GDPR policy

1. Nexelys GDPR Commitment

Nexelys takes the protection of your personal data seriously and is committed to complying with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the amended French Data Protection Act.

This GDPR policy precisely describes how Nexelys collects, processes, retains, and protects your personal data, as well as the rights available to you.

2. Legal Basis for Processing

All personal data processing carried out by Nexelys is based on one of the following legal grounds:

Consent (Art. 6.1.a), when submitting the contact form, you explicitly consent to the processing of your data
Legitimate interest (Art. 6.1.f), commercial follow-up within the context of a business relationship initiated by the prospect
Legal obligation (Art. 6.1.c), retention of mandatory accounting and tax records

3. Processing Register

3.1 Diagnostic requests via the contact form

Purpose	Processing and follow-up of diagnostic requests
Data concerned	Name, email, phone, sector, type of analysis
Legal basis	Consent (Art. 6.1.a GDPR)
Duration	3 years from last contact
Recipients	Nexelys consultants only

3.2 Subscription to the "Free publications" newsletter

Purpose	Monthly delivery of free sector analyses
Data concerned	Email address
Legal basis	Consent (Art. 6.1.a GDPR), double opt-in via Brevo
Duration	Until unsubscription, then 3 years (proof of consent)
Recipients	Nexelys + Brevo (emailing subprocessor)

3.3 B2B commercial prospecting

Purpose	Sending prospecting emails to qualified business contacts
Data concerned	First and last name, professional email, job title, company (sources: professional databases such as Apollo)
Legal basis	Legitimate interest (Art. 6.1.f GDPR), B2B prospecting toward business contacts in line with their role
Duration	3 years from the last contact, or immediate objection
Recipients	Nexelys + Instantly.ai (prospecting subprocessor)
Right to object	At any time, via the unsubscribe link in every email

3.4 Subscriber account and payment

Purpose	Account creation, subscription management, invoicing
Data concerned	Email, hashed password, subscription plan, billing data
Legal basis	Performance of the contract (Art. 6.1.b GDPR) + Legal obligation (Art. 6.1.c) for invoicing
Duration	Duration of the contract; 10 years for billing data
Recipients	Nexelys + Stripe (payment subprocessor)

Important: Nexelys never stores full bank card data (card number, CVV, expiry date), these are handled exclusively by Stripe.

3.5 Cookies and browsing

Purpose	Technical operation of the website, audience measurement, ad campaign tracking
Data concerned	Session data (technical cookies); analytics and marketing identifiers after consent
Legal basis	Legitimate interest (Art. 6.1.f) for technical cookies; Consent (Art. 6.1.a) for analytics and marketing cookies
Duration	See the Cookies policy
Recipients	Nexelys, Google LLC (GA4, GTM, Fonts), LinkedIn Ireland (Insight Tag)

4. Processors and Transfers

To deliver its services, Nexelys relies on the subprocessors listed below. Some are established outside the European Union; in that case, transfers are governed by appropriate safeguards (Standard Contractual Clauses, SCCs, approved by the European Commission, and/or the EU-US Data Privacy Framework for adhering US subprocessors).

Subprocessor	Purpose	Location	Safeguard
Infomaniak Network SA	Professional email service	Switzerland	Swiss adequacy decision (Art. 45 GDPR)
Sendinblue SAS / Brevo	Newsletter and marketing emailing	France (EU)	Native GDPR compliance
Resend Inc.	Transactional emails	United States	DPF + SCCs
Instantly.ai	B2B email prospecting	United States	SCCs
Stripe Payments Europe Ltd	Subscription payments	Ireland (EU)	Native GDPR compliance
Netlify, Inc.	Frontend hosting	United States	DPF + SCCs
Railway Corp.	Backend hosting	United States	SCCs
Google LLC	Google Fonts, GTM, GA4	United States	DPF + SCCs
LinkedIn Ireland Unlimited Company	Insight Tag	Ireland (EU)	Native GDPR compliance

All subprocessors are bound by agreements compliant with Article 28 of the GDPR.

Nexelys never sells, rents, or shares your data with third parties for commercial purposes.

5. Exercising Your Rights

Under the GDPR, you have the following rights over your personal data:

Right of access (Art. 15), obtain confirmation that your data is being processed and receive a copy
Right of rectification (Art. 16), have inaccurate data corrected
Right to erasure (Art. 17), obtain deletion of your data in the cases provided for
Right to restriction (Art. 18), restrict the processing of your data
Right to portability (Art. 20), receive your data in a structured, readable format
Right to object (Art. 21), object to processing on legitimate grounds
Right to withdraw consent (Art. 7.3), at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, send your request by email to contact@nexelys.io, including proof of your identity. We undertake to respond within one month (extendable to three months for complex requests).

6. Complaint to the CNIL

If you believe that Nexelys's processing of your personal data does not comply with the GDPR, you have the right to file a complaint with the French data protection authority (CNIL):

CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Tel: +33 1 53 73 22 22, www.cnil.fr

7. Contact

For any questions regarding this GDPR policy or the protection of your data:

Controller	Mr. Bilal Kaddouri · Nexelys
Email	contact@nexelys.io
Phone	+33 6 33 66 98 68
Address	42 Rue Pasteur, 60180 Nogent-sur-Oise, France