Privacy policy

1. Purpose of the privacy policy

This privacy policy aims to inform visitors to the E.P. — Conseil stratégique website about how their personal data may be collected, used, retained and protected when they browse the website or communicate with its publisher.

It is drawn up in accordance with the Règlement général sur la protection des données (RGPD — règlement UE 2016/679) (General Data Protection Regulation — GDPR, EU Regulation 2016/679) and the loi Informatique et Libertés (French Data Protection Act), in their applicable versions.

2. Controller

The controller for the processing of personal data carried out in connection with this website is:

Élodie Papin

• Sole trader — E.P. — Conseil stratégique
• SIREN: 109 280 750
• SIRET: 109 280 750 00018
• Business address: 6 rue Ornano, 69001 Lyon
• Email address: contact.elodiepapin@gmail.com

For any questions about this policy or the processing of your personal data, you can contact the controller at the email address given above.

3. Personal data that may be collected

Depending on how you use the website, the following categories of data may be processed:

Data provided voluntarily

When you contact the publisher by email or through a contact form, if available, the data provided may include your surname, first name, email address, company, job title and the content of your message.

Technical browsing data

When you visit the website, certain technical data may be processed by the systems required for its operation and security, including the IP address, the date and time of the request, information about the browser or device used and the server's technical logs.

Whether these data are actually collected depends on the features and technical services used on the website.

The website is not intended to collect sensitive data within the meaning of the GDPR. Please do not send such information in your messages unless it is strictly necessary and the applicable legal conditions permit it.

4. Purposes and legal bases for processing

Personal data are processed only for specified, explicit and legitimate purposes.

Receiving and handling contact enquiries

Data provided voluntarily may be used to respond to requests for information, discuss services and follow up on enquiries.

Depending on the context, the applicable legal basis is taking steps at your request prior to entering into a contract or the controller's legitimate interest in responding to professional enquiries.

Managing business relationships

Where communications lead to a business relationship, the necessary data may be used to prepare business proposals, manage the client relationship and follow up on services.

Depending on the situation, the legal basis is the performance of a contract or taking steps prior to entering into a contract.

Compliance with legal obligations

Certain data may be retained or processed to comply with applicable accounting, tax or other legal obligations.

The legal basis in this case is compliance with a legal obligation.

Website operation and security

Strictly necessary technical data may be processed to ensure the website's operation, maintenance, incident prevention and security.

The legal basis is determined according to the processing concerned, in particular technical necessity or the legitimate interest in ensuring the security of the service.

Audience measurement and other possible features

If audience measurement tools, personalisation tools or third-party services are used, the purposes, data concerned and applicable legal bases will need to be specified according to their actual configuration. Where consent is required, it will be obtained before the trackers concerned are placed or read.

5. Mandatory or optional nature of data

Where data are requested when you make contact, only the information necessary to handle the enquiry should be provided.

Failure to provide essential information may prevent the controller from responding to or following up on the enquiry.

Other information remains optional unless otherwise indicated when it is collected.

6. Data retention periods

Personal data are not retained for longer than necessary for the purposes for which they are processed.

As a guide, the applicable periods are determined according to the following rules:

• Contact enquiries with no subsequent business relationship: retention for the time necessary to handle the enquiry, followed by deletion or limited archiving if there is a justification for it.
• Pre-contractual communications and business follow-up: retention for the period necessary to manage communications and, where justified, for the period needed to manage any disputes.
• Data relating to clients and services: retention throughout the business relationship, followed by archiving in accordance with applicable limitation periods and legal obligations.
• Accounting documents and supporting records: retention for the period required by applicable legal obligations.
• Technical logs and security data: retention for a period proportionate to security needs, according to the hosting service's settings.

The exact periods must be adapted to the processing actually carried out. Where a statutory retention period applies, it takes precedence.

7. Recipients of data

Personal data are accessible only to people who need them for the purposes described in this policy.

Where necessary, they may be processed by technical service providers involved in the website's operation, hosting, maintenance or communications management.

These providers must process the data only within the scope of their tasks and in accordance with applicable legal obligations.

Data are not sold to third parties.

They may be disclosed to an administrative or judicial authority where required by law or where disclosure is necessary to defend legal rights in court.

The providers actually used and their roles will need to be checked against the website's actual technical configuration.

8. Transfers of data outside the European Union

Some technical service providers may be established outside the European Union or use infrastructure located in third countries.

If personal data are transferred outside the European Economic Area, the transfer must comply with the conditions laid down by the GDPR, including the existence of an adequacy decision or the implementation of appropriate safeguards where these are necessary.

Any transfers and the applicable safeguards depend on the providers actually used for the website. They must be checked before this policy is published in its final form.

9. Data security

The controller implements appropriate technical and organisational measures to preserve the confidentiality, integrity and security of personal data, taking into account the nature of the data and the risks associated with processing.

These measures may include restricting access, securing the accounts and services used, and using technical service providers that offer appropriate safeguards.

As no transmission or storage system can guarantee absolute security, the controller takes care to limit risks under the conditions laid down by applicable regulations.

10. Data subjects' rights

In accordance with the GDPR and the loi Informatique et Libertés, you have the following rights, subject to the conditions laid down by the regulations:

• Right of access: obtain confirmation that your data are being processed and receive a copy.
• Right of rectification: request the correction of inaccurate or incomplete data.
• Right of erasure: request the deletion of your data where the legal conditions are met.
• Right to restriction of processing: request restriction of processing in the cases provided for by law.
• Right of objection: object to certain processing based on legitimate interest on grounds relating to your particular situation.
• Right of portability: receive the data you have provided in a structured and commonly used format, where this right applies.
• Right to withdraw your consent: where processing is based on your consent, withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal.
• Right to give instructions about what happens to your data after your death: under the conditions laid down by French legislation.

To exercise your rights, you can send your request to: contact.elodiepapin@gmail.com.

Proof of identity may be requested only where necessary to verify your identity in the event of reasonable doubt.

A response will be provided within the time limits laid down by the GDPR. Certain rights may be restricted where the law provides for this, particularly where there is a legal retention obligation.

11. Complaint to the CNIL

If, after contacting us, you believe that your rights are not being respected or that the processing of your data does not comply with the regulations, you can submit a complaint to the Commission nationale de l’informatique et des libertés (CNIL) (French data protection authority).

Official website: https://www.cnil.fr/

12. Cookies and other trackers

The website may use cookies or other trackers necessary for its operation, security or for remembering certain browsing choices.

Any use of trackers for audience measurement, personalisation, advertising or third-party services depends on the website's actual configuration.

Where prior consent is required, the trackers concerned are placed or read only after the user has made an affirmative choice. The user must be able to refuse the trackers concerned and withdraw their consent through accessible means.

Strictly necessary trackers may be exempt from consent under the conditions laid down by the regulations. The associated processing of personal data remains subject to the applicable obligations.

The categories of trackers actually used, their purposes, their durations and the ways of managing preferences will need to be specified after the website's configuration has been checked.

13. Links to third-party websites

The website may contain links to external websites or services. When you visit those websites, their own privacy policies apply.

The controller is not responsible for the privacy practices implemented by the publishers of those third-party services. We invite you to consult their policies before providing them with personal data.

14. Changes to the privacy policy

This policy may be amended to reflect legal, regulatory or technical developments or changes to the website's operation.

The applicable version is the one published on the website on the date of your visit. In the event of a substantial change requiring specific information to be provided or fresh consent to be obtained, appropriate measures will be implemented in accordance with the regulations.

15. Contact

For any questions about this policy or the processing of your personal data, you can contact:

Élodie Papin — E.P. — Conseil stratégique

• Email: contact.elodiepapin@gmail.com
• Business address: 6 rue Ornano, 69001 Lyon