Privacy & Cookies Policy
Working draft — to be validated by management and legal counsel before publication (CDC §11.3). The retention period for contact form submissions (see §7) still needs to be precisely defined with the DPO.
1. Data controller
The controller for personal data processed on the nephyus.com website is NEPHYUS (see Legal Notice). For any question regarding your personal data: privacy@nephyus.com.
2. Data collected
This corporate site does not intentionally collect any sensitive personal data. The following data may be processed:
| Data | Source | Purpose | | ------------------------------------------------- | --------------------------------------- | ---------------------------------------- | | Name, email, message | Contact forms | Handling and responding to your request | | Subject of the request | Dedicated Contact form | Routing the request to the right contact | | Browsing data (pages visited, duration, referrer) | Audience measurement (if consent given) | Anonymized traffic statistics |
No identity verification (KYC) or authentication data is processed on this corporate site: such processing is handled by the dedicated NX· applications (e.g. NX·Verify, the app.nephyus.com portal), outside the scope of this site.
3. Legal basis and purposes
- Responding to contact requests: performance of pre-contractual steps or legitimate interest in responding to an inquiry.
- Audience measurement: user consent, collected via the cookie banner.
4. Data recipients
- Emails sent from contact forms are handled by Brevo (transactional email provider).
- The site is hosted by Nuxit (VPS).
- Audience measurement, when enabled with your consent, is handled by a self-hosted Matomo instance operated by NEPHYUS: browsing data is therefore not shared with a third-party advertising company and remains hosted on NEPHYUS's own infrastructure.
No data is sold or transferred to third parties for commercial purposes.
5. Transfers outside the European Union
As things stand, this corporate site does not transfer personal data outside the European Union. Should a third-party service involving such a transfer be added, this policy will be updated accordingly, with a description of the applicable safeguards (standard contractual clauses or equivalent).
6. Cookies
A consent banner is displayed on your first visit. It distinguishes:
- Cookies strictly necessary for the site to function (e.g. remembering your language choice and your consent), which do not require prior consent.
- Audience-measurement cookies (self-hosted Matomo), set only after your explicit consent.
You can change your choice at any time via the "Manage my cookies" link in the footer.
7. Retention period
- Contact form submissions: kept for 【period to be defined with the DPO, e.g. 3 years from the last contact】 for sales follow-up and anti-abuse purposes, unless a longer legal retention period applies.
- Audience-measurement data: kept for a maximum of 13 months, in line with CNIL recommendations.
8. Your rights
Under the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict, and object to the processing of your data, as well as the right to data portability and to define directives regarding your data after your death. You can exercise these rights by writing to privacy@nephyus.com. You also have the right to lodge a complaint with your national data protection authority (in France, the CNIL — www.cnil.fr).
9. Security
NEPHYUS implements reasonable technical and organizational measures (HTTP security headers, HTTPS transport encryption) to protect processed data against unauthorized access, loss, or alteration.
10. Contact
For any question regarding this policy: privacy@nephyus.com.