Privacy policy
How we process your personal data.
This is an English translation of the French original. If this English version differs from the French version in any way, the French version prevails. French law applies.
1. Who is responsible for your data
The data controller is Nahouda, whose registered office is at 38 Boulevard Halidi Selemani, 97600 Mamoudzou, Mayotte. For any question about your personal data: privacy@nahouda.fr. Nahouda has not appointed a data protection officer.
2. The data we process, why and for how long
| Situation | Data | Why | Legal basis | Retention period |
|---|---|---|---|---|
| You visit the site | date, page requested and response code, in the server’s technical logs (without IP address) | security and proper operation | legitimate interest | about 1 month (automatic log rotation) |
| You request a quote or write to us | name, email, company, message | to reply to you | your request (pre-contractual measures) | 3 years, then automatic deletion |
| You request a quote or write to us, and have not objected | text of your message, without your name, email or telephone number | to improve the quality of our services: answer your questions better, spot recurring topics and choose our next articles and projects, using an analysis tool hosted on our own servers | legitimate interest | 12 months, then only themes and counters not linked to you are kept |
| You write to us by email | your email address and the content of your message | to reply to you | your request (pre-contractual measures) or our legitimate interest in replying to your messages | 3 years, then deletion |
| You have a customer account | identity, email, company, billing address, licences | to manage your account and your contract | the contract | as long as the account exists, then 30 days after its deletion or the end of the last subscription (export period); invoices 10 years (accounting obligation) |
| You log in | IP address, device, date and result of logins | to protect accounts | legitimate interest | 6 months (180 days), automatic deletion every night |
| Our team assists you on your account | date and reason for staff access | traceability of support | legitimate interest | 12 months |
| You pay | billing data; the card is processed by the payment provider, never by Nahouda | to collect payment and invoice | the contract | invoices 10 years |
| Your browser reports content blocked by our security policy | address of the page (without its parameters), blocked resource, security rule concerned, code excerpt if any; no cookie, no IP address, no identifier | to detect injection attempts and site errors | legitimate interest (site security) | 90 days |
The analysis of your message does not lead to any decision concerning you. If you object, when sending it or later by writing to privacy@nahouda.fr, your message is not analysed and anything that had been drawn from it is erased.
Erasure is carried out by permanent anonymisation. Technical backups are renewed regularly: data erased at your request disappears from backups within 30 days at the latest.
3. Who receives your data
- OVH (France): hosting of the servers.
- Sweego (France): sending of the site’s emails (confirmations and notifications).
- Infomaniak (Switzerland): receipt of emails sent to an @nahouda.fr address, which Nahouda then reads in its own mailbox.
- Stripe: payment processing; receives only billing data.
- Tools hosted by Nahouda itself (file storage, monitoring of errors and security alerts of the site, Nahouda Connect login): no third party, listed for transparency.
Your data is never sold. The detailed list of our providers is available on request.
4. Transfers outside the European Union
Two providers may process data outside the European Union. Stripe, for billing data, notably in the United States, with safeguards provided by law (standard contractual clauses and the EU-US data protection framework). Infomaniak, a company established in Switzerland, for emails received at an @nahouda.fr address: Switzerland is recognised by the European Commission as providing an adequate level of protection. No other transfer is made.
5. Your rights
You may ask for access to your data, its rectification, its erasure, restriction of processing, object to it and ask for its portability, by writing to privacy@nahouda.fr. We reply within one month; proof of identity is only requested in case of doubt. If you believe that your rights are not being respected, you may lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
6. Security
Passwords are stored in encrypted form, two-factor authentication protects staff accounts and access to data is limited to the people who need it.
7. Notification in the event of a data breach
In the event of a personal data breach likely to result in a risk to the rights and freedoms of the individuals concerned, Nahouda notifies the CNIL within 72 hours of discovering the incident (article 33 of the GDPR). Where that risk is high, the individuals concerned are informed directly without undue delay (article 34 of the GDPR).
8. Minors
Our services are reserved for adults.
10. Changes
The version and date of this policy are shown at the top of the page and the history of versions is kept. Customers are notified by email of any significant change.
Version history
- Version 126 October 2026In force