Privacy policy.

Article 1. Definitions

In this policy, the following capitalised terms have the meanings set out below, whether used in the singular or the plural.

“Personal Data” or “Data”: any information relating to an identified or identifiable natural person within the meaning of Article 4 of Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”), including an IP address. “Processing”: any operation performed on Data, from collection to erasure.

“Data Subject” or “you”: the natural person to whom the Data relates.

“Controller”: the person who determines the purposes and means of Processing; here the company SANFYTECH, also referred to as “we”. “Processor”: the person who processes Data on behalf of the Controller, on its documented instructions (Article 28 of the GDPR).

“Client”: any legal person, or any natural person acting for professional purposes, that has entered into a contract with SANFYTECH. “Site”: the corporate website available at https://www.sanfytech.com. “Online Services”: the applications published and operated by SANFYTECH, which a user accesses by means of an account.

“French Data Protection Act”: Law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés), as amended.

Article 2. Purpose and scope

2.1 This policy, drawn up pursuant to Articles 12, 13 and 14 of the GDPR and the French Data Protection Act, describes how SANFYTECH collects, uses, discloses, retains and protects the Data of visitors to the Site, prospects, contact persons at its Clients and its suppliers, job applicants, users of the Online Services and persons accessing its administration systems.

2.2 It does not apply to Data that SANFYTECH processes on behalf of its Clients in the course of its hosting, managed services, development or integration services: for such Processing, the Client is the Controller and SANFYTECH acts as Processor, under the agreement entered into pursuant to Article 28 of the GDPR, and informing the data subjects is then a matter for the Client and its own policy.

By way of exception, this policy applies to Processing that SANFYTECH carries out on its own account and for which it alone determines the purpose and means, even where that Processing runs on systems that it operates for a Client: technical and security logging of its own infrastructure base and the management of its business relationship, invoicing and accounting. For that Processing alone, SANFYTECH is the Controller and Articles 5 to 15 of this policy apply, the Client referring to this in its own information notice. The boundary between that Processing and the Processing carried out as Processor, in particular the logging produced on the systems operated on behalf of a Client and the audience measurement deployed on them where applicable, is the one set out in Article 2.4 of the agreement entered into pursuant to Article 28 of the GDPR.

2.3 Nor does it apply to third-party sites to which a link may point. The legal notice of the Site is published at https://www.sanfytech.com/legal/mentions-legales, the general terms of sale at https://www.sanfytech.com/legal/cgv and the terms of use of the Online Services at https://www.sanfytech.com/legal/cgu.

2.4 Where the Processing of your Data began before 15 July 2026, in the course of the sole-trader activity previously carried on by the legal representative of SANFYTECH, that Data was taken over by SANFYTECH, which has been its sole Controller since that date. This policy constitutes notice of this change of controller within the meaning of Articles 13 and 14 of the GDPR and governs such Processing going forward, without altering either the purpose or the legal basis of the original collection; you retain, as against SANFYTECH, all the rights provided for in Chapter III of the GDPR, including the right to object to the continuation of such Processing.

Article 3. Controller and point of contact

3.1 The Controller is:

3.2 No data protection officer. SANFYTECH has not appointed a data protection officer: none of the three conditions laid down in Article 37 of the GDPR is met, as the company is not a public body and carries out neither regular and systematic monitoring of individuals on a large scale nor large-scale Processing of Data falling under Article 9 of the GDPR. This position is reviewed whenever our processing changes.

3.3 Single point of contact. The President of the company is the single point of contact for data protection matters, reachable at rgpd@sanfytech.com or by post at the registered office, for any request falling under this policy and for exchanges with the supervisory authority. Every request received at that address is given a time-stamped acknowledgement of receipt, which records the date of receipt from which the response period under Article 14.3 runs. As SANFYTECH has a single establishment in France, the competent authority is the CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority).

Article 4. Source of the Data and information requested

4.1 In the vast majority of cases, the Data is collected directly from you: contact form, e-mail, telephone conversation, response to a commercial proposal, performance of a contract, creation of an account on an Online Service.

4.2 Solely for the purposes of business-to-business prospecting, professional contact Data may be collected indirectly, from publicly accessible sources: websites of organisations, public registers, professional directories and events. Indirect collection is not limited to prospecting: competition results already made public by their organiser, reproduced for documentary purposes in one of our Online Services, are also collected from their source. This policy constitutes information within the meaning of Article 14 of the GDPR for such Processing, the characteristics of which are set out in the table in Article 5; it is brought to your attention in the first message sent to you and, in any event, within one month of the collection of your contact details. You may object to it at any time, without having to give reasons, by writing to rgpd@sanfytech.com or by using the unsubscribe link included in each of our messages; the Data concerning you is then removed. SANFYTECH neither buys nor rents prospecting lists.

4.3 In our forms, the information required is marked as mandatory: without it, the request cannot be processed. Other information is optional and has no effect on the response given.

Article 5. Processing, purposes, legal bases and periods

5.1 The table below lists the Processing for which SANFYTECH is the Controller. The periods stated are maximum retention periods in the active database: beyond them, the Data is erased or moved to intermediate archiving under the conditions of Article 8. You may at any time request the early erasure of your Data by exercising your rights under the conditions of Article 14.

5.2 No Data falling within the special categories of Article 9 of the GDPR (health, political, philosophical or religious opinions, trade union membership) is collected; we ask you not to send us any such Data unprompted.

5.3 As at the date of this version, SANFYTECH has no employees and is not running any recruitment campaign: the Processing relating to job applications is carried out only from receipt of a first application. Where Processing is based on our legitimate interest, the balancing of that interest against your rights is provided to you on request.

Article 6. Recipients and processors

6.1 Your Data is accessible to the director of SANFYTECH and, to the extent of their needs, to authorised technical staff. It is disclosed to the following recipients:

6.2 None of your Data is transferred, sold or rented to third parties for commercial purposes, nor used by SANFYTECH to train or fine-tune an artificial intelligence model. The artificial intelligence tools used by SANFYTECH are subscribed to under contractual terms that exclude training of the provider’s models on the content submitted to it; any change resulting in that use no longer being excluded leads to SANFYTECH ceasing to use the tool concerned. Each Processor acts on documented instructions and is bound by confidentiality and security obligations. The list above is updated whenever a service provider changes. Where SANFYTECH hosts or operates a service on behalf of a Client, the list of sub-processors specific to that service is annexed to the agreement entered into with that Client.

6.3 Components run on our own infrastructure. The Processing for audience measurement and the protection of our public forms is carried out by means of software installed on our own servers, in France: no Data is therefore disclosed to any third party, and these components are not recipients within the meaning of Article 4, point 9, of the GDPR. They are described in Articles 11.2 and 11.5 of this policy.

Article 7. Location of the Data and transfers outside the European Union

7.1 Location. Our production systems are hosted in data centres located in France (Strasbourg, Roubaix and Gravelines (France)). Backups are subject to the following arrangements: backups are encrypted at source before transfer; the primary copy is kept in the European Union (Germany) and a mirror copy is kept in France. As Germany is a Member State of the Union, this location does not constitute a transfer outside the European Union. We therefore do not state that your Data “never leaves France”: it does not leave the European Union, subject only to the flows described below. Commercial statements on the Site concerning the location of our infrastructure are to be read subject to this article and Article 7.2, which prevail over them. SANFYTECH does not guarantee that its Processing is beyond the reach of all extraterritorial legislation: the flow listed in Article 7.2 involves processing in the United States, and the safeguard applicable to it is described there.

7.2 Listed transfers. Only one flow involves processing outside the European Union: the artificial intelligence based administration assistance tool described in Article 6.1. The entity with which we contract is established in Ireland; the processing of the material submitted to it is carried out in the United States. This flow is governed by the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914). The Data transmitted is reduced to what is strictly necessary: no authentication credentials and no cryptographic secrets are submitted to the tool; log extracts are limited to the elements needed for diagnosis and may include IP addresses and technical identifiers. No other transfer outside the European Union takes place in connection with the Processing for which we are the Controller, subject only to Article 7.3.

7.3 Switzerland. Our business e-mail is hosted in Switzerland and in the European Union. Switzerland is a third country covered by an adequacy decision of the European Commission in force at the date of this version: the transfer exists, it is governed by Article 45 of the GDPR and does not require any additional safeguard. If that decision is repealed, suspended or invalidated, we will put in place an appropriate safeguard within the meaning of Article 46 of the GDPR or bring the transfer concerned to an end.

7.4 Principles applied. For any new service processing Data, a provider established in the European Union or in an adequate country is preferred, and any contrary choice is justified in writing. The Data transferred is limited to what is necessary; no authentication credentials, no cryptographic secrets and no Data falling under Article 9 of the GDPR are transmitted outside the European Union. In accordance with Articles 13.1(f), 14.1(f) and 15.2 of the GDPR, a copy of the appropriate safeguards governing the transfers that concern you, in particular the standard contractual clauses adopted by Implementing Decision (EU) 2021/914, is provided to you on simple request sent to rgpd@sanfytech.com, within the period set in Article 14.3 of this policy.

Article 8. Retention periods, erasure and backups

8.1 Where no specific period is stated in Article 5, the Data is kept for the time strictly necessary for the purpose for which it was collected, then erased no later than three (3) months after that purpose ceases to exist, in particular after the exchange has ended, the account has been closed or the service to which it relates has come to an end. Processing subject to a legal retention obligation follows the arrangements in Article 8.2.

8.2 When these periods expire, the Data is subject to periodic purging. Where a legal obligation requires it to be kept, it is moved to restricted-access intermediate archiving until the statutory period expires. By way of exception, the logs and documents relating to a breach recorded in our internal register or to litigation are excluded from the purge and kept for five (5) years after the file is closed, in a separate location; this exception never applies by default.

8.3 Erasure and backups. When you request the erasure of your Data, it is erased from the active database without delay and at the latest within one month of your request. Our backups, which are used exclusively to restore our services after an incident, are not modified: altering them would destroy their evidential value. Your Data is deleted from our backups, including the standby copy, when their retention period expires, which does not exceed twelve (12) months. If a restoration takes place within that interval, the erasure is immediately reapplied.

Article 9. Security of the Data

9.1 In accordance with Article 32 of the GDPR, SANFYTECH implements technical and organisational measures appropriate to the risks, in particular:

• encryption of communications: TLS version 1.2 at least on published services, certificates renewed automatically;
• encrypted backups: daily backup of the machines within the hosting scope, encryption before transfer, key under our exclusive control and disclosed to no hosting provider or storage provider, automatic integrity checking of the backed-up sets;
• segregation: systems operated on a private network, publication through a shared entry point, separation of environments and of management data;
• control of administrative access: administration by cryptographic key, named bastion host recording sessions, individual accounts for each administrator;
• secrets management: centralised in a dedicated vault, no secrets in clear text in code repositories;
• patch tracking on inventoried systems, protection of public forms by a self-hosted anti-bot mechanism, centralised logging of security events and automatic temporary blocking of malicious IP addresses.

9.2 Scope of our commitments. The measures described in 9.1 are implemented having regard to the state of the art, the costs of implementation and the risks, in accordance with Article 32 of the GDPR. SANFYTECH guarantees neither the absence of vulnerabilities, nor the invulnerability of its systems, nor the impossibility of unauthorised access. Each measure is documented and justified on request. The level of SANFYTECH’s contractual obligations towards its Clients is defined by the general terms published at https://www.sanfytech.com/legal/cgv and by the agreement entered into pursuant to Article 28 of the GDPR; this policy does not derogate from them and in no way limits the rights that data subjects derive from the GDPR.

9.3 No certification. SANFYTECH does not currently hold any security certification or qualification and does not claim any. The assessments carried out on its information system are tool-assisted self-assessments, which constitute neither an independent audit, nor a penetration test, nor an accreditation.

Article 10. Logging, threat detection and IP address blocking

10.1 To ensure the security of our services, we keep technical and security logs containing in particular the IP address from which requests originate, the timestamp, the resource requested and authentication events. This Processing is based on our legitimate interest in protecting our systems, in the light of Recital 49 of the GDPR, and on Article 32. The periods adopted, six months for operating logs and twelve months at most for security traces, fall within the range of six months to one year recommended by the CNIL for logging.

10.2 IP addresses from which behaviour identified as malicious originates may be subject to automatic temporary blocking. The detection engine runs on our infrastructure: none of these addresses is transmitted to any third party, and no page content, no form Data and no user identifier leaves our systems. The blocking is temporary and reversible; you may challenge it under the conditions of Article 14.

10.3 Administrative access. Administrators and technical service providers are informed in writing, before their access is opened, of the existence of the logging and recording of their sessions, of the persons authorised to access them and of the applicable retention period, set at twelve (12) months at most in accordance with Article 5. These recordings are used solely for the analysis of security incidents and to establish evidence of an intervention; they are never used to monitor individual activity or to evaluate individuals.

Article 11. Cookies, audience measurement and form protection

11.1 Cookies. Our sites place no advertising cookies, no social network cookies and no advertising performance measurement trackers; no consent collection banner is therefore displayed to you. Where an Online Service requires it, only cookies strictly necessary for its operation are placed, such as an authentication session identifier or a display preference: they are exempt from consent under Article 82 of the French Data Protection Act and expire when the session ends or, at the latest, six (6) months after being placed. The Site stores your choice of theme, light or dark, in your browser’s local storage; this information is not a cookie, is not transmitted to anyone and is erased along with your browser data.

11.2 Cookie-free audience measurement. Traffic on the sites we publish on our own account is measured using a tool self-hosted on our own infrastructure, without any third-party provider and without placing any cookie. Where the same tool is deployed on a Client’s service, we operate it as processor, exclusively on behalf of that Client, which is the controller and itself informs the data subjects. Your IP address is truncated by two bytes before any recording and the visit identifier is pseudonymised by means of a hash renewed daily, which neither allows you to be identified nor allows you to be tracked from one day to the next or from one site to another; it nevertheless remains Data and is accordingly subject to the periods and rights provided for in this policy. Your browser’s “Do Not Track” signal is respected. Only the aggregated statistics kept beyond the periods in Article 5 are anonymous.

11.3 This Processing benefits from the consent exemption provided for audience measurement by Article 82 of the French Data Protection Act, as interpreted by the CNIL guidelines and recommendation on cookies and other trackers: purpose limited to measuring audience and improving our content, for our internal use only; no cross-referencing with other processing, no cross-site tracking, no profiling and no advertising use; no transmission to any third party; segregation of the statistics of each site, accessible only to its publisher; periods limited to the values in Article 5, namely three hundred and ninety-five (395) days for raw logs and twenty-four (24) months for detailed reports.

11.4 Objection. You may object to this measurement by enabling your browser’s “Do Not Track” signal, which our instance honours, or by writing to us at rgpd@sanfytech.com. You may also delete cookies already placed and block new cookies from being placed through your browser settings.

11.5 Form protection. Our public forms are protected against automated submissions by a self-hosted proof-of-work mechanism, called ALTCHA, without cookies and without transmission of Data to any third party, supplemented by a honeypot field and a limit on the number of submissions. The IP address used for this sole purpose is kept in memory for ten minutes to limit the number of submissions; a rejected attempt is recorded, with the IP address, in the security logs referred to in Article 10.

Article 12. Automated decision-making, profiling and analysis assisted by artificial intelligence

12.1 In accordance with Article 22 of the GDPR, SANFYTECH takes no decision based solely on automated Processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

12.2 No profiling is carried out on visitors to our sites or on users of our Online Services.

12.3 However, the Data of business contacts recorded in our sales management may be subject to analysis, assisted by an artificial intelligence tool run on our own infrastructure, intended to assess the commercial interest of a contact and to prioritise our outreach. This analysis constitutes profiling within the meaning of Article 4, point 4, of the GDPR. It concerns only professional Data, produces no legal effect and entails no automated decision within the meaning of Article 22: the commercial decision, like any decision prepared internally using an artificial intelligence tool, remains taken by a natural person.

12.4 Your right to object. You may at any time, without having to give reasons and free of charge, object to commercial prospecting and the profiling associated with it, by writing to rgpd@sanfytech.com. Your objection is given effect without delay and your Data then ceases to be processed for that purpose.

Article 13. Minors

13.1 Our services are intended for an adult professional audience. No Data concerning a person under fifteen (15) years of age is knowingly collected by the Site; in the event of inadvertent collection, the Data is deleted without delay upon notification to rgpd@sanfytech.com.

13.2 Where an Online Service published by SANFYTECH is likely to be used by persons under fifteen (15) years of age, registration is lawful only if consent is given jointly by the minor concerned and by the holder or holders of parental authority over that minor, under the conditions of Article 8 of the GDPR and of the French Data Protection Act. The information relating to the Processing is then drafted in clear and plain terms, easily understandable by the minor, and is provided in easily accessible language. The arrangements for verifying age and collecting this dual consent, once settled, will be set out in the policy specific to that service, which will prevail over this policy as regards that service. That service is not opened to a wide audience until these arrangements have been implemented.

Article 14. Your rights and how to exercise them

14.1 You have the following rights over the Data concerning you:

• access (Article 15 of the GDPR): confirmation that your Data is being processed, information about that Processing and a copy of the Data;
• rectification (Article 16): correction or completion of inaccurate or incomplete Data;
• erasure (Article 17), subject to our legal retention obligations;
• restriction (Article 18): temporary suspension of Processing, for example while the accuracy of Data is being verified;
• portability (Article 20): the Data you have provided to us, in a structured format, where the Processing is based on your consent or on a contract;
• objection (Article 21): on grounds relating to your particular situation where the Processing is based on our legitimate interest, and without giving any reason in the case of prospecting;

• withdrawal of consent (Article 7(3) of the GDPR), without affecting the lawfulness of prior Processing;

• post-mortem directives (Article 85 of the French Data Protection Act): general directives, lodged with a trusted third party certified by the CNIL, or specific directives, addressed to SANFYTECH.

14.2 Procedure. Requests are made by e-mail to rgpd@sanfytech.com or by post to the registered office, 173 rue de Courcelles, 75017 Paris, stating the right you wish to exercise and, if possible, the Processing concerned.

14.3 Response time. We respond within one (1) month of receipt of your request. This period may be extended by two (2) months, taking into account the complexity or number of requests, in which case we inform you of the extension, with reasons, within one month of your request (Article 12.3 of the GDPR).

14.4 Identity verification and no charge. Where there is reasonable doubt as to your identity, we may request the additional information necessary; any proof provided is kept only for as long as it takes to handle the request. Exercising your rights is free of charge; where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may, in accordance with Article 12.5 of the GDPR, charge a reasonable fee or refuse to act on it, giving reasons for our position.

14.5 Complaint. You have the right to lodge a complaint with a supervisory authority (Article 77 of the GDPR). In France, the competent authority is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, whose online complaint service is available from its website. We nevertheless invite you to contact us first.

14.6 In the absence of specific directives, the heirs of a deceased person may exercise certain rights over that person’s Data under the conditions of paragraph II of Article 85 of the French Data Protection Act, in particular to have an account closed.

14.7 What happens to your Data in our Online Services after your death. In accordance with paragraph III of Article 85 of the French Data Protection Act, if you have an account on one of our Online Services, you are informed that, upon your death, your Data there will be kept and then erased under the conditions of Article 8, unless there are directives to the contrary. You may at any time choose whether or not to have your Data communicated to a third party whom you designate, and modify or revoke that choice, by writing to rgpd@sanfytech.com. This choice is recorded, time-stamped and prevails over the default arrangements described in 14.6.

Article 15. Personal Data breach

15.1 Any breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Data is, as soon as we become aware of it, subject to a documented assessment and recorded in our internal register of breaches, whether or not it gives rise to notification. That record states the facts, their effects and the measures taken, in accordance with Article 33.5 of the GDPR.

15.2 Where it is likely to result in a risk to your rights and freedoms, the breach is notified to the CNIL without undue delay and, where feasible, not later than seventy-two (72) hours after we have become aware of it (Article 33 of the GDPR). Where it is likely to result in a high risk, you are informed without undue delay, in clear and plain terms (Article 34 of the GDPR): nature of the breach, contact details of the point of contact, likely consequences and measures taken or proposed.

15.3 Where the breach concerns Data processed on behalf of a Client, the Client is informed without undue delay and at the latest forty-eight (48) hours, non-working days included, from the time we become aware of it, a period stipulated in Article 14.1 of the data processing agreement and counted in calendar hours. Notification to the supervisory authority and informing the data subjects are the Client’s responsibility in its capacity as Controller. Where the breach affects any of the Processing that we carry out on our own account within the meaning of Article 2.2, even where it runs on a Client’s systems, notification to the supervisory authority and, where applicable, informing the data subjects are our responsibility: we inform the Client at the same time so that it can assess the follow-up required in respect of its own processing.

Article 16. Updates to the policy and version history

16.1 This policy may be amended to reflect changes in our Processing, our service providers or the regulations. The applicable version is the one published at https://www.sanfytech.com/legal/confidentialite, whose version and date appear at the top of the document. Earlier versions are kept, with their publication date and withdrawal date, and provided on request sent to rgpd@sanfytech.com, so that anyone can determine the rules applicable to the Processing of their Data at a given date.

16.2 In the event of a substantial change, in particular the addition of a purpose, a change of legal basis, the addition of a recipient outside the European Union or the extension of a period, the data subjects are informed by e-mail or by a prominent notice on the Site, before the new version comes into force.

16.3 Version history:

Article 17. Contact

For any question about this policy, your Data or the exercise of your rights:

• E-mail: rgpd@sanfytech.com
• Post: SANFYTECH, 173 rue de Courcelles, 75017 Paris
• Telephone: 07 59 96 14 99

SANFYTECH, simplified joint-stock company (SAS) with share capital of 5,000.00 euros, Paris Trade and Companies Register (RCS de Paris) no. 107 365 249, whose business is carried on from Strasbourg (Alsace).