Legal Privacy policy

Privacy policy

This policy describes how NSY collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the French "Informatique et Libertés" Act.

Data controller

Company
NSY
Legal representative
Cédric Barme
SIREN
842 078 453
Address
8 Hameau de Poiseaux, 45130 Épieds-en-Beauce, France
Contact
Contact form

NSY is a single-member structure with no designated DPO (not required under article 37 of GDPR). Cédric Barme personally handles requests related to personal data.

Data collected

The nsy.fr website only collects data that you submit voluntarily via the contact form or the feasibility questionnaire:

  • Full name (required)
  • Business email (required)
  • Company (optional)
  • Phone (optional)
  • Service of interest (Technical consulting or Web creation · AI)
  • Project timeline
  • Description of your need (free text)
  • Feasibility questionnaire answers (project type, context, timeline — guided choices and free text)

No other data is collected. The website uses no tracking cookies, no third-party analytics (no Google Analytics, Matomo, Plausible, etc.), and no advertising tracking pixels. See the Cookies section below for details on the single functional cookie used (language preference).

Form protection (anti-bot and anti-spam)

To protect the forms against spam robots, the site relies on two mechanisms:

  • Cloudflare Turnstile — an anti-bot check displayed on the forms. The widget analyses technical signals from your browser (including the IP address) to tell humans and robots apart; it is operated by Cloudflare, Inc. The content of your message is never sent to it — only the verdict reaches us.
  • Server-side anti-spam screening — submissions are analysed automatically (content, and the IP address used in hashed form for daily caps). Submissions identified as spam are briefly logged in a technical file outside the web root, solely to monitor the mechanism.

Legal basis: legitimate interest (article 6.1.f GDPR) in protecting the service against abuse.

Journal reading counters

Journal articles display view and like counters. These are anonymous per-article aggregates: no personal data is stored and no profile is built. Your "already read / already liked" state stays in your own browser (sessionStorage / localStorage); a technical cap per hashed IP address protects the mechanism against abuse.

Processing purposes

The data collected is used exclusively to:

  • Respond to your contact or quote request
  • Reach out to clarify your need if necessary
  • Prepare a commercial proposal if your project is a good fit

Your data is never sold, shared, pooled or transferred to third parties for commercial purposes.

Legal basis

The processing is based on:

  • Pre-contractual measures taken at your request (article 6.1.b of GDPR), when you contact us regarding a potential engagement
  • The legitimate interest of the data controller (article 6.1.f of GDPR) for the administrative management and follow-up of the prospect relationship

Retention period

Your data is retained:

  • 3 years after the last contact if you do not become a client
  • 10 years after the end of the contractual relationship if you become a client (accounting obligations, article L. 123-22 of the French Commercial Code)
  • Received emails are deleted beyond these periods

Data recipients

Only Cédric Barme, as manager of NSY, has access to the data. No subcontractor intervenes on this data, except for:

  • Infomaniak Network SA (Switzerland, adequate country under GDPR) — host of the website and email provider
  • Mistral AI (France, European Union) — only if you use the conversational assistant: your messages are relayed to them for the time needed to generate the reply (see the "AI assistant" section below)
  • Cloudflare, Inc. (United States — certified under the EU-US Data Privacy Framework) — only for the Turnstile anti-bot check on the forms: technical signals from your browser, never the content of your messages

AI assistant (chatbot)

The site offers a conversational assistant powered by a language model provided by Mistral AI (a French company — data processed within the European Union).

  • The messages you type in the chat (and the current conversation history) are sent to our server, then relayed to the Mistral AI API for the sole purpose of generating the reply.
  • NSY stores no message: no database, no logging of conversation content. Only anonymised technical counters (hashed IP address) are used to limit request volume.
  • The conversation history stays in your browser (sessionStorage) and disappears when the tab is closed.
  • Do not type sensitive data into the chat; for any binding request, use the contact form.
  • Legal basis: legitimate interest (assisting the site's visitors). If the model is unavailable, a local answer engine takes over — no data then leaves your browser.

Your rights

In accordance with articles 15 to 22 of GDPR, you have the following rights:

  • Right of access — know what data we hold about you
  • Right to rectification — correct inaccurate data
  • Right to erasure ("right to be forgotten") — request the deletion of your data
  • Right to restriction of processing
  • Right to portability — retrieve your data in a structured format
  • Right to object to processing

To exercise these rights, use the contact form, specifying your request. You will receive a response within a maximum of one month.

If, after contacting us, you believe your rights are not being respected, you may file a complaint with the French data protection authority CNIL.

Security

The nsy.fr website is served exclusively over HTTPS with an SSL certificate provided by Let's Encrypt via Infomaniak. Emails are processed on secure Infomaniak servers hosted in Switzerland.

NSY implements appropriate technical and organisational measures to ensure data security. However, as no system is infallible, NSY cannot guarantee absolute security.

Cookies

The nsy.fr website sets no tracking, session, analytics or advertising cookies. No prior consent banner is therefore necessary for cookies set by nsy.fr — see, however, the Embedded third-party content section regarding the pages that display a YouTube video player.

A single functional preference cookie is used:

Name Purpose Duration When is it set?
nsy_lang Remember your language choice (FR / EN) so you don't have to re-select it on every visit. 1 year Only when you click a 🇫🇷 / 🇬🇧 flag in the navigation.

This cookie is strictly necessary for the language selection functionality. It only contains a 2-character string (fr or en), carries no personal data, is never transmitted to any third party, and is attached only to your browser with the SameSite=Lax attribute.

In accordance with French CNIL deliberation no. 2020-091 of 17 September 2020, cookies intended to remember a choice expressed by the user (language preference) are exempt from the obligation to obtain prior consent, provided they are set on an explicit user action — which is the case here (clicking a flag).

You can delete this cookie at any time from your browser settings. The default language will then be re-detected from your browser's language preferences (Accept-Language header).

Embedded third-party content (YouTube)

Two pages on this site display video players hosted by YouTube: Work, which showcases the sites we have delivered, and 3D design. Everywhere else, videos are hosted on our own servers and call no outside service.

These players use YouTube's privacy-enhanced mode (the youtube-nocookie.com domain): no advertising or personalisation cookie is set unless you start playback. That said — and this is true of any embedded content, whatever its source — merely displaying the page opens a connection to YouTube's servers (Google), which then receive your IP address, the address of the page you are viewing, and your browser's technical data. If you play a video, YouTube may additionally write information to your browser's local storage and associate that view with your Google account if you are signed in.

That processing is then governed by Google's privacy policy, over which NSY has no control: policies.google.com/privacy. If you would rather avoid it, simply do not start playback, or view these two pages with a third-party content blocker; the same videos remain available on our YouTube channel, where going there is your own decision.

Updates

This policy may be updated at any time to reflect technical, legal or organisational changes. The date of the last update appears at the bottom of the page.

Last update: 2026