Privacy policy

The controller is the company that publishes this site, identified in full in the legal notice. It determines the purposes and means of the processing described below.

We have not appointed a data protection officer: none of the mandatory cases applies. Requests are handled by the publication director, who answers under his own name. ^§

It is shorter to start there. Every line below is verifiable in your browser's network tab.

• No cookie is placed on your device, by us or by anyone else. There is therefore no consent banner: there is nothing to consent to.
• No advertising tracker, no social network pixel, no ad network.
• No profiling, and no automated decision producing legal effects concerning you.
• No data is sold, rented or exchanged, to anyone, on any terms.
• No font and no image is loaded from a third-party server: fonts are self-hosted and subset. The only third-party script on the page is the audience measurement described below.

The absence of cookies is not a comfort argument: it changes which legal regime applies. It is precisely because nothing is written to or read from your device that the audience measurement on this site does not require prior consent. ^§

The form collects your first name, last name, organisation, email address, subject and the message you write. None of these fields is used for anything other than answering you.

Purpose: handling an inbound request and, where relevant, preparing a contractual relationship. Legal basis: steps taken at your request prior to entering into a contract. None of these fields feeds a CRM, a segmentation or a campaign. ^§

The form is delivered by EmailJS, a third-party provider that relays the message to our mailbox. From the moment it arrives, the message lives in our business mailbox and nowhere else. ^▪

You can always write to our email address directly and involve no third party at all. For anything you consider sensitive, that is the route we recommend.

Audience is measured with Plausible: page views, entry and exit pages, referrer, country, device type and browser. Measurements are aggregated at collection — no persistent identifier is created, nothing is written to your device, and none of it can identify you or recognise you from one visit to the next.

Purpose: knowing which pages are read and by which path, in order to decide what to write next. Legal basis: our legitimate interest in measuring the audience of our own site. That interest has been balanced against your rights; what tips the balance is that the measurement is non-identifying and writes nothing to your device. ^§

The service is operated by Plausible Insights OÜ, an Estonian company, and the measurements are hosted in the European Union. You can neutralise the measurement with your browser's tracking protection or a blocker: the site behaves identically, and we display no message trying to talk you out of it. ^▪

Like any site, this one is served by a server that technically processes the connection IP address and the user agent. We do not use those logs, we have no access to them, and we keep no copy.

While the site is served by GitHub Pages, those logs are held by a United States provider. That is the subject of decision D8, set out plainly in the legal notice. ^▪

We do not publish a generic list of recipient categories. Here are the only three third parties processing data on our behalf, what they see, and where they are established.

Two transfers are possible as things stand: the technical logs held by the current host, and the contact form relay. No other processing described here leaves the European Union.

The reference of the safeguards framing those transfers — standard contractual clauses or an equivalent mechanism — is ⟨reference of the transfer safeguards to be attached⟩. Writing that is less comfortable than copying a stock sentence; it is more accurate. ^§

A period we have not settled is written as such. An empty field can be fixed; a “three years” copied from a template never gets fixed, because nobody remembers where it came from. ^§

You have a right of access, rectification, erasure and restriction, a right to object to processing based on our legitimate interest, and a right to portability for data processed on the basis of a contract or consent only. ^§

These rights are exercised in writing at our email address, or by post to the registered office. We answer within one month of receipt, extendable by two months for a complex request — in which case we tell you, and we tell you why.

We may ask for something that lets us verify your identity where the request concerns data we cannot confidently link to you. That evidence is kept only for the time of the verification, and used for nothing else.

If our answer does not satisfy you, or if none comes, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. Lodging a complaint requires no prior step with us.

This policy carries a cut-off date. Any substantive change produces a new one, shown at the top of the page. We do not rewrite a policy silently, and we do not backdate a version.