Privacy policy

Controller

Techspike SARL, 39 rue du Général de Gaulle, 33460 Margaux-Cantenac, France (Bordeaux Trade and Companies Register (RCS) 982 709 255), represented by its managing director (gérant), Benjamin Barbé. E-mail: contact@techspike.fr. For any question about your data, write to us at this address. We have not appointed a data protection officer, as we are not required to.

Hosting and server logs

The site and our tools for handling enquiries are hosted in France, in the data centres of Scaleway SAS (8, rue de la Ville-l’Évêque, 75008 Paris), Paris region. When you visit, the server records technically necessary data: IP address, date and time, page requested, browser and device information, referring page. They are used to deliver the site and protect it against attacks, and are kept for at most one year.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Scaleway processes the data on our behalf (Art. 28 GDPR).

Contact form, security check and orders

When you write to us through a form, we process what you enter: name, company, e-mail address, phone, the address of your application, message and preferred date, and for an order the billing address, VAT ID and your selection. We use it to answer your enquiry, run the free security check, prepare a quote and carry out your order. It is stored in our enquiry tool and forwarded to our mailbox.

For the security check, we access the address you give from outside, as any browser does, and only evaluate publicly visible information.

The legal basis is taking steps at your request before entering into a contract, or performing the contract (Art. 6(1)(b) GDPR), our legitimate interest in handling enquiries (point f) and, for invoices, our legal obligations (point c).

Code upload after an order

If you choose to send your code as a ZIP archive, we send you a personal, time-limited upload link. The archive is transferred encrypted and stored in a private Scaleway storage space in France (Paris region) that only we can access. We use it solely for the audit you ordered and delete it no later than 30 days after delivering the report. For a re-test, you send us the current version again.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR). If the code contains personal data, we process it on your behalf as a processor, under the data processing agreement concluded with you (Art. 28 GDPR).

AI-assisted analysis

For audits and the security check, we use AI models from Anthropic (Claude). We send it the content to be analysed: for an audit, your source code and the results of our analysis tools; for the security check, the externally visible results about your site. If your code contains personal data, for example in test data or configuration files, that data is sent too.

Anthropic processes the data on our behalf (Art. 28 GDPR) and does not use it to train its models. Processing takes place in the United States; this transfer relies on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Recipients

Your data is neither sold nor rented. Only the following have access, as far as necessary:

• the people at Techspike SARL handling your enquiry or audit;
• our partner Viewconic GmbH (Ammerseestr. 23, 82131 Gauting, Germany), with whom we run this site, the enquiry tool and the e-mail system, and who may take part in carrying out audits; it acts on our behalf (Art. 28 GDPR);
• our other technical processors: Scaleway (hosting, France) and Anthropic (AI analysis, United States);
• our accountant (expert-comptable) and, when required by law, the competent authorities.

Retention periods

• Enquiries without an order and prospects: three years from your last contact.
• Customers: for the duration of the contractual relationship, then five years (limitation period, Art. 2224 Code civil and Art. L. 110-4 Code de commerce).
• Invoices and accounting records: ten years (Art. L. 123-22 Code de commerce).
• Source code sent for an audit: at most 30 days after delivery of the report. We keep the report during the contractual relationship for the re-test and your questions.
• Server logs: at most one year.

Cookies, storage and audience measurement

We set no cookies and use no third-party analytics, advertising or social media tools. Fonts are served from our own server; no data goes to font services.

To improve the site, we count visits anonymously on our own server: the page viewed, the language, the site you came from (its domain name only), campaign tags in the link (utm), the type of device (computer, tablet, phone) and steps such as “started the security check” or “booking step 2”. Form contents are never included. To tell the visitors of one day apart, the server hashes the IP address and browser identifier with a key that is created anew every day and deleted the next day. We do not store the IP address or the browser identifier themselves. A visitor can therefore neither be followed across days nor linked to a person, and nothing is stored on your device. The legal basis is our legitimate interest in a site that serves its visitors (Art. 6(1)(f) GDPR); the measurement meets the conditions under which the French data protection authority (CNIL) allows audience measurement without consent. The data is kept for 13 months and shared with no one. If “Do Not Track” or “Global Privacy Control” is on in your browser, we send nothing.

So that the address from the security check appears in the contact form, we keep it in your browser’s session storage (sessionStorage), which is cleared when you close the tab. This storage is strictly necessary for the service you request and therefore needs no consent (Art. 82 of the French Data Protection Act).

Security

Connections to the site are encrypted (TLS). Access to data is limited to the people who need it, with authentication. We sign a non-disclosure agreement before any access to your code.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time to processing based on our legitimate interest, and to direct marketing without giving reasons (Art. 21). You may withdraw consent at any time for the future. Under French law, you may also set instructions for what happens to your data after your death (Art. 85 of the French Data Protection Act).

To exercise these rights, write to us at contact@techspike.fr. We reply within one month. You may lodge a complaint with the French supervisory authority, the CNIL (Commission nationale de l’informatique et des libertés, 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the supervisory authority where you live (Art. 77 GDPR).

Other information

We make no decisions based solely on automated processing within the meaning of Art. 22 GDPR. The audits themselves are also governed by the agreements made for the engagement, in particular the non-disclosure agreement and the data processing agreement. We update this policy when our processing changes; the date is at the top of the page.