Privacy Policy

1. Who is responsible for your information

The organization responsible for the processing of your personal information (the "controller" under the GDPR) is:

Eclixia is not required to appoint a Data Protection Officer under article 37 of the GDPR. The person in charge of the protection of personal information (as required by Quebec Law 25) is the company's management, reachable at hello@eclixia.com. For any privacy question, this address is your single point of contact.

2. Personal information we collect

Eclixia collects only the information strictly needed to provide its services. It comes from two sources:

Information you give us

When you use our contact, brief or newsletter forms, we collect:

• First and last name: to identify your request
• Business or personal email address: to reply to you and, with your consent, send the newsletter
• Phone number: if you choose to provide it, so we can call you back
• Company name and industry: to qualify your project
• Description of your project or need: to handle your brief
• Calendar availability: to book a meeting through Cal.com

Information collected automatically

While you browse the site, we automatically collect:

• IP address: anonymized before any analysis (last octets masked)
• Pages visited, visit duration, referring pages: through Google Analytics 4 (anonymized)
• Browser type, operating system, screen resolution: technical analytics
• Ad clicks and conversions: with your consent, through Google Ads
• Performance data: through Plausible Analytics hosted on our own servers

We do not collect any sensitive information within the meaning of article 9 of the GDPR (health data, political opinions, ethnic origin, and so on).

3. Why we use your information, and on what legal basis

Under the GDPR, every use of personal information must rest on a legal basis. Under PIPEDA and Quebec Law 25, collection must serve identified purposes and, where required, rest on your consent. The table below covers both:

4. Commercial emails (CASL)

When we send commercial electronic messages to recipients in Canada, we comply with Canada's Anti-Spam Legislation (CASL):

• Consent: we send our newsletter and other marketing emails only with your express consent (for example, when you subscribe through a form) or where implied consent applies under CASL, such as an existing business relationship.
• Identification: every message clearly identifies Eclixia as the sender and includes our contact details.
• Unsubscribe: every message contains a working unsubscribe link. Opt-out requests take effect promptly and at no cost to you. You can also unsubscribe at any time by writing to hello@eclixia.com.

Replies to your own inquiries (contact form, brief, quote request) are transactional messages, not marketing, and are sent to answer your request.

5. How long we keep your information

We keep your information only as long as needed for the purposes it was collected for, within the limits set by the applicable rules:

Once these periods expire, your information is either deleted or irreversibly anonymized.

6. Who receives your information

Your information is handled by the Eclixia team as part of their duties. It may be shared with the following service providers, which Eclixia contractually requires to protect it in accordance with the GDPR:

We never sell your personal information, and we never use it for behavioural advertising without your prior, explicit consent.

7. Where your information is processed

If you browse this site from Canada, the information you provide is transferred to and processed in the European Union, where Eclixia and its hosting are located. Within the EU, it is protected by the GDPR, a framework whose protections are substantially similar to, and in several respects stronger than, those of PIPEDA and Quebec Law 25.

Some of our providers (Google Analytics 4, Google Ads) are based in the United States. Those transfers are governed by the Standard Contractual Clauses adopted by the European Commission (article 46 GDPR) and by the EU-US Data Privacy Framework. All other processing (hosting, our own analytics) takes place exclusively within the European Union.

For Quebec residents: this cross-border communication of personal information is disclosed here in accordance with Law 25. We have assessed that the frameworks described above provide adequate protection for the information concerned.

8. Automated decisions and profiling

Eclixia does not make any fully automated decisions about you within the meaning of article 22 of the GDPR or of Quebec Law 25, and does not profile you for targeted marketing without your explicit consent.

The audience measurement tools we use do not allow us to personally identify visitors to the site.

9. Your rights

Because our processing is governed by the GDPR (articles 15 to 22), you have the following rights over your personal information wherever you live, including in Canada. These rights cover, and in places go beyond, the access and correction rights granted by PIPEDA and Quebec Law 25:

• Right of access: obtain a copy of all the information we hold about you and details of how it is used.
• Right of rectification: have inaccurate, incomplete or outdated information corrected.
• Right to erasure: ask for your information to be deleted, subject to legal retention obligations.
• Right to restriction: ask for processing to be temporarily frozen in the cases provided by the GDPR.
• Right to portability: receive your information in a structured, commonly used, machine-readable format. Quebec Law 25 grants Quebec residents a similar right.
• Right to object: object at any time to the processing of your information, in particular for marketing purposes.
• Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Post-mortem instructions (French law): define instructions about what happens to your information after your death.

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with a supervisory authority:

• In France: the Commission Nationale de l'Informatique et des Libertés (CNIL), online at www.cnil.fr/fr/plaintes or by mail: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• In Canada: the Office of the Privacy Commissioner of Canada (OPC), www.priv.gc.ca
• In Quebec: the Commission d'accès à l'information du Québec (CAI), www.cai.gouv.qc.ca

10. Cookies

The Eclixia site uses cookies and similar trackers. For a full description of the cookies we set, what they do and how to manage your preferences, see our Cookie Policy.

In line with the guidance of the CNIL (deliberation 2020-091 of 17 September 2020) and with Quebec Law 25, your consent is collected before any cookie that is not strictly necessary for the site to work is set.

11. How we protect your information

Eclixia applies appropriate technical and organizational safeguards to protect your personal information against unauthorized access, disclosure, alteration or destruction:

• Communications encrypted over HTTPS (TLS 1.3)
• Restricted access to data, with strong authentication
• Encrypted passwords (Bcrypt or Argon2 hashing)
• Access logs and alerts on suspicious activity
• Regular security updates of systems and dependencies
• Encrypted backups with controlled retention

If a breach of personal information is likely to create a serious risk to your rights and freedoms, Eclixia will notify you as soon as possible, in accordance with article 34 of the GDPR and with the breach notification requirements of PIPEDA and Quebec Law 25.

12. Changes to this policy

Eclixia may update this privacy policy at any time, in particular to reflect regulatory changes or changes in how we handle information. The date of the latest revision appears at the top of this page.

If we make a substantial change, we will let you know by email or through a visible notice on the site.

13. Contact us

For any question about this policy or about your personal information:

• Email: hello@eclixia.com
• Phone: +33 4 37 65 32 37 (Monday to Friday, 9 a.m. to 6 p.m. Central European Time)
• Mail: Eclixia, 71 rue Michel Félizat, 69007 Lyon, France