Privacy Notice
This notice explains what personal data ACE-NSI Cybersecurity collects through this website, why we collect it, how long we keep it and the rights you have under the EU General Data Protection Regulation (GDPR) and French data protection law.
1. Who we are
ACE-NSI Cybersecurity is the trading name of ACENSI CYBER SECURITY, a French SARL providing cyber security advisory and managed services. For the purposes of data protection law we are the controller of the personal data described in this notice.
| Legal entity | ACENSI CYBER SECURITY, SARL, trading as ACE-NSI Cybersecurity |
|---|---|
| Registered office | 5 allées de Tourny, 33000 Bordeaux, France |
| Company number | RCS Bordeaux 824 302 608 |
| Data protection contact | Our contact form, or by post to the registered office |
| Data Protection Officer | We have not appointed a Data Protection Officer, as we are not required to. Please send any question about your data to the contact above. |
2. The personal data we collect
We collect only what we need for the purpose in question.
When you contact us or request a meeting
- First and last name, work email address, telephone number (optional), company name and job title
- The type of enquiry and its subject; for a meeting, your preferred format, date and time; for a partnership, your company's website and the kind of partnership you have in mind
- Anything you write in the message field
This website does not accept file uploads. Please do not include special category data (such as health, religious or political information) in your messages. If you do, we will treat it as provided voluntarily and delete it where it is not relevant.
With every form
- The page you sent the form from, the page's language, the date and time, and the wording of the box you ticked. These go to our CRM with your details. Your IP address is not sent to our CRM.
- To block spam, our form service keeps short-lived counters per IP address, stored only as a keyed hash, never the address itself. It does not keep anything you type.
When you use the website
- Technical data recorded in our host's server logs: IP address, browser type and version, pages requested, date and time, and referring page
- A setting stored in your browser if you pause the site's animations. See our Cookie Policy.
3. Why we use it, and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Responding to your enquiry and arranging meetings | Contact and enquiry data | Steps at your request prior to a contract (Art. 6(1)(b)); our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Blocking spam and abuse on our forms, and keeping this website secure | Hashed IP address, technical data | Our legitimate interest in operating a secure website (Art. 6(1)(f)) |
| Meeting accounting, tax and regulatory obligations if you become a client | Contract and billing data | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interest in running and growing a business-to-business security practice does not override your rights. You can object at any time (see Your rights).
4. Where the data comes from
Almost all of the personal data we hold comes directly from you. We may also obtain limited business contact details from public professional sources, such as a company website or LinkedIn, where we have a legitimate interest in contacting you in a professional capacity. If we do, we will tell you at first contact and give you an easy way to object.
5. Who we share it with
We do not sell personal data. We share it only with:
- Service providers acting on our instructions (processors), each bound by a written contract under GDPR Article 28: Infomaniak Network SA (Switzerland), which hosts this website and our form service; HubSpot (part of the HubSpot, Inc. group, United States), our customer relationship manager, which receives what you send through our forms and stores it in its EU data centre; and our email provider.
- Technology partners, where you have asked us to arrange a demonstration, trial or quotation with them. We ask for your agreement before passing your details on, and they act as separate controllers.
- Professional advisers (lawyers, accountants, auditors) where necessary.
- Authorities, where we are legally required to disclose.
6. International transfers
Infomaniak stores data in Switzerland, which the European Commission recognises as providing an adequate level of protection. Our HubSpot account stores data in the EU, but HubSpot, Inc. and its sub-processors may access it from the United States and other countries. Those transfers are covered, as applicable, by the EU-US Data Privacy Framework and by the European Commission's Standard Contractual Clauses in HubSpot's data processing agreement. If any other provider processes personal data outside the EEA, we rely on an adequacy decision, the Standard Contractual Clauses or another lawful mechanism. You can request a copy of the safeguards by contacting us.
7. How long we keep it
| Data | Retention period |
|---|---|
| Enquiries that do not become client relationships | 24 months from last contact |
| Client records, contracts and invoices | 10 years, as French commercial law requires for accounting records |
| Hashed IP counters used by the form spam check | They count only the last 10 minutes and are cleared automatically after about an hour |
| Website server logs | Kept by our host for a limited period, up to 12 months |
8. How we protect it
We apply technical and organisational measures appropriate to the risk, as required by GDPR Article 32. This website is served only over an encrypted connection (HTTPS). Our forms go through our own form service, which checks for spam without outside services, keeps nothing you type, and passes your details straight to our CRM. Access to our CRM and mailboxes is limited to the people who need it. No system is completely secure; if a personal data breach is likely to result in a risk to your rights, we will notify the CNIL within 72 hours and, where the risk is high, tell you directly.
9. Your rights
Subject to certain conditions, you have the right to:
- Access the personal data we hold about you, and receive a copy
- Rectify data that is inaccurate or incomplete
- Erase your data ("right to be forgotten")
- Restrict how we process it
- Object to processing based on legitimate interests, and to direct marketing at any time, with no reason needed
- Receive the data you gave us in a structured, machine-readable format (data portability)
- Withdraw consent at any time, without affecting processing already carried out
- Give instructions on what happens to your data after your death, as French law provides
To exercise any of these, use our contact form or write to us at our registered office. We will respond within one month, which we may extend by two further months for complex requests, telling you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive.
10. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to a supervisory authority in the country where you live, where you work, or where the issue occurred. Our lead supervisory authority is the CNIL (Commission nationale de l'informatique et des libertés, France), www.cnil.fr.
11. Cookies and similar technologies
We explain what this site stores in your browser, and how to control it, in our Cookie Policy.
12. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means alone, and we do not carry out profiling of that kind.
13. Changes to this notice
We review this notice regularly. When we make material changes we will update the version and date above and, where appropriate, tell you directly. Previous versions are available on request.