Privacy policy

1. Data controller

The data controller is Cardynal, a simplified joint-stock company (SAS) under French law trading as 972.agency, whose registered office is at 142 rue de Rivoli, 75001 Paris, France, registered with the Paris trade register under number 107 620 767.

For any question about your data: hello@972.agency, or by post to the registered office. No data protection officer has been appointed, that appointment not being mandatory given our processing; requests are handled directly by management.

2. Data collected and its origin

We collect only the data you send us voluntarily:

• Booking a call: when you reserve a slot, your name, phone number, email address and the information you enter in the form are recorded directly in our own sales-tracking tool, hosted by us. No third-party booking service is involved.
• Direct exchanges: if you call, write or contact us via WhatsApp, the information you choose to send us on that occasion.
• Client relationship: the data needed to prepare the quote, to invoice and to follow the project (business contact details, company information, billing data).
• Technical data: connection data strictly necessary for the operation, security and logging of the site (IP address, timestamp), processed by our host.
• Analytics: page viewed, referring page, device type, browser, language and country. This measurement uses no cookie and does not keep your IP address: it is used only to compute, through a non-reversible hash renewed regularly, a visit identifier that allows neither recognising you from one day to the next nor following you from one site to another.

No sensitive data within the meaning of article 9 of the GDPR is collected. No profiling and no automated decision producing legal effects is carried out. We do no targeted advertising and we neither sell nor rent any data.

3. Purposes and legal bases

• Answering your request and preparing a quote — legal basis: pre-contractual measures taken at your request (art. 6(1)(b) GDPR).
• Performing and following the service ordered — legal basis: performance of the contract (art. 6(1)(b)).
• Operation and security of the site — legal basis: legitimate interest in protecting our infrastructure (art. 6(1)(f)).
• Project previews and non-essential trackers — legal basis: your consent (art. 6(1)(a)), withdrawable at any time.
• Accounting and tax obligations — legal basis: legal obligation (art. 6(1)(c)).

4. Recipients and processors

Your data is accessible only to authorised staff within Cardynal, and to the technical providers acting on our behalf:

• No booking provider: the form and the calendar are ours, and the data stays in our own sales-tracking tool.
• Meta Platforms Ireland Ltd. — only if you choose to write to us via WhatsApp, in which case the conversation is governed by that service's privacy policy.
• Railway Corporation — hosting of the site.

Each of these providers is bound by a contract compliant with article 28 of the GDPR. No data is passed to third parties for commercial purposes. Your data may be disclosed to administrative or judicial authorities where the law requires it.

5. Transfers outside the European Union

Our host (Railway Corporation) is established in the United States. In addition, part of our team works from our Jerusalem office in Israel: that country benefits from an adequacy decision of the European Commission, so that such access does not constitute a transfer requiring additional safeguards.

Transfers to the United States are framed by the appropriate safeguards provided for in chapter V of the GDPR (European Commission standard contractual clauses and/or certification under the EU–US Data Privacy Framework). A copy of those safeguards can be obtained on request to hello@972.agency.

6. Retention periods

• Contact requests with no follow-up: 3 years from the last contact.
• Booking requests: 12 months.
• Client relationship data: for the duration of the relationship, then 5 years (ordinary limitation period, art. 2224 of the French civil code).
• Accounting records and invoices: 10 years (art. L123-22 of the French commercial code).
• Technical logs: 12 months at most.
• Traffic statistics: 13 months at most, in line with the CNIL recommendation.
• Proof of cookie consent: 6 months, after which the banner reappears.

7. Cookies and trackers

The site places cookies and local storage strictly necessary for it to work and to remember your consent choice. In accordance with article 82 of the French Data Protection Act, they do not require your agreement.

Booking a call places no third-party cookie: the form is ours. Consent concerns only the project previews: when you open one, the site concerned is displayed in a frame and, for some of them, may place its own trackers — those load only after your agreement. Declining has no consequence for your access to the site. No advertising cookie and no third-party social network is used.

Traffic is measured with Umami, a solution we host ourselves on our own servers: the data is passed to no ad network and no third party. It places no cookie, keeps no IP address and allows no cross-site tracking. On that basis it falls within the analytics exempted from consent by the CNIL, and is not subject to the banner.

You can change your choice at any time, as easily as you gave it, with the button below.

8. Security

We implement appropriate technical and organisational measures: encryption in transit (HTTPS), restricted and authenticated access, hosting in professional data centres, logging and regular security updates.

9. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time and to give directions about what happens to your data after your death.

To exercise them, write to hello@972.agency or to 142 rue de Rivoli, 75001 Paris, France. We answer within one month, extendable by two months for complex requests. Proof of identity may be requested where there is reasonable doubt about the identity of the person making the request.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.