This policy explains how CASTEX ("Castex", "we") handles personal data when you visit castex.online, contact us or work with us. It is written to meet the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés).
1. Who is responsible for your data
The data controller is:
CASTEX
12 Rue Jean de Beauvais, 75005 Paris, France
SIREN 908 200 207
Email: [email protected]
We have not appointed a data protection officer, as we are not required to. Every question about your data can be sent to [email protected].
2. Data we collect
When you send a message
Through the enquiry forms or by email we receive your full name, email address, company name if you give it, the project type you select, the content of your message and the page it was sent from. We also record that you confirmed reading this policy, with the date and time.
When you visit the website
Like any web server, the server hosting this site receives technical data with each request: IP address, date and time, requested address, browser and operating system details, and the referring page. These are recorded in server logs used for security and troubleshooting.
To block automated spam, the form handler stores a one-way hash of your IP address with the times of recent submissions. The original address cannot be read back from the hash, and the records are deleted after 24 hours at the latest.
When we work together
For clients and prospects we keep the business contact details of the people we deal with, correspondence, proposals, contracts and invoices.
We do not collect special categories of data, such as health information, through this website, and we ask you not to include them in messages.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR article 6) |
|---|---|
| Replying to your enquiry and sending you a copy of your message | Steps taken at your request before entering into a contract (6.1.b) |
| Preparing proposals, performing and invoicing a project | Performance of a contract (6.1.b) |
| Keeping accounting and tax records | Legal obligation (6.1.c) |
| Protecting the site against abuse, spam and attacks; server logs | Our legitimate interest in keeping the service secure (6.1.f) |
| Handling legal claims | Our legitimate interest in establishing or defending legal claims (6.1.f) |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means, including profiling.
4. How long we keep it
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a project | 3 years from our last contact with you |
| Client contracts and correspondence | For the duration of the relationship, then 5 years (limitation period for commercial claims) |
| Invoices and accounting documents | 10 years from the end of the financial year (French Commercial Code, article L123-22) |
| Anti-spam records (hashed IP address) | Up to 24 hours |
| Server logs | No longer than 12 months |
When a period ends, the data is deleted or irreversibly anonymised.
5. Who receives your data
Only the people at Castex who need it to answer you or run a project can access your data. It is also processed by service providers acting on our instructions under data processing terms that meet article 28 of the GDPR:
- our web hosting provider, which runs the server for this site;
- our email provider, which delivers and stores messages sent to our address.
We may also share data with our accountants and legal advisers, who are bound by professional secrecy, and with public authorities when the law requires it.
6. Transfers outside the European Economic Area
We aim to keep data within the European Economic Area. If a provider processes data outside it, the transfer relies on an adequacy decision of the European Commission or on the Standard Contractual Clauses adopted by the Commission, with additional safeguards where needed. You can ask us for a copy of these safeguards.
7. Security
The site is served over an encrypted HTTPS connection. The form handler validates all input, stores no message content on the web server and keeps its technical records in a directory that cannot be accessed from the web. Access to our mailboxes and systems is limited and protected by strong authentication.
8. Your rights
Under the GDPR and French law you have the right to:
- access your data and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- object to processing based on our legitimate interest;
- receive data you provided in a portable format, where processing is based on a contract;
- set instructions about what happens to your data after your death (article 85 of the French Data Protection Act).
To exercise a right, write to [email protected] or to our postal address. We reply within one month. This can be extended by two further months for complex requests, in which case we tell you why. If we have reasonable doubts about your identity, we may ask for information to confirm it.
9. Complaints
If you believe we have not handled your data properly, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the French data protection authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr
If you live in another EU country, you can also contact the supervisory authority there.
10. Cookies
How this site uses cookies and similar technologies is explained in our cookie policy.
11. Children
Our services are intended for businesses. We do not knowingly collect data from children under 15, the age of digital consent in France.
12. Apps we publish
This policy covers the website and our business relationships. It does not cover the mobile apps we publish; information about data processing in an app is provided with that app.
13. Changes to this policy
We update this policy when our practices or the law change. The date at the top shows the latest version. Significant changes affecting clients are also communicated to them directly.