Privacy policy

Data controller

Personal data collected through the public website is processed under the responsibility of Soveria SAS.

• Controller: Soveria SAS
• Registered office: Bâtiment B4, 25 Impasse Napoléon, 06160 Antibes, France
• SIREN: 103 974 291
• Registered-office SIRET: 103 974 291 00017
• Registration: 103 974 291 R.C.S. Antibes
• Personal-data contact: contact@getsoveria.com
• Phone: +33 (0)7 59 69 00 40
• Data protection officer: not appointed at this stage; GDPR requests are handled through contact@getsoveria.com

Data collected

The website limits requested data to information needed to understand and answer a request.

• Contact form: name, email address, company, role, product family, approximate volume, subject and free-form message
• Meeting booking: information needed to choose a slot, organise the call and follow up on the request
• Navigation: technical data needed for website operation and security, such as server logs
• Cookie preference: acceptance or refusal choice stored locally in this browser for 180 days
• PostHog, when the public token is configured and after consent: page views, page path, URL, page title, language, referrer, UTM parameters, viewed sections, opened FAQ items, important clicks, language switches, meeting clicks and form interactions
• Marketing attribution: first and last landing page, first and last UTM source, medium, campaign, term, content and referrer, which may be stored locally for up to 90 days when audience measurement is accepted
• Monitoring after consent: Web Vitals, navigation type and compact client errors, limited to the technical message, type and source of the error
• PostHog session replay: disabled in the current public SDK implementation

The public form should not receive manufacturing secrets, confidential product data, technical drawings or sensitive files.

Purposes and legal bases

Each processing activity must rely on a clear purpose and an appropriate legal basis.

• Answer a request sent through the website: pre-contractual steps or legitimate interest depending on the request
• Qualify a demo, audit, pricing or physical-carrier need: Soveria's legitimate interest in answering professional enquiries
• Organise a meeting: pre-contractual steps or legitimate interest
• Follow up on a B2B enquiry: legitimate interest, unless the person objects
• Measure page views, viewed sections, important clicks and conversions through PostHog to improve the website: consent when the tool is enabled
• Understand marketing attribution for enquiries, without targeted advertising or data resale: consent when PostHog is enabled
• Monitor Web Vitals and compact client errors to improve performance and detect incidents: consent when PostHog is enabled
• Remember cookie choices: strictly necessary tracker used to respect the expressed acceptance or refusal
• Secure the website and prevent abuse: legitimate interest
• Non-essential audience measurement: consent when required by applicable rules

Cookies and trackers

The website displays a consent banner before enabling non-essential audience measurement.

• Decline and Accept buttons are available at the same level
• Declining does not prevent access to the website
• No PostHog tracker subject to consent starts before acceptance
• The choice is stored in the browser for 180 days so the preference is not requested again on every visit
• Consented marketing attribution may be stored locally for up to 90 days to understand where contact requests come from
• A Cookie preferences link in the footer lets users change or withdraw this choice
• Cookie information is grouped in this privacy policy and completed by the footer preferences button

The consent banner concerns PostHog audience measurement. Third-party services used for forms, booking or hosting remain described in the dedicated sections.

Required information

Some information is needed so Soveria can correctly answer a request.

• Fields marked as required in forms must be completed to send the request
• The free-form message remains under the user's control
• Without valid reply contact details, Soveria cannot follow up
• No sensitive product data is required for a first contact

Retention periods

Data is kept for a period proportionate to the pursued purpose, then deleted or archived where necessary to comply with a legal obligation or defend a right.

• B2B contact requests and commercial exchanges: up to 3 years after the last active contact
• Cal.eu meeting data: up to 3 years after the last business exchange, unless deleted earlier or configured with a shorter retention period
• Website and hosting technical logs: up to 12 months when needed for security, diagnostics or abuse prevention
• Cookie acceptance or refusal choice: 180 days in the browser, then a new choice is requested
• Local marketing attribution: up to 90 days in the browser, then renewed when a new consented marketing source is captured
• PostHog events, if enabled: up to 12 months for Soveria conversion and performance analyses; the native Marketing Analytics attribution window is configured to 90 days in the PostHog project, subject to later changes to this configuration
• Audience-measurement trackers: duration limited to the measurement purpose and the user's expressed choice

Recipients and processors

Access to data is limited to the people and providers who need it to handle the request.

• Soveria team members authorised to answer commercial, technical or regulatory requests
• Soveria internal API then the configured SMTP email service for routing contact-form messages to contact@getsoveria.com; FormSubmit may remain used as a technical fallback when SMTP is not configured
• Cal.eu for displaying the calendar and organising meetings
• PostHog EU Cloud for audience measurement when the tool is enabled
• Public getsoveria.com website hosting provider: OVH SAS
• Technical providers required for the website, email, calendar and hosting
• Soveria does not sell personal data collected from the public website

Transfers outside the European Union

Soveria favours a European approach for hosting and data protection.

• The public website is hosted by OVHcloud, through OVH SAS, in the Europe, France - Gravelines region, eu-west-gra
• PostHog is configured to use the European host when analytics is enabled, with IP anonymisation at project level
• The configured SMTP email service, FormSubmit when used as a fallback, Cal.eu and technical processors may apply their own processing locations and subprocessors
• If an external tool involves processing outside the European Union, European Economic Area or a country recognised as adequate, Soveria checks the applicable safeguards, such as an adequacy decision, standard contractual clauses or a suitable data-processing agreement

Security and confidentiality

Soveria applies measures designed to limit unauthorised access to personal data.

• Access limited to people who need to handle the request
• HTTPS encryption on the published website
• Providers selected according to the expected confidentiality level
• Broad autocapture, session replay and unidentified person profiles are disabled in the public-site PostHog implementation
• Separation between public first contact and exchanges containing sensitive industrial information

Your rights

Data subjects may exercise the rights provided by the GDPR, within the limits set by applicable rules.

• Right of access, rectification, erasure and restriction
• Right to object when processing is based on legitimate interest
• Right to data portability when this right applies
• Right to withdraw consent at any time for consent-based processing
• Requests should be sent to contact@getsoveria.com with enough information to identify the request
• Soveria responds within one month from receipt of the complete request, unless an extension is allowed by applicable rules

Complaint

If you consider that your rights are not respected, you may lodge a complaint with the competent authority.

• French authority: Commission nationale de l'informatique et des libertés (CNIL)
• Website: cnil.fr
• Soveria recommends contacting it first so the request can be handled directly when possible