Privacy policy

Required fields

Fields marked with an asterisk are required to process the request. Your role is optional. If required information is not provided, QSTOM-IT cannot process the form.

Legal bases

When your request concerns a service or potential contractual relationship, processing is based on steps taken at your request prior to entering into a contract. For other professional enquiries, partnerships and form security measures, QSTOM-IT relies on its legitimate interests in responding to professional enquiries and protecting its service from abuse.

Recipients and service providers

Data is available only to authorised QSTOM-IT personnel who need it to process the request. The website is hosted by PlanetHoster and messages are handled through QSTOM-IT's professional Google Workspace account.

Retention periods

• request with no further action: deletion no later than 12 months after the last useful exchange
• prospect where professional exchanges continue: up to 3 years from the last contact initiated by the prospect
• if a contractual relationship is established: relevant information is then retained according to the legal and contractual retention periods applicable to the client record
• technical data used for abuse prevention: one-hour operational window, with no use for profiling or marketing

Security and abuse prevention

The form uses a session token, an invisible honeypot field, timing consistency checks, server-side validation and submission rate limiting. For rate limiting, the server uses an HMAC fingerprint of the IP address rather than storing the plain IP address in the rate-limit file. This fingerprint is used only to prevent abuse. The service does not perform automated decision-making producing legal effects concerning you.

Cookies and trackers

As of the date of this policy, QSTOM-IT does not use advertising cookies or Analytics trackers on the website. The contact form creates only a technical session cookie required to secure the anti-CSRF token. This cookie is strictly necessary for the service and expires at the end of the browser session. If an audience measurement tool requiring consent is activated later, this policy and the consent mechanism will be updated before activation.

Hosting, email and transfers

The qstom-it.com hosting project is configured by QSTOM-IT on PlanetHoster infrastructure located in France. PlanetHoster Inc. is a company established in Canada.

Messages received are processed through Google Workspace. Google provides a Cloud Data Processing Addendum for Google Workspace and contractual mechanisms designed to address processing and transfers subject to European data protection law. Depending on the services and settings used, some data may be processed outside the European Economic Area.

Your rights

Depending on the processing activity and its legal basis, you may request access to your data, rectification, erasure or restriction of processing. You may object to processing based on legitimate interests. Where the legal conditions are met, you may also exercise the right to data portability. You can exercise your rights through the contact form by selecting Other request or by writing to projects@qstom-it.com.

Complaint to the CNIL

If, after contacting QSTOM-IT, you believe that your data protection rights have not been respected, you may lodge a complaint with the French Data Protection Authority, the Commission nationale de l'informatique et des libertés (CNIL).

No sale of data or automatic marketing enrolment

QSTOM-IT does not sell data received through this form. Submitting the form does not automatically subscribe you to a newsletter or marketing campaign.

Policy updates

This policy may evolve to reflect changes to the website, service providers or the legal framework. The update date shown at the top of the page identifies the version currently in force.