Privacy and cookies

Translation provided for information only; only the French version is authoritative.

Cookies

This website sets none. No audience measurement cookie, no advertising cookie, no social media cookie. That is why no banner asks for your consent: there is nothing to consent to.

The fonts are served from our own server. Nothing on this page calls a third-party domain to display: no social network, no ad network, no map, no video.

If you are signed in to your client area, this website only asks it for the email address to display in the header. The login cookie stays protected on the client area. This check does not extend your session.

A game is hidden in this website. If you engrave your initials in it, your best times are kept in your browser’s storage, and nowhere else: nothing is sent, neither to us nor to anyone. Nothing is written there before you engrave a first time; the following ones are then engraved under the same initials. The “Clear my times from this browser” button, at the end of a game, deletes them, initials included.

If you choose a language in the language selector, that choice is kept in your browser’s storage, so that the website opens in that language on your next visit. If you close the banner that offers the website in your browser’s language, that refusal is kept there too, so that the banner does not come back. Nothing is written there without one of these two actions, and nothing is sent, neither to us nor to anyone. They serve the display you asked for and are exempt from consent within the meaning of CNIL deliberation no. 2020-091. Clearing this website’s data in your browser deletes them.

On the contact page, your estimate choices, current step and preference for an email or a callback are kept in this tab’s session storage. This lets you resume after refreshing. This saved progress contains neither your name, email address, phone number nor message. It stays in your browser and is not sent to the server. Clearing this website’s data in your browser removes it.

We measure visits to this website with a tool that we host on our own servers, in France. It sets no cookie, keeps no identifier that would recognise you from one visit to the next, and passes nothing to a third party. The script is served from this domain and not from an external service. This measurement is used to know how many people come and which pages they read. On the contact page, it also counts the quiz questions answered, the kind of price shown (the website alone, with a feature, or quoted separately) and the next step chosen: totals, without your answers or anything you write. It is based on our legitimate interest in knowing whether this website does its job, Article 6(1)(f), and the absence of any tracker exempts it from consent within the meaning of CNIL deliberation no. 2020-091. These measurements are deleted after thirteen months.

What we collect

The contact form opens a conversation in your client area. What you write there is stored by us, on our server in France: your name, your email, your phone number if you leave one, your line of business, your town and your message. If you fill in the optional “Your project” section, it is stored there too: the type of project, what you are interested in, the address of your current website, the domain name you’d like, the timescale, the features, the website languages and how to reach you. The language of the page you write from goes with it, so that the acknowledgement reaches you in that language. If you use the “Your price in two minutes” quiz, your answers and the estimated price go with it, as does the name of the person or business that recommended us, if you give it: it is used for the referral scheme. The section, the answers and the language follow the rest of your request, both in how long they are kept and in who receives them. This processing is based on the steps you ask us to take before a possible contract, Article 6(1)(b) of the GDPR. You receive an acknowledgement, and you can follow the conversation and reply to us from your client area, with a code sent by email. There is no password.

If you ask for a call back, we record your number, the time slot chosen, and the date and time you ticked the agreement box: it is the proof of your request, kept with it. We call only that number, about that request, Monday to Friday between 10:00 and 20:00. Just tell us, by phone or at contact@nolitana.com, and we will stop calling.

Your client area account holds only your email address, your creation and last login dates, a fingerprint of the login code and of the session, never the code itself, the IP address at the time you request a code, and the websites you have access to. A code is valid for ten minutes, a session expires after 14 days without activity and 90 days at most, and the IP address is deleted after one day. This processing is based on the performance of the contract, Article 6(1)(b). The policy published on the client area repeats these periods word for word.

Your IP address is recorded at the time of submission, for one day. This is not audience measurement: it is used only to limit the number of requests a single machine can send, which protects the service and our clients’ mailboxes. This limit is based on our legitimate interest.

This information is used to reply to you. It is not sold, rented or passed to any third party, except where required by law. The acknowledgement and the notice that alerts us are sent through Resend, in the United States, which therefore sees everything you wrote in the form. This transfer is covered by the standard contractual clauses of the European Commission.

We also keep a file of the businesses we approach, with the name of the business, its line of business, its public business contact details and the date of our exchanges. These contact details come from public sources: your website, your shopfront or your online listing. This processing is based on our legitimate interest in offering our services to professionals whose trade is directly related to what we sell. A message to contact@nolitana.com is enough to be removed permanently, without having to give a reason: your record is deleted, and your address joins an opt-out list that we keep indefinitely, so that we never write to you again.

Recommendations. When someone signed up to recommend us, client or not, brings us a business that becomes a client, we keep who recommended whom, the date, and what each receives: the free month, then the discount or the sum for each month. Of the person signed up, we keep their name, email, phone number if they leave it, town, country, business number if they have one, the date they accepted the rule, then, from their first payment, their address, the account to pay them into, their statements and their invoices. Their sign-up, in the client area, opens a conversation there as the contact form does, and their personal link is shown there, then sent to them by email, through Resend. This processing is based on the performance of the rule they accepted, Article 6(1)(b), for as long as they are signed up and then 5 years, and 10 years for accounting documents. If they pass us your contact details, with your agreement, we handle them like those passed on by a business introducer, below. If you are the business they recommended, they read, on the statement we send them, the name of your business and what you have paid us: that is what lets them check what we owe them. This sharing is based on our legitimate interest in giving them an account they can check, Article 6(1)(f).

Business introducers. Independents, under contract with us, may recommend businesses to us. When one of them passes us a contact, we use it only for a first approach, saying where it came from; if nothing follows, it is deleted after one month. This processing is based on our legitimate interest, Article 6(1)(f), and you may object to it at any time.

How long

• A request that goes no further is deleted 12 months after the last message.
• A prospect record is deleted three years after the last contact from you.
• A contact passed on by a business introducer, with no follow-up, is deleted after one month.
• A request that becomes a client follows the contract, then the accounting and tax periods that apply to us, 10 years for invoices.

Server logs

Our servers keep no access logs, neither for this website nor for those we host. Connection data exists nonetheless, at Cloudflare, which relays our pages and sees the IP address of every visit: it is used for routing and protection against attacks, and falls under Cloudflare’s policy.

The administration panel, on the other hand, keeps a log, and it is the only one in our infrastructure. It records publications, because the law requires us to keep for one year the means of identifying who put content online and to hand it over to the judicial authority if it asks. It also records logins, successful and refused, because without them an intrusion attempt on a client’s website would leave no trace.

This log contains the date, the type of operation, the section changed and the connection address. It contains neither the login code, nor the session token, of which only an irreversible fingerprint is kept, nor the published content. It is deleted after one year and is not cross-referenced with any other file.

Where the data is, and who sees it

The servers are in France, at OVH, in its Strasbourg data centre. That is where the websites, the databases and the backups live.

Three providers are involved in addition. Cloudflare relays and caches our pages, and therefore sees the IP address of every visitor. Stripe will collect the subscriptions, none of which has been charged yet. These two are covered by the adequacy decision between the European Union and the United States of 10 July 2023. Resend, which sends the client area’s emails and those of a contact request, is covered by the standard contractual clauses of the European Commission. The full list, with the role of each, is on the our subprocessors page.

No one else. We neither sell nor rent any data, and we do not buy any either.

Your rights

You can ask for access to your data, its correction, its erasure, its portability, the restriction of its processing, or object to that processing. Write to contact@nolitana.com: we acknowledge receipt within 48 hours, on working days, and we give a full reply within one month, as the regulation provides. This period may be extended by two months for a complex request, in which case we tell you so within the first month, with the reason.

No decision concerning you is made by automated means. The quiz on the contact page applies fixed rules, the same for everyone, to estimate your price: it is an estimate, and what you take is decided with you. The price displayed is the same for everyone: it depends neither on your browsing nor on a profile.

If our reply does not satisfy you, you can refer the matter to the CNIL, the French data protection authority, www.cnil.fr, 3 place de Fontenoy, 75007 Paris.

Who is responsible

Amaury Poltavtseef EI, 30 rue Geoffroy L’Asnier, 75004 Paris, SIREN 923 057 293, registered with the Paris Trade and Companies Register (RCS). No data protection officer has been appointed: our activity falls under none of the three cases in which the regulation requires one. Your requests therefore come directly to contact@nolitana.com.

For the websites we host, the controller is our client, and we are its processor. A request concerning data collected by a business’s website is handled with that business, and we pass it on to them within two working days if it reaches us.