Privacy policy - Simon Boisset

This policy explains which personal data is processed when you visit simonboisset.com or contact us, why, and how to exercise your rights. It applies under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.

Data controller and contact

Lezo, with its registered office at 21 boulevard Auguste Pageot, 44000 Nantes, France, is responsible for the processing described here. Company details are given in the legal notice. For questions about your data, contact Simon Boisset at [email protected].

Email contact and correspondence

Data: name, email address, professional details and the content you provide.
Purpose: respond to your request and, where needed, prepare a proposal.
Legal basis: our legitimate interest in responding to requests and communicating with professional contacts (GDPR Article 6(1)(f)). Where you personally would be a party to the future contract, steps necessary to prepare it at your request rely on pre-contractual measures (Article 6(1)(b)).
Operation: email correspondence is received and stored in Google Workspace.
Retention: for a prospect without a contract, commercial data is kept in active use for no more than three years after collection or the last contact initiated by that person. A follow-up from us does not extend this period. Data that is no longer needed is deleted earlier.

When a contractual relationship begins, necessary data follows that relationship. Records needed for a legal obligation or to defend our rights are kept separately from commercial follow-up, with restricted access and for the period applicable to their category. Invoices and accounting records are kept for ten years from the end of the financial year. Residual copies in providers' backups follow their deletion cycles; deletion is not necessarily immediate after removal from active tools.

Your reply address and the information necessary to understand your request allow us to handle it; without them, we cannot provide a useful response. Additional details, including your company or telephone number, are optional. Please do not send sensitive data or access credentials.

Booking a call

Data: name, email, information you add when booking, date and details needed to arrange the appointment.
Purpose: arranging the discussion you ask for.
Legal basis: our legitimate interest in arranging discussions with professional contacts (article 6(1)(f)), or pre-contractual measures at your request where you personally will be a party to the contract (article 6(1)(b)).
How it works: booking takes place on Cal.com, an external service. The booking link does not transmit your name or email; you enter them directly on Cal.com. Appointments are managed with our Google Workspace calendar. Cal.com applies its own policy to cookies set on its site. Cal.com identifies mandatory fields; without them, the booking cannot be completed.
Retention: prospect-related data follows the period and exceptions described for contact requests, including copies in calendars and emails.

Audience measurement with consent

With your consent, PostHog measures page visits, traffic sources and clicks on contact links to Cal.com or our email. This helps us understand which content and channels lead to contact requests. The legal basis is your consent (GDPR Article 6(1)(a)).

Collection is limited to the event date, page, language, referring origin and domain, accepted campaign labels, the destination and position of clicked contact links, temporary pseudonymous visit identifiers, and the version of the information on which your consent was based. Page URLs are sent without query parameters or fragments, and referring sources without paths or query parameters. Contact events contain neither the full booking URL, your email address nor message contents.

There are no session recordings or automatic interaction capture. IP addresses are removed from incoming events in PostHog; the provider may nevertheless process technical data to deliver requests and protect its service.

No audience measurement event is sent without valid consent, after a refusal or withdrawal, or once the choice expires. ‘Manage analytics’ lets you change your choice; ‘Withdraw analytics consent’ stops collection in one click when it is active.

Audience retention and historical data

Analytics identifiers remain in memory during the visit, without persistent browser storage. They are renewed on a full reload and do not establish tracking from one visit to another.

Sent events and previous historical data remain hosted in PostHog's European instance. The current plan makes events available for analysis within a seven-year window; this window does not guarantee automatic physical deletion. Withdrawing consent stops future events and removes browser identifiers; it does not by itself erase events already received. You can request erasure of data concerning you at [email protected].

Retained historical data may include browsing, click, reading-time, source, language, browser and device data, pseudonymous identifiers and technical errors. New consent is requested for the limited measurement described here; previous approvals are not reused.

Security and technical logs

Website hosting and delivery services may generate logs containing IP addresses, dates, requested URLs and browser information. These support operation, security, abuse prevention and incident analysis, based on our legitimate interest in maintaining and protecting the service (Article 6(1)(f)).

Retention must be limited to the time needed for these purposes. Only records necessary for an incident or a legal obligation may be retained separately, with restricted access. Infrastructure log retention depends on the services and applicable rotation rules. It is distinct from contacts and historical PostHog data.

Cookies and browser storage

A preference cookie, exempt from consent, remembers your language for one year. Session storage restores your reading position during the browser session.

Your audience measurement choice, its date and the text version are stored locally. Both acceptance and refusal expire after six months (183 days), without extension on subsequent visits. This preference storage is not used to measure your browsing. You can change your choice through ‘Manage analytics’.

The website sets no advertising cookies or persistent analytics identifiers. Former PostHog identifiers are removed where the browser permits access. You can also delete cookies and storage through your browser settings. External services you visit, such as Cal.com, manage their own cookies.

Recipients and providers

Your data is intended for authorized people at Lezo and is not sold. The following providers are involved according to the processing activity:

OVH SAS (France): website hosting.
Cloudflare, Inc.: website delivery and protection, processing of requests and related technical data.
Google Workspace: receipt and storage of correspondence and calendar management.
Cal.com, Inc. (United States): booking and management of requested appointments.
PostHog, Inc. (United States, European instance): limited audience measurement with consent and previous historical data.

Locations and transfers

A service's region does not mean that all its operations, including support access and subprocessors, remain in that country. Cal.com states that it processes data in the United States; Google, Cloudflare and PostHog may also involve entities or providers outside the European Economic Area.

Providers' published processing terms and transfer safeguards are described in their agreements: OVHcloud, Cloudflare, Google Workspace, PostHog and Cal.com. These include standard contractual clauses or, depending on the entity and transfer concerned, an adequacy decision. You can ask [email protected] for details of safeguards applicable to your data and how to obtain a copy.

Your rights

Subject to the conditions in the GDPR, you can request access, rectification, erasure or restriction of the processing of your data. You can object to processing based on legitimate interest on grounds relating to your particular situation. Portability applies to automated processing based on consent or a contract. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can also set instructions regarding your data after your death.

To exercise your rights, email [email protected]. We respond within one month. This may be extended by two months because of the complexity or number of requests; we will inform you and explain the reasons within the first month. Proportionate identity verification may be needed where there is reasonable doubt.

You can lodge a complaint with the CNIL, the French data protection authority. No automated decision-making or profiling with legal or similarly significant effects concerning you takes place.

Changes

This policy may change when processing changes. The date of the last update is shown at the top of the page. A substantial change in the audience measurement scope will require updated information and, where necessary, renewed consent.

This English text is a practical translation. The French version prevails in case of discrepancy.