This policy explains what personal data DataFish collects through this website, why, how long it is kept and how to exercise your rights.
1. Data controller
DATAFISH, Paris Trade and Companies Register 994 392 199.
Contact: contact@datafish.info.
DataFish has not appointed a data protection officer. For any question about your data, write to contact@datafish.info.
2. What we collect, and why
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| You book a call | Name, email address, selected time slot and the information you enter in the booking form; where applicable, the campaign your visit came from | Organise and prepare the call, contact you about your request | Pre-contractual steps taken at your request | 3 years from our last exchange, unless you become a client |
| You write to us or call us | Name, email address, phone number, content of your message | Answer your request | Our legitimate interest in answering requests sent to us | 3 years from our last exchange |
| You answer the pre-diagnosis on the Where are you today? page | Your answers to the chat questions, your email address and, if you enter them, your first name, company and phone number | Prepare your initial diagnosis, have it reviewed by our team, send it to you and contact you about it. The chat is provided by MaturIA, our diagnostic platform, which stores this data | Your consent (box ticked in the chat before sending) | Same period as diagnostics completed on MaturIA (see the MaturIA privacy policy) |
| You become a client | Business contact details, exchanges, contract and billing documents | Deliver the engagement, invoice, meet our accounting obligations | Performance of the contract and legal obligations | Duration of the relationship, then as long as required by law (10 years for accounting records) |
| You browse the website | IP address, date and time, pages viewed, browser type | Run and secure the website | Our legitimate interest in keeping the website secure | Short period set by our hosting provider |
| You accept visit tracking with HubSpot | Pages viewed, where the visit came from, identifiers stored in HubSpot's cookies; information entered in a form on the website (email address, company name) | See which pages are useful and where our visitors come from; store the information entered in a form in our contact management tool, so that we can contact you | Your consent, which you can withdraw at any time | Cookies kept for six months at most (see section 5) |
We do not sell your data. We do not use it for profiling or automated decision-making.
3. Who has access to your data
Your data is accessible to the DataFish partners who need it, and to the service providers who process it on our behalf:
- Vercel Inc., website hosting, United States;
- Calendly LLC, online booking, United States;
- Google LLC (Google Workspace), business email, United States;
- HubSpot, Inc., website visit tracking and contact management, if you have accepted it, United States.
These providers act on our instructions and are bound by confidentiality and security obligations.
Answers to the pre-diagnosis are stored in MaturIA, DataFish's diagnostic platform; its service providers are listed in the MaturIA privacy policy.
4. Transfers outside the European Union
Vercel, Calendly and Google are based in the United States. All three are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection (decision of 10 July 2023). Calendly also relies on the standard contractual clauses adopted by the European Commission.
If you accept visit tracking, the data collected by HubSpot may be transferred to and hosted in the United States. HubSpot, Inc. states that it is certified under the same Data Privacy Framework and relies on the standard contractual clauses, as set out in its privacy policy.
5. Cookies and trackers
Without your consent, this website sets no analytics or tracking cookies. The Calendly booking module is shown directly on the Contact page; on other pages, it is only loaded if you click a booking button.
Visits to the website are measured with Vercel Web Analytics, without cookies: the data is aggregated and anonymous. This measurement runs whether or not you accept the tracking described below.
With your consent, we also use the tracking code of HubSpot, a customer relationship management tool published by HubSpot, Inc. (United States), to see which pages are viewed and where our visitors come from. Nothing is loaded from HubSpot until you click "Accept" in the banner shown at the bottom of the screen. HubSpot then sets the following cookies:
__hstc: main visitor tracking cookie, kept for six months;hubspotutk: visitor identifier, kept for six months;__hssc: tracks the current session, kept for 30 minutes;__hssrc: used to tell whether the browser has been restarted, deleted at the end of the session.
Until you are identified, these visits remain anonymous. If you have accepted this tracking, the information you enter in a form on this website may also be sent to HubSpot when you click the submit button, and stored in our contact management tool. HubSpot may then attach the pages you have already viewed to your contact record, as it does when you click a link in an email sent with HubSpot. Without your consent, nothing is sent to HubSpot.
HubSpot states that it also uses certain data collected by its tracking code to improve its own products and services. Its servers may also set short-lived technical cookies (bot protection, rate limiting), which HubSpot classifies as necessary. Details are given in HubSpot's list of cookies.
Your choice, whether you accept or decline, is remembered for six months in your browser (local storage, no cookie), after which the banner is shown again. You can change your mind at any time with the "Manage cookies" link at the bottom of every page: if you withdraw your consent, HubSpot's code is no longer loaded and the cookies listed above are deleted from your browser.
To display its pages, however, your browser loads fonts from Google Fonts (Google), which receives your IP address in the process.
When the booking module is shown, it is provided by Calendly, which may set its own cookies. Calendly then presents its own choices, and its use of cookies is described in its privacy notice.
If you reached the website through a campaign link, the source parameters of that link (the "utm" parameters in the address) may be passed on to Calendly when you open the booking module, so that we know where the request comes from. This website does not store them on your device.
6. Your rights
You have the right to access, rectify and erase your data, to restrict its processing, to object, in particular to any commercial communication, to data portability, and to give instructions regarding your data after your death.
To exercise these rights, write to contact@datafish.info. We reply within one month. If we have reasonable doubts about your identity, we may ask you for proof.
If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
7. Security
Access to your data is limited to the people who need it. Our service providers are chosen for their security guarantees, and exchanges with the website are encrypted (HTTPS).
8. Changes to this policy
This policy may be updated. The version in force is the one published on this page.