Privacy policy

Phenisys SAS, a French simplified joint-stock company (SAS), registered under SIREN number 539 060 327 with the Lyon Trade and Companies Register, whose registered office is located at 61 Cours de la Liberté, 69003 Lyon, France, represented by Christophe Nétillard, acts as the controller of the personal data collected on this website.

For any question about your personal data, or to exercise your rights: contact@phenisys.com.

Through the contact form and by email: last name, first name, email address, phone number, the content of your message and, where applicable, any documents or photographs you send us. Where other data reaches us by another means, it is processed with the same level of protection.

While browsing: audience measurement data, only if you consent to it (see the “Analytics and cookies” section).

We never ask for information that is not required to handle your request, and we do not collect any sensitive data.

To answer your requests and manage the business relationship: performance of pre-contractual measures or legitimate interest.

To provide user support, including through an automated conversational agent: legitimate interest.

To keep the website secure and prevent misuse: legitimate interest.

To measure the website audience: your consent, which you may withdraw at any time.

No processing is carried out for advertising, prospecting or data-resale purposes.

The website uses Google Analytics 4 to measure its audience (pages viewed, source, device type). This tool is loaded only after your explicit consent, collected through the banner shown on your first visit: as long as you have not consented, no measurement tracker is set.

Audience data is neither resold nor used for advertising purposes. The website uses no advertising pixel and no social network tracker.

Google Analytics is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Measurement data may be processed by Google LLC (United States) under the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework.

You may withdraw your consent at any time. The cookies used, their purpose and their lifespan are detailed in our cookie policy.

Data sent through the contact form or by email: deleted no later than one month after receipt.

Cookies and audience measurement trackers: thirteen months at most, in line with the French CNIL recommendations.

Technical server logs: kept for a limited period, strictly necessary for the security and traceability of the website.

Hosting: the website and the data are hosted in France, on a secure infrastructure operated by OVHcloud (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France).

Audience measurement: Google, and only if you have given your consent (see the “Analytics and cookies” section).

Access to the data is restricted to authorised Phenisys staff and protected by multi-factor authentication (MFA).

No data sent through the forms is sold, rented or shared with third parties, or transferred outside the European Union, except where legally required — a court order or a reasoned request from a competent authority.

Under the General Data Protection Regulation, you have the right to access, rectify, erase, restrict the processing of, and port your data, and to object to its processing, as well as the right to withdraw your consent at any time.

These rights can be exercised by writing to contact@phenisys.com; we reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

Phenisys implements appropriate technical and organisational measures: hosting in France, encrypted traffic (HTTPS), restricted access for authorised staff and multi-factor authentication.

In the event of a personal data breach, or a suspected breach, we notify the CNIL within 72 hours, inform the individuals concerned where the risk to their rights and freedoms is high, and take the necessary steps to identify, correct and prevent the incident.

This policy may be updated to reflect regulatory or technical changes. The applicable version is the one published on this page.

Last updated: 1 October 2026.