Politique de Confidentialité — RGPD

Privacy Policy

Version 1.0 Last updated 12 May 2026 Regulation GDPR (EU) 2016/679

On this page

Data Controller
Scope & Definitions
What We Collect
Purposes & Legal Basis
Retention Periods
Recipients & Processors
International Transfers
Security Measures
Cookies & Tracking
Your Rights (GDPR)
Right to Lodge a Complaint
Updates to This Policy

Data Controller

The data controller responsible for processing your personal data under Article 4(7) of the GDPR is:

Entity: [Legal entity name]
Address: [Registered office — France]
Email: philippe.maquine@gmail.com
Contact for data requests: philippe.maquine@gmail.com

Given the limited scope of our processing activities, no Data Protection Officer (DPO) has been formally appointed. All data-related questions are handled directly by the management.

Scope & Definitions

This Privacy Policy describes how AAI Maquine collects, uses, stores, and protects personal data of visitors and prospective clients of the website aai-maquine.com.

For the purposes of this policy, "personal data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.

What We Collect

We follow the principle of data minimisation (Article 5(1)(c) GDPR): we only collect data that is strictly necessary for our stated purposes.

Category	Data Collected	Source
Contact Form	First name, last name, company name, email address, area of interest, free-text message	Provided by you
Email Correspondence	Email address, name, content of exchanges	Provided by you
Technical Logs	IP address, browser type, timestamps (kept by hosting provider for security/abuse prevention)	Automatically by host

We do not collect sensitive data (Article 9 GDPR), data concerning minors, financial data, or behavioural/profiling data.

Purposes & Legal Basis

Each processing activity is grounded in a specific legal basis under Article 6 of the GDPR:

Purpose	Legal Basis (Art. 6)
Respond to your enquiry and arrange a discovery call	Pre-contractual measures at your request — Art. 6(1)(b)
Send commercial proposals and execute consulting engagements	Performance of a contract — Art. 6(1)(b)
Comply with accounting, tax, and legal obligations	Legal obligation — Art. 6(1)(c)
Maintain security of the website and detect abuse	Legitimate interest — Art. 6(1)(f)
Send occasional follow-up emails to prospects	Consent — Art. 6(1)(a) — withdrawable at any time

Retention Periods

We retain personal data only for as long as necessary for the purposes for which it was collected, in accordance with Article 5(1)(e) of the GDPR:

Contact form / prospect data — 3 years from the last contact, then deleted or anonymised
Client contractual data — duration of the engagement plus 5 years (commercial prescription, Art. L.110-4 French Commercial Code)
Accounting records — 10 years (Art. L.123-22 French Commercial Code)
Technical/security logs — up to 12 months

Recipients & Processors

Your personal data is accessed only by the management of AAI Maquine. We do not sell, rent, or share your data with third parties for commercial purposes.

For strictly necessary technical operations, we rely on the following sub-processors (Article 28 GDPR), each bound by a data processing agreement:

Hosting provider — [Name, e.g. OVH / Vercel / Netlify] — stores the website and security logs
Email provider — [Name, e.g. Google Workspace / Proton] — routes and stores correspondence
Accountant — [If applicable] — for invoicing and statutory obligations

International Transfers

Where a sub-processor processes data outside the European Economic Area (EEA), such transfers are framed by appropriate safeguards under Chapter V of the GDPR — typically the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision (e.g. the EU–US Data Privacy Framework).

By default, we select providers operating within the EEA whenever feasible.

Security Measures

In accordance with Article 32 of the GDPR, AAI Maquine implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk:

TLS/HTTPS encryption of all data in transit
Strong authentication and access controls on internal systems
Restricted access to personal data on a strict need-to-know basis
Regular review of sub-processors and their security posture
Incident response procedure including notification within 72 hours where required (Art. 33 GDPR)

Cookies & Tracking

This website uses only strictly necessary technical cookies — used for the proper functioning of the site (e.g. preserving navigation state). These cookies are exempt from prior consent under Article 82 of the French Data Protection Act and CNIL guidelines.

We do not deploy:

Advertising or marketing trackers
Audience measurement / analytics tools that collect personal data
Social media tracking pixels
Cross-site profiling cookies

For this reason, no cookie consent banner is displayed. Should we introduce non-essential cookies in the future, a CNIL-compliant consent mechanism will be implemented prior to deployment.

Your Rights (GDPR)

Under Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) — obtain confirmation of processing and a copy of your data
Right to rectification (Art. 16) — correct inaccurate or incomplete data
Right to erasure (Art. 17) — request deletion ("right to be forgotten")
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format
Right to object (Art. 21) — including to processing based on legitimate interest or for direct marketing
Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior processing
Right to define post-mortem directives (Art. 85 of the French Data Protection Act)

To exercise any of these rights, contact us at philippe.maquine@gmail.com. We will respond within one month of receipt (Art. 12 GDPR), extendable by two months for complex requests. We may request reasonable proof of identity before acting on your request.

Right to Lodge a Complaint

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority — in particular, the French data protection authority:

Authority: Commission Nationale de l'Informatique et des Libertés (CNIL)
Address: 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France
Website: www.cnil.fr

Updates to This Policy

This Privacy Policy may be updated to reflect changes in our practices or legal requirements. The "Last updated" date at the top of the page indicates the most recent revision. Substantial changes will be notified through a visible notice on the website or by direct communication where appropriate.