Privacy Policy

1. Data Controller

In accordance with Article 37 of the GDPR, Nexelys has not appointed a Data Protection Officer (DPO). The data controller is Mr. Bilal Kaddouri.

2. Data Collected

When you use the contact form available on our website, we collect the following data:

• First and last name
• Professional email address
• Phone number
• Business sector
• Type of analysis requested (optional)

This data is collected with your explicit consent when you submit the form.

In addition to the contact form, Nexelys carries out the following processing activities:

• Subscription to the Free publications newsletter, email address and engagement data (opens, clicks) to tailor the content sent.
• B2B commercial prospecting by email, based on legitimate interest (Art. 6.1.f GDPR), targeting qualified business contacts in line with their professional role.
• Subscriber account creation, email address, hashed password, and chosen subscription plan.
• Payment, payments are processed by our subprocessor Stripe; Nexelys never stores any bank card data (card number, CVV, expiry date).

3. Purposes of Processing

The data collected is used exclusively for:

• Following up on your request for a free diagnostic
• Scheduling a consultation with a Nexelys consultant
• Sending you information about our services, with your agreement

It is under no circumstances used for unsolicited commercial purposes, nor shared with third parties.

4. Retention Period

Retention periods vary according to the nature of the processing:

• Free-diagnostic prospect data, 3 years from the last contact
• Brevo newsletter data, until unsubscription, then retained for 3 years as proof of consent
• Market study follow-up (request to be notified of updates), until unsubscription, then retained for 3 years as proof of consent. One-click unsubscribe in every message.
• B2B cold email prospecting data, up to 3 years after the last contact, or immediate deletion upon objection
• Accounting and invoicing data, 10 years (legal obligation, French Commercial Code)
• Connection / security logs, 12 months
• Cookies, see section 6 below

At the end of these periods, your data is deleted or anonymised.

5. Your Rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• Right of access, obtain a copy of your personal data
• Right of rectification, correct inaccurate or incomplete data
• Right to erasure, request deletion of your data
• Right to restriction, restrict the processing of your data
• Right to portability, receive your data in a structured format
• Right to object, object to the processing of your data

To exercise these rights, contact us at contact@nexelys.io.

If your request is not satisfied, you may file a complaint with the CNIL (French data protection authority).

6. Cookies and Third-Party Resources

The website nexelys.io uses cookies to ensure its operation, measure its audience and optimise its communications. These cookies are only set after you give consent, with the exception of strictly necessary cookies.

Cookies used:

• Technical cookies (strictly necessary), session, security, preferences
• Analytics cookies, Google Analytics 4 (G-7YPHNCZRGW), loaded only after consent, anonymised audience measurement
• Marketing cookies, LinkedIn Insight Tag (Partner ID 9010482), conversion tracking for LinkedIn ad campaigns
• Fonts, Google Fonts (loaded from fonts.googleapis.com, may transmit your IP address to Google LLC, USA)

For more details and to manage your cookie preferences, see our Cookies policy.

7. Data Security

Nexelys implements appropriate technical and organisational measures to protect your data against loss, destruction, alteration, unauthorised access, or disclosure.

8. Subprocessors and Transfers Outside the EU

To deliver our services, we rely on the following subprocessors. Some are established outside the European Union; in that case, transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission and/or the EU-US Data Privacy Framework (DPF).