ELXAO respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information in compliance with the General Data Protection Regulation (GDPR) and French data protection law.
Data controller
Company: ELXAO
Address: 154 boulevard Malesherbes, 75017 Paris, France
Email: contact@elxao.com
Data Protection Contact: privacy@elxao.com
What personal data we collect
Information you provide directly
| Data Type | Collection Point | Purpose |
|---|---|---|
| Name, Email | Contact Form | Respond to inquiries |
| Email Address | Newsletter Subscription | Send marketing communications |
| Business Info (company, website, budget) | Quote Calculator | Provide service estimates |
| Name, Email, Address, Payment Info | Checkout / Orders | Process orders and payments |
Information collected automatically
| Data Type | Collection Method | Purpose |
|---|---|---|
| IP Address, Browser, Device, Pages Visited | Website Visit (Server Logs) | Security, analytics, website improvement |
| Behavior Data (clicks, scrolls, time on page) | Google Analytics (with consent) | Understand user behavior, improve UX |
| UTM Parameters, Referrer Source | Marketing Attribution | Measure marketing effectiveness |
| Cookie Consent Preferences | Cookie Banner | Respect your privacy choices |
Legal basis for processing
We process your personal data based on the following legal grounds (Article 6 GDPR):
- Consent (Art. 6(1)(a)): Newsletter subscriptions, marketing cookies, analytics cookies
- Contract Performance (Art. 6(1)(b)): Processing orders, delivering services you requested
- Legal Obligation (Art. 6(1)(c)): Accounting records, tax compliance (France requires 10-year retention)
- Legitimate Interest (Art. 6(1)(f)): Website security, fraud prevention, improving services
How we use your data
- Respond to your inquiries and provide customer support
- Process orders and manage payments
- Send service-related communications (order confirmations, invoices)
- Send marketing emails (only with your consent — you can unsubscribe anytime)
- Analyze website usage to improve our services
- Detect and prevent fraud or security threats
- Comply with legal obligations (accounting, tax reporting)
Who we share your data with
We share your data only with trusted third-party processors who help us operate our services:
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Google LLC | Analytics, Ads, Tag Manager | USA | EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs) |
| Stripe, Inc. | Payment Processing | USA | Standard Contractual Clauses (SCCs), PCI-DSS certified |
| Mailchimp (Intuit) | Email Marketing | USA | Standard Contractual Clauses (SCCs) |
| Bluehost Inc. | Website Hosting | USA | Standard Contractual Clauses (SCCs) |
All processors are bound by Data Processing Agreements (DPAs) and are required to protect your data according to GDPR standards.
We never sell your personal data to third parties.
International data transfers
Some of our processors are located outside the European Union (primarily in the United States). When we transfer your data internationally, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs): European Commission-approved contracts that require non-EU processors to protect your data
- EU-U.S. Data Privacy Framework: Google LLC is certified under this framework, ensuring adequate data protection
- Transfer Impact Assessments (TIAs): We evaluate risks for each international transfer
- Processor Commitments: Google, Stripe, Bluehost, and Mailchimp have committed to GDPR-equivalent protections
You have the right to request information about safeguards in place for international transfers by contacting privacy@elxao.com.
How long we keep your data
| Data Type | Retention Period | Reason |
|---|---|---|
| Cookie Consent Records | 13 months (then re-prompt) | CNIL requirement |
| Newsletter Subscribers | Until unsubscribe + 3 months | Proof of consent, legal defense |
| Contact Form Inquiries | 3 years after last contact | Customer relationship, legal claims |
| Order / Invoice Data | 10 years after transaction | French accounting law requirement |
| Analytics Data (Google) | 14 months | Google Analytics default retention |
| Website Logs (IP, user agent) | 12 months | Security, fraud prevention |
After these periods, data is securely deleted or anonymized.
Your rights under GDPR
You have the following rights regarding your personal data:
Right to access (Art. 15)
Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)
Correct inaccurate or incomplete data.
Right to erasure / "right to be forgotten" (Art. 17)
Request deletion of your data (except when we have legal obligation to retain it).
Right to data portability (Art. 20)
Receive your data in a machine-readable format (CSV, JSON) and transfer it to another service.
Right to restriction of processing (Art. 18)
Limit how we use your data while we verify its accuracy or your objection.
Right to object (Art. 21)
Object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent (Art. 7)
Withdraw consent for newsletters, cookies, or marketing at any time.
Right to lodge a complaint
File a complaint with the French data protection authority (CNIL):
CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr
Phone: +33 1 53 73 22 22
How to exercise your rights
To exercise any of these rights, contact us at:
Email: privacy@elxao.com
Subject Line: "GDPR Rights Request"
Include: Your name, email, and specific request
We will respond within 30 days (or explain if we need more time).
Security measures
We implement technical and organizational measures to protect your data:
- Encryption: HTTPS/SSL for all data transmission
- Secure Payment Processing: Stripe handles payment data (we never store full credit card numbers)
- Access Controls: Limited employee access to personal data on a need-to-know basis
- Regular Updates: Security patches applied to WordPress, plugins, and server software
- Backups: Regular encrypted backups stored securely
- Monitoring: Automated security monitoring for suspicious activity
Cookies & tracking
We use cookies for analytics and marketing purposes. For detailed information, see our Cookie Policy.
You control cookies: Use our cookie banner (appears on first visit) or click "Manage Consent" at the bottom right of any page.
Children's Privacy
Our services are not directed to individuals under 16 years old. We do not knowingly collect data from children. If you believe we have collected data from a child, contact us immediately at privacy@elxao.com and we will delete it.
Changes to this policy
We may update this privacy policy to reflect changes in our practices or legal requirements. When we make significant changes:
- We update the "Last updated" date at the top
- We notify you via email (for newsletter subscribers)
- We may display a notice on our website
Continued use of our services after changes constitutes acceptance of the updated policy.
Contact us
For questions about this privacy policy or how we handle your data:
Email: privacy@elxao.com
Mail: ELXAO, 154 boulevard Malesherbes, 75017 Paris, France
General Inquiries: contact@elxao.com
This privacy policy complies with:
- Regulation (EU) 2016/679 (GDPR)
- French Law No. 78-17 of January 6, 1978 ("Informatique et Libertés")
- CNIL guidelines on cookies and consent