Privacy policy

Data controller

The controller of your personal data is CORTENYS SAS, a simplified joint-stock company under French law (société par actions simplifiée), with its registered office at 26 allée Circulaire, 93600 Aulnay-sous-Bois, France.

• General contact: contact@cortenys.com
• Data protection contact: contact@cortenys.com

Personal data we process

Depending on how you use the site, we may process identity and contact details, account data, order details, payment-related information, messages sent to our customer service team and the technical data needed to keep the service secure.

Purposes and legal bases

We process your data in order to respond to your enquiries, manage your customer account, fulfil your orders, handle your payments, provide customer service, keep the site secure and comply with our legal and accounting obligations.

As CORTENYS is established in France, this processing is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR). The UK GDPR and the Data Protection Act 2018 also apply if you are in the United Kingdom, and the Swiss Federal Act on Data Protection (FADP) if you are in Switzerland.

Depending on the circumstances, the processing is based on one of the following legal bases under the GDPR and, where applicable, the UK GDPR: the performance of a contract with you or pre-contractual steps taken at your request (Article 6(1)(b)), the legitimate interests of CORTENYS (Article 6(1)(f)), compliance with a legal obligation (Article 6(1)(c)) or, where the law requires it, your consent (Article 6(1)(a)).

The legitimate interests pursued by CORTENYS relate in particular to the security of the site and the service.

Recipients and processors

Your data can be accessed by authorised internal teams and by certain processors whose involvement is strictly necessary to operate the service.

• Supabase: authentication and application data
• Stripe: payment processing
• Resend: sending transactional and contact emails
• OpenAI: chat assistant on the site
• Google OAuth: sign-in with a Google account
• Vercel: hosting and delivery infrastructure for the site
• Meta Platforms Ireland Limited and Google Ireland Limited: advertising measurement and YouTube content, only with your prior consent

Transfers outside the European Union

Some providers may process data outside the European Union, in particular in the United States, or make data accessible there. Where necessary, these transfers are covered by an appropriate mechanism, such as standard contractual clauses, a data transfer addendum or another legally valid mechanism specified by the provider concerned (Articles 44 et seq. GDPR and, where applicable, Chapter V of the UK GDPR and Article 16 FADP). You may request information about these mechanisms and, where applicable, a copy of them by writing to contact@cortenys.com.

Retention periods

Contact requests are kept for 3 years after the last relevant contact.

Customer account data are kept for the life of the account and then for 3 years after its deletion or the last activity on it, unless the law requires otherwise.

Invoices and accounting records are kept for 10 years, in accordance with applicable legal obligations.

Security logs and data used to limit the frequency of requests (rate limiting) are kept for 6 months.

Conversations with the chat assistant are not stored by CORTENYS.

Your rights

You have, in particular, the rights of access, rectification and erasure, the right to restriction of processing, the right to object and, where applicable, the right to data portability (Articles 15 to 18, 20 and 21 GDPR). If you are in the United Kingdom, the UK GDPR gives you the same rights; if you are in Switzerland, you also have the rights provided by the FADP, in particular the right to information (Article 25 FADP) and the right to data portability (Article 28 FADP). You can exercise your rights, or send us a complaint about how we use your data, by writing to contact@cortenys.com.

Where we process your data on the basis of our legitimate interests, you may object to that processing at any time on grounds relating to your particular situation (Article 21(1) GDPR).

You may withdraw your consent at any time, for example by using “Manage cookies” in the footer of the site. Withdrawing consent does not affect the lawfulness of processing based on that consent before its withdrawal (Article 7(3) GDPR).

If you believe that the processing of your data infringes the GDPR or that your rights have not been respected, you may lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement (Article 77 GDPR). In Ireland, this is the Data Protection Commission (DPC); in Luxembourg, the Commission nationale pour la protection des données (CNPD). As CORTENYS is established in France, its lead supervisory authority is the CNIL (Commission nationale de l’informatique et des libertés), with which you may also lodge a complaint.

If you are in the United Kingdom, you may also lodge a complaint with the Information Commission, known as the ICO (section 165 of the Data Protection Act 2018). If you are in Switzerland, you may also file a report with the Federal Data Protection and Information Commissioner, the FDPIC (Article 49 FADP).