Privacy policy
This English version is a translation provided for information only. The French version is the authoritative text and prevails in the event of any discrepancy.
This page explains which personal data we process, why, on what legal basis, for how long, with whom it is shared, and how to exercise your rights.
Who is responsible for your data
The data controller is Protocol Safe, 47 rue Vivienne, 75002 Paris. For any question about your data: contact@protocol-safe.fr.
What we process, and why
Keeping the site secure and running properly
Data processed: IP address, date and time, requested page and browser used (User-Agent), written to the server’s technical logs.
Legal basis: the legitimate interests of the publisher (GDPR, Art. 6(1)(f)). The legitimate interest pursued is: detecting and blocking abusive access.
Retention period: 30 days, then deleted.
Answering your contact request
Data processed: name, email address, message and, if you provide them, company, phone and country.
Legal basis: the legitimate interests of the publisher (GDPR, Art. 6(1)(f)). The legitimate interest pursued is: answering the people who write to us.
Retention period: the time needed to handle your request, then at most 3 years from our last exchange; the sending log (recipient, date, status) is deleted after 30 days.
Recipients: Hermes, our in-house sending service, hosted on our own server: it erases the message content as soon as the email is delivered and keeps only a sending log; then our contact mailbox, where the request arrives by email. An acknowledgement is sent to you, quoting only your name.
Protecting the contact form against abusive submissions
Data processed: IP address.
Legal basis: the legitimate interests of the publisher (GDPR, Art. 6(1)(f)). The legitimate interest pursued is: preventing the form from being used to flood our mailbox or a third party’s.
Retention period: 10 minutes, in memory only.
Signing you up for the Callisto or SacNouVend beta, if you follow the link to its sign-up form
Data processed: the answers you enter in the sign-up form.
Legal basis: your consent (GDPR, Art. 6(1)(a)).
Retention period: until the beta opens, then at most 3 years without further exchange on your part.
Recipients: Tally, which hosts the form.
Who your data is shared with
Your data is disclosed only to the persons who need it for the purposes above, and to our processors, who process it on our behalf and in accordance with our instructions.
IONOS — website hosting and email delivery (European Union).
Tally — sign-up forms for the Callisto and SacNouVend betas (Belgium (European Union)).
Transfers outside the European Union
Your data is not transferred outside the European Union.
Your rights
You may request access to your data, its rectification or erasure, or the restriction of its processing, and you may object to its processing. You may also request to receive it in a machine-readable format (data portability), where the processing is based on your consent or on a contract.
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before its withdrawal.
You may also set out instructions regarding what happens to your data after your death.
To exercise these rights: contact@protocol-safe.fr. We respond within one month, which may be extended by two months if the request is complex; we may ask you to prove your identity.
If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Mandatory data
Data marked as mandatory in our forms is necessary to provide the service requested: without it, we cannot provide that service. Other data is optional.
Automated decisions
No decision producing legal effects concerning you, or similarly significantly affecting you, is based solely on automated processing.
Updates
This policy has been in force since 13 October 2026. We may amend it; the version published online is the one that applies.