal Bases for Processing

We process your personal data for the following purposes, each resting on a specific legal basis under GDPR Article 6.

When you contact us or submit a form to enquire about our services, we process your data on the basis of pre-contractual necessity (Art. 6(1)(b)) — it is simply necessary to respond to your request. We may also rely on our legitimate interest (Art. 6(1)(f)) in developing our commercial activity and maintaining relationships with prospective clients.

For marketing communications such as newsletters or campaign emails, we rely exclusively on your prior consent (Art. 6(1)(a)). You can withdraw this consent at any time, with no effect on the lawfulness of processing carried out before withdrawal.

For website analytics via Google Analytics 4, campaign measurement via the LinkedIn Insight Tag, and tag orchestration via Google Tag Manager, we process data solely on the basis of your consent. None of these tools are activated until you have accepted the relevant category in our cookie consent banner.

For fraud prevention and the technical security of our website, we rely on our legitimate interest (Art. 6(1)(f)) in maintaining a safe and functional online environment.

Finally, where we are subject to a legal obligation — such as accounting, tax, or compliance requirements — we process the data strictly necessary to fulfil that obligation (Art. 6(1)(c)).

Who We Share Your Data With

We share your personal data only with trusted third-party service providers who act as data processors on our behalf, under written Data Processing Agreements (DPAs) in accordance with GDPR Article 28. We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.

Our website is hosted and our CRM operated by HubSpot, Inc. (25 First Street, Cambridge, MA 02141, USA), which also handles our contact forms and marketing email infrastructure. Website analytics are provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) through Google Analytics 4 and Google Tag Manager. Campaign performance and B2B retargeting are managed through the LinkedIn Insight Tag operated by LinkedIn Ireland Unlimited Company (Wilton Plaza, Dublin 2, Ireland).

International Data Transfers

HubSpot and Google are headquartered in the United States, which means that some of your personal data is transferred outside the European Economic Area (EEA). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission under Decision 2021/914/EU, supplemented by the respective Data Processing Agreements of each provider. LinkedIn, while an Irish-registered entity, may also transfer certain data to the United States under equivalent safeguards.

You may request a copy of the applicable transfer mechanisms by contacting us at the address indicated in Section 1

How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

Data submitted through our contact forms is retained for three years from the date of your last interaction with us. If a commercial relationship follows, client contact data is kept for the duration of the engagement plus five years, in line with French legal obligations. Google Analytics data is configured with a 14-month retention window in our GA4 settings. HubSpot CRM records are retained for three years from your last interaction or until you withdraw consent. Data processed via the LinkedIn Insight Tag is subject to LinkedIn's own retention policy, with matched audiences kept for a maximum of 180 days. Cookie consent records are retained for six months, in line with CNIL guidance.

Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or loss. All data transmitted to and from this website is encrypted via HTTPS. Access to our CRM (HubSpot) is subject to authentication controls and role-based access restrictions. All third-party processors are bound by Data Processing Agreements that include security obligations. We review our data access rights and security practices on a regular basis.

No method of electronic transmission or storage is entirely risk-free. In the event of a data breach affecting your rights and freedoms, we are committed to notifying the relevant supervisory authority within 72 hours and, where required, informing you without undue delay.