Legal information

[[EMAIL]]

This privacy policy aims to inform users of the site VERTIGO LAB (https://vertigolab.eu/) about the methods of collecting and processing their personal data, in accordance with the Regulation (EU) 2016/679 of April 27, 2016 (General Data Protection Regulation — GDPR) and the Law No. 78-17 of January 6, 1978 relating to data processing, files, and freedoms, as amended.

1. Data Controller

The data controller for personal data is:

• VERTIGO LAB
• Represented by Thomas BINET
• Address: 1510 route du Stade, Lieudit Pigaillon, 47700 ANZEX, France
• Email: https://www.ovhcloud.com

2. Personal Data Collected

In the context of using the site VERTIGO LAB and its services, the following categories of personal data may be collected:

• First and last name
• Email address
• SIRET and information related to the company

3. Purposes and Legal Bases for Processing

In accordance with Article 6 of the GDPR, each processing of personal data is based on a specific legal basis. The table below details the purposes, legal bases, and retention periods applicable:

4. Retention Periods

Personal data is retained for the strictly necessary duration for the purposes for which it is processed, as indicated in the table above. Beyond these periods, the data is deleted or anonymized irreversibly.

Certain data may be retained longer in case of legal obligation:

• Billing and accounting data: 10 years from the end of the fiscal year (Article L.123-22 of the Commercial Code);
• Contractual data: 5 years from the end of the contractual relationship (civil law prescription, Article 2224 of the Civil Code);
• Connection data (logs): 1 year (Decree No. 2011-219 of February 25, 2011).

5. Recipients of the Data

The personal data collected is intended for the data controller and, where applicable, its subcontractors acting on its behalf and according to its instructions, in strict compliance with the GDPR.

The subcontractors currently involved in data processing are:

• Address: [[NUM]] rue Kellermann, [[NUM]] Roubaix, France — hosting of the site and data
• Mailchimp — management and sending of newsletters
• Google LLC — audience measurement (Google Analytics), tag management (Google Tag Manager), and/or advertising (Google Ads)

Each subcontractor is bound by a processing contract in accordance with Article 28 of the GDPR, ensuring the security and confidentiality of the data processed on behalf of the data controller.

No personal data is transferred, sold, or exchanged for commercial purposes with third parties unrelated to the purposes described in this policy.

6. Data Security

The data controller implements all appropriate technical and organizational measures as defined in Article 32 of the GDPR to ensure the security, integrity, and confidentiality of personal data, and in particular to prevent them from being distorted, damaged, or accessed by unauthorized third parties.

The measures include:

• Encryption of data in transit (HTTPS / TLS protocol);
• Regular backups of data;
• Limiting access to data to authorized personnel only;
• Regular updates of software and security systems.

7. Your Rights

In accordance with Articles 15 to 22 of the GDPR and Articles 48 to 56 of the Data Protection Act, you have the following rights regarding your personal data:

• Right of access (article 15 GDPR): obtain confirmation that your data is being processed and receive a copy in a structured format;
• Right to rectification (article 16 GDPR): have any inaccurate or incomplete data concerning you corrected;
• Right to erasure (Article 17 GDPR): request the deletion of your data under the conditions set by the regulation;
• Right to restriction of processing (Article 18 GDPR): obtain the restriction of processing your data in certain cases provided by the GDPR;
• Right to object (Article 21 GDPR): object to the processing of your data for reasons related to your particular situation, or object to processing for commercial prospecting purposes;
• Right to data portability (Article 20 GDPR): receive the data you have provided in a structured, commonly used, and machine-readable format;
• Right to withdraw consent: withdraw your consent at any time for processing based on this legal basis, without affecting the lawfulness of processing carried out before the withdrawal;
• Right to set post-mortem directives: define directives regarding the retention, deletion, and communication of your data after your death (Article 85 of the Data Protection Act).

To exercise any of these rights, send your request along with proof of identity to:

• Email: https://www.ovhcloud.com
• Mail: VERTIGO LAB — 1510 route du Stade, Lieudit Pigaillon, 47700 ANZEX, France

The data controller commits to responding to your request within a maximum period of one month from its receipt, in accordance with Article 12.3 of the GDPR. This period may be extended by an additional two months in case of complexity of the request.

8. Complaint to the CNIL

If you believe, after contacting us, that your rights regarding your personal data are not being respected, you have the option to file a complaint with the National Commission for Information Technology and Freedoms (CNIL):

• Address: 3, place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07
• Phone: 01 53 73 22 22
• Website: www.cnil.fr