Privacy policy

The controller

RETBA AI, 16 cours Albert 1er, 75008 Paris, France, registered under 933 650 418 R.C.S. Paris, is the controller of the processing described below. Questions go to cb@cdb.agency.

Data processed

Depending on the relationship, RETBA AI processes:

• for a site visitor: technical connection data held in server logs, including a truncated IP address, the date and the page viewed;
• for a site visitor, for audience measurement: the page viewed, the referring page, the type of browser and device, the country and page-load timings, which Cloudflare Web Analytics reports only as aggregate statistics;
• for a person who writes through the site's contact or consultation request forms: the information they enter, described in the section on those forms;
• for a doctrine-letter subscriber: the email address and the date of sign-up;
• for a client: identity, address, email, billing data and, without ever passing through our servers, payment data handled by Stripe;
• for a Narval user: account credentials, the password digest, the questions put to the software and the history of files produced;
• for a Founding Circle subscriber: their answers to the weekly software evaluation questionnaire;
• for a person under watch: publicly available information about them, the publications that target them and the analysis drawn from both.

Purposes and legal bases

• performing the subscription contract and opening access to the software, under article 6.1.b of the Regulation;
• keeping accounts and meeting tax obligations, under article 6.1.c;
• securing the service and preventing abuse, under the legitimate interest of article 6.1.f;
• measuring traffic to the cdb.agency site, under the same legitimate interest;
• fixing and developing the software from the beta evaluation questionnaires, under the same legitimate interest;
• sending the doctrine letter, under the consent of article 6.1.a, which may be withdrawn at any time;
• carrying out the watch requested by the client on the figures under watch, under the legitimate interest of the client and our own, weighed against the rights of the persons concerned.

Where data falls within the special categories of article 9 of the Regulation, such as a political opinion or a health fact made public, it is processed only to the extent that the person has manifestly made it public, or where processing is necessary for the establishment, exercise or defence of legal claims.

Recipients

Depending on the processing, data is disclosed to the following recipients, each for what falls within its task:

• the associates and analysts of RETBA AI, bound to secrecy;
• Cloudflare, Inc., for hosting the site, the application functions and the databases, and for measuring traffic to the site;
• Stripe Payments Europe, Ltd, for payment and invoicing;
• Resend, for email delivery;
• Google, whose Google Workspace service hosts the controller's email, including the cb@cdb.agency mailbox;
• the language-model providers that run the analyses, under contracts forbidding training on the data sent;
• open-source data providers and the specialist provider that measures the exposure of an identifier in leaks, all bound by confidentiality agreements;
• judicial or administrative authorities, on a proper request.

No data is sold or transferred for marketing purposes.

Transfers outside the European Union

Hosting of the site, the software and the email, audience measurement, payment, email delivery and the running of analyses may involve a transfer to the United States. Such transfers rely on the European Commission's standard contractual clauses and, where applicable, on the recipient's certification under the EU-US Data Privacy Framework.

Retention periods

• technical logs: twelve months;
• requests received through the site's forms: no more than twenty-four months from receipt, an automatic daily erasure removing those that have reached that period; any copy received by email is kept in the controller's mailbox for no longer than the same period;
• pseudonymised fingerprint of the IP address, used to limit form submissions and attempts to sign in to the Narval software: no more than twenty-four hours;
• answers to evaluation questionnaires: three years;
• client account and file history: the term of the subscription, then twelve months;
• timestamped exhibits: five years, so that they remain available in the event of a dispute;
• accounting records and contracts: ten years, under the French Commercial Code;
• address on the doctrine letter: until consent is withdrawn, then three years.

Security

Passwords are stored as PBKDF2-derived digests. Sessions are signed and expire after twelve hours. Client accounts are partitioned, firm access is separate and separately revocable, and traffic runs over HTTPS.

Cookies and other trackers

The cdb.agency site sets no cookie and writes nothing to the browser's storage. Its traffic is measured by Cloudflare Web Analytics, a service provided by its host, Cloudflare, Inc.

RETBA AI considers that this measurement meets the conditions of the consent exemption that the Commission nationale de l'informatique et des libertés grants to audience measurement tools: its purpose is strictly limited to measuring traffic to the site; it produces only aggregated statistics; RETBA AI does not combine them with any other processing and does not use them to follow the visitor from one site to another; according to its provider, the tool places neither a cookie nor any other data on the visitor's device. That is why the site displays no consent banner.

The Narval software, reached at narval.cdb.agency, sets two cookies:

• nv_session, which keeps the user signed in and expires after twelve hours;
• nv_langue, which remembers the screen language for twelve months.

It also keeps interface preferences in the browser's storage: the display theme, the language, a note that the getting-started guide has already been seen and the account's type of access, as well as, for the length of a visit, the postponement of the evaluation questionnaire. None of these is used for audience measurement or advertising.

These cookies and stored items are strictly necessary for the service the user requests or for keeping their interface choices. On that ground they are exempt from consent under article 82 of the French law of 6 January 1978 and the guidelines of the Commission nationale de l'informatique et des libertés on cookies and other trackers. That is why the software does not display a consent banner either.

Contact and consultation request forms

The contact and consultation request forms of the cdb.agency site are received and kept by the Narval software, under the responsibility of RETBA AI.

They collect the name, the email address, the organisation where given, and the message. The consultation request also collects the segment, the main challenges, the objectives, the desired timeline and the budget range given. The type of request, the language of the page, the site from which the form was sent and the date of receipt are added. The IP address is not recorded. To limit abusive submissions, a pseudonymised fingerprint of it, computed with a secret key, is kept for no more than twenty-four hours, separately from the request.

This data is used to answer the request and, where the request concerns a service, to prepare the contractual relationship. In that case the processing rests on steps taken at the person's request prior to entering into a contract (article 6.1.b of the Regulation) and, in other cases, on RETBA AI's legitimate interest in answering those who write to it (article 6.1.f).

It is disclosed to the controller and to its providers: Cloudflare, Inc., which hosts the software and its database; Resend, an email delivery service through which a copy of the request may be sent to the controller's mailbox; Google, whose Google Workspace service hosts that mailbox (cb@cdb.agency). These providers may process the data in the United States, on the terms described in the section on transfers.

Requests are kept for no more than twenty-four months from receipt: an automatic erasure, run every day, removes those that have reached that period. Any copy received by email is kept in the controller's mailbox for no longer than the same period.

The person who wrote exercises the rights described below by writing to cb@cdb.agency.

Persons under watch

A person whose name is under watch keeps all of their rights. No decision producing legal effects concerning them is taken on automated processing alone: every analysis is read by an analyst before it reaches the client.

Any request sent to cb@cdb.agency is handled, and passed to the client acting as controller where the request concerns that client.

Rights

Everyone has the right of access, rectification, erasure, restriction, objection and portability, and the right to give directions on what becomes of their data after death.

These rights are exercised at cb@cdb.agency. We answer within one month, extended to three months where the request is complex. A complaint may be lodged with the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.