Privacy policy

Data controller

The data controller is VN Conseil SAS, a French simplified joint-stock company registered with the Créteil RCS under SIREN 987 514 361, with its registered office at 4 rue de Budapest, 94140 Alfortville.

Given the size of the company and the nature of the processing carried out, VN Conseil is not required to appoint a Data Protection Officer (DPO) under article 37 of the GDPR. Any data protection question can be sent to contact@vn-conseil.com.

Personal data collected

The personal data collected via the site is the data you voluntarily provide, by filling in the contact form available on the /contact :

• First and last name
• Email address
• Phone number (optional)
• Company name (optional)
• Practice concerned and package considered (optional)
• Free-text content of your message
• If you ask for a simulator result by email: your email address and the content of the simulation (inputs entered and results displayed)

No sensitive data within the meaning of article 9 of the GDPR (health, political or religious opinions, etc.) is collected. No advertising tracker or profiling is used. Without your consent, browsing generates no automatic collection other than technical server logs (IP address, timestamp, URL called, user-agent), retained for security and fraud prevention purposes. If you accept analytics cookies via the banner shown on your first visit, Microsoft Clarity also records your browsing on the site: pages viewed, clicks, scrolling and mouse movements, device and browser type, approximate country, as well as session recordings and heatmaps. Sensitive input fields (such as email addresses) are masked before anything is sent to Clarity.

Purposes and legal bases

Only audience measurement (Microsoft Clarity) is based on your consent: Clarity is loaded only after you click "Accept" in the cookie banner, and you can withdraw your consent at any time via the "Manage cookies" link at the bottom of every page, as easily as you gave it. Declining has no effect on access to the site and its simulators. The acceptance boxes on forms (contact, emailing a result) are a transparency formality reminding you of the processing terms, not a revocable prior consent.

Retention periods

• Prospects with no follow-up: data from a visitor who made contact but did not become a client is retained for 3 years from the last meaningful exchange, in line with CNIL recommendations on commercial prospection.
• Clients: contractual data is retained for 5 years from the end of the contractual relationship (civil limitation period applicable to commercial contracts).
• Accounting documents and invoices: 10 years in accordance with article L. 123-22 of the French Commercial Code.
• Audience measurement (Microsoft Clarity): your choice (accepted or declined) is stored for 6 months in your browser, then asked again. Clarity cookies last at most 12 months (_clck) and one day (_clsk). At Clarity, session recordings are kept for 30 days and aggregated data (heatmaps, statistics) for 13 months.
• Technical site access logs: maximum 12 months, in accordance with article L. 34-1 of the French Post and Electronic Communications Code.

Data recipients

The data collected is accessible only to VN Conseil partners and collaborators who need it to respond to your request, strictly within the scope of their duties.

The following technical providers act on behalf of VN Conseil:

• Microsoft Ireland Operations Limited (Microsoft Azure) - site hosting and data storage. Data centre located in the European Union (Westeurope region - Netherlands). Microsoft is certified ISO 27001, 27017, 27018 and SOC 2.
• Microsoft Ireland Operations Limited (Microsoft 365 / Exchange Online) - routing of emails between the site and our professional mailboxes.
• Microsoft Corporation (Microsoft Clarity) - audience measurement, only if you have accepted it. Microsoft undertakes not to use this data for advertising on behalf of VN Conseil.

No data is sold, rented or transferred to third parties for commercial purposes. Your data may be transmitted to the competent authorities in the event of a legally founded judicial or administrative requisition.

Transfers outside the European Union

The Azure servers used by VN Conseil are located in the European Union. No transfer to a third country is made as part of routine hosting and processing. Microsoft, as an international group, may occasionally need to access certain data for technical support purposes from a third country, under appropriate safeguards (standard contractual clauses adopted by the European Commission). If you accept audience measurement, the data collected by Microsoft Clarity is processed in the United States by Microsoft Corporation, certified under the EU-US Data Privacy Framework recognised by the European Commission adequacy decision of 10 July 2023.

Security

The site is exposed exclusively over HTTPS (TLS 1.2 or above). Lead submission to our professional mailboxes is performed via the Microsoft Graph API using an Azure managed identity, with no secret stored in clear. Access to data is restricted by state-of-the-art authentication and authorisation controls.

Your rights

Under articles 15 to 22 of the GDPR and the French Data Protection Act as amended, you have the following rights regarding your data:

• Right of access: obtain confirmation that your data is being processed and obtain a copy.
• Right of rectification: have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten"): obtain the deletion of your data, within the limits allowed by law (in particular accounting retention obligations).
• Right to restriction: suspend the processing of your data in certain situations.
• Right to portability: retrieve your data in a structured, machine-readable format.
• Right to object: object, on grounds relating to your particular situation, to processing based on our legitimate interest.
• Right to issue post-mortem directives: organise the fate of your data after your death.

To exercise these rights, send an email to contact@vn-conseil.com specifying your request and attaching, if necessary, proof of identity. We commit to respond within one month from receipt of your request.

If you consider that your rights are not respected, you have the right to lodge a complaint with the CNIL: cnil.fr/fr/plaintes.

Updates to this policy

This policy may be updated to reflect changes in our practices, our processors or applicable regulation. The current version is always available at https://www.vn-conseil.com/en/politique-confidentialite. The last update date is shown at the top of the page.