Privacy — GDPR

Data controller

NOLAN SARL is the controller of the data collected on this site. For any request about your personal data: contact@nolan-sarl.fr.

Data collected

This site collects data only when you deliberately fill in the contact form. The fields submitted are:

• your name,
• your work email address,
• your company name (optional),
• the project type, engagement model and budget range you select,
• the message describing what you need.

When the form is submitted, your IP address is also processed, solely to limit abuse: it keys an in-memory counter that caps how many submissions an address can make per hour, and it appears in the server logs when a limit is reached or an automated submission is detected. The legal basis is our legitimate interest in protecting the form. That counter is kept for at most one hour and is never associated with the content of your message.

No account is created and no profile is built. Browsing the pages triggers no collection on our part; as on any site, the host's technical logs record the requests they receive.

Purpose and legal basis

This data is used solely to answer your request and, where relevant, to prepare a proposal. The legal basis is pre-contractual steps taken at your request — GDPR article 6(1)(b). We do not ask for your consent for this: answering a request you sent us does not need it, and a consent made mandatory in order to submit the form would not be freely given.

Protecting the form against automated submissions rests on a separate basis, our legitimate interest — article 6(1)(f). That is what your IP address is processed under, as described above.

Your data is never sold, rented, used for advertising, or passed to third parties for commercial purposes.

Recipients

Data is processed by NOLAN SARL. Two technical processors are involved, each bound by a processing agreement under GDPR article 28:

• Resend (Resend, Inc.), to deliver the message by email;
• the site’s hosting provider, named in the legal notice, for the server and database.

Your data reaches no other recipient. It is never sold, rented or used for advertising.

Transfer outside the European Union. Resend processes data in the United States. That transfer is covered by the European Commission’s Standard Contractual Clauses (module 2, controller to processor) and by Resend’s certification under the EU-U.S. Data Privacy Framework. Resend’s current sub-processors, all established in the United States, are listed at resend.com/legal/subprocessors.

Retention period

Your enquiry is not written to any database: it is delivered by email and kept in NOLAN SARL’s business mailbox. Enquiries that do not lead to a contract are deleted from it no later than three years after the last contact, in line with the CNIL’s guidance on business prospecting. Data tied to a contract is kept for the duration of the engagement and then for the statutory accounting retention period.

At Resend, which handles delivery, data is deleted within 90 days of the account being closed. The anti-abuse counter described above is kept for at most one hour.

Your rights

Under the General Data Protection Regulation you have the following rights:

• right of access to your data,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to object, including to processing based on our legitimate interest,
• right to data portability.

To exercise any of these, write to contact@nolan-sarl.fr. You will receive a reply within one month.

Security

The following measures protect the data submitted through the form, in line with GDPR article 32:

• the whole site is served over HTTPS, with HSTS enabled for one year;
• no enquiry is written to a database — the form’s content only passes through;
• submissions are capped per IP address and globally, to contain abuse;
• pages enforce a strict content security policy with a per-request token;
• viewing a page triggers no request to any third-party domain — typefaces are served from our own server;
• access to the admin interface is per-person and password-protected.

Cookies and analytics

The public part of this site sets no cookies. Typefaces are served from the site’s own server rather than a third party. The admin interface, used only by NOLAN SARL, sets a session cookie strictly necessary for authentication; it does not concern visitors and tracks no one.

Where audience measurement is enabled, it runs on Umami, hosted on our own infrastructure. Umami sets no cookie, creates no persistent identifier, does not retain your IP address and sends no data to any third party: the resulting statistics are strictly aggregated (page views, referrer, device type) and cannot identify you.

This measurement falls under the consent exemption the CNIL grants to statistics strictly necessary to operate and improve a site, so no consent banner is shown.

Complaints

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority: www.cnil.fr.