We collect four things, and nothing else

Who is responsible for this data

The data controller is the publisher of this website, whose full identity and address are given in the legal notice. The publisher, and no one else, decides what is collected here and what is done with it.

For any question about your data, or to exercise one of the rights described below: contact@amndevsec.fr, or the form, stating what your request is about. Both arrive in the same place.

No trackers, no analytics

This website uses no analytics tool, no advertising pixel, no social media button, and its code sets no cookie. So there is no consent banner to show: there is nothing to consent to. One caveat, and it is not up to us: the host may set a strictly technical cookie, for example to protect access during a preview phase.

The home page has two links to our Instagram and LinkedIn accounts: plain links, which load nothing from Instagram or LinkedIn until you click on them.

The fonts are hosted on this website and are not loaded from a third-party service. Opening a page therefore sends your IP address to no one other than the website's host.

The pages write nothing on your device.

The access request form

What is collected: your name, the name of your organisation, your email address, and the text you write. Nothing else: the form asks for no means of payment, no password and no attachment. The message also shows whether it comes from the English version of the website.

A second, shorter form sits at the bottom of the Pricing page, to ask a question without requesting access. It collects only your email address and your question. It arrives in the same place, it is handled the same way, and the same retention periods apply.

Why: to reply to you and, where relevant, to prepare what comes next. Legal basis: steps taken at your request before entering into a contract (article 6.1.b of the GDPR).

Who receives it: us, and no one else. The request reaches us through our email delivery provider, Resend, which acts as a processor and makes no other use of it. Your information is neither sold, nor rented, nor passed on to any business partner, without exception.

How long: three years from our last exchange if the conversation continues, twelve months if it leads nowhere. Sorting is done by hand every January: a request may therefore stay until the January that follows that period.

Who deletes it, and when: we do, by hand, once a year, in January. On our side, nothing erases itself, and we would rather write that down than let you believe in a mechanism that does not exist. If you want your request to disappear sooner, say so at contact@amndevsec.fr: it is done within eight days, and we confirm it to you.

Does your information leave the European Union?

Yes, and we may as well say so clearly. Two American providers are involved:

• Resend (Plus Five Five, Inc.) delivers the email that passes your request on to us. The content of the form therefore goes through its servers.
• Vercel Inc. hosts this website. Like any host, it keeps technical connection logs. The form also goes through a function of this website, run by Vercel in the United States, which passes it on to Resend without keeping it.

A transfer of personal data outside the European Union must be covered by the safeguards set out in Chapter V of the GDPR: the European Commission's standard contractual clauses, or participation in the EU-US Data Privacy Framework.

Vercel Inc. covers this transfer through its participation in the EU-US Data Privacy Framework, supplemented by the European Commission's standard contractual clauses. Resend (Plus Five Five, Inc.) covers it through its participation in the EU-US Data Privacy Framework, supplemented by the European Commission's standard contractual clauses. These safeguards are set out in their respective data processing agreements, which we can send you on request.

No scoring, no profiling

No score, no profiling, no decision made automatically about you. There is only one automatic filter, against bots: a message containing more than two links reaches us marked "to check", and it is read like the others; a submission that the server takes for a bot's is set aside (see below). Everything else is read and answered by a person.

Protection against automated submissions

To stop a script from flooding the form, the server counts recent submissions coming from the same origin. To do this, your IP address is turned on the fly into a non-reversible fingerprint, kept in memory for twenty-four hours at most, the window over which the count runs. These twenty-four hours run from your last submission. It is not written anywhere and disappears when the server restarts. The form also measures the time spent on the page before sending: a submission made in less than two and a half seconds is treated as a script's, and ignored. This check relies on JavaScript: without it, it does not take place. This duration is used only for this check and does not appear in the message that reaches us.

Your IP address itself is neither saved to disk, nor attached to the message that reaches us, nor passed on to anyone. The host, for its part, keeps its own technical logs, like any host.

Legal basis for these checks: our legitimate interest in protecting the form and the website against abuse (article 6.1.f of the GDPR). The same basis covers the technical logs kept by the host.

No CAPTCHA is used: these systems send information about your browser to a third party, and mostly penalise people who use accessibility tools.

Your rights

You can ask for access to the information about you, its rectification, its erasure, the restriction of its processing, its portability in a readable format, or you can object to the processing. You can also give instructions on what happens to your data after your death.

In practice: write to contact@amndevsec.fr, or use the form, stating clearly that it is a GDPR request. We reply within one month. There is nothing to justify and no special form to fill in; if we have a doubt about your identity, we will tell you rather than ignore the request.

If the reply does not satisfy you, you can lodge a complaint with the CNIL (the French data protection authority), at cnil.fr.

Not to be confused with your workspace

This page covers this showcase website only. The data you entrust to your workspace, if you become a client, falls under a separate framework described in the contract between us, which includes the logging of each access on our side and the option to export your data at any time.

Changes

This page describes the website's actual set-up on the date of its last update. If an analytics tool were ever added, this page would be updated at the same time.