Legal
Privacy policy
Last updated: 12 November 2026
Who is responsible for your data
This policy explains how PLENESYS SAS (“Plenesys”, “we”) processes the personal data collected through this website, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978 (loi Informatique et Libertés).
Controller: PLENESYS SAS, 1900 route des Crêtes, 06560 Valbonne, France · [email protected] · +33 (0)4 65 84 84 40. We have not appointed a Data Protection Officer, as our activity does not require one; any question about your data can be sent to the address above.
What we collect, why, and for how long
We only collect what you send us through the forms of this site. Fields marked as required are needed to answer you or to process your application.
| Processing | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| Contact form | Name, company (optional), email, subject, message | Answering your message and following up our exchanges | Our legitimate interest in answering enquiries and developing our business (art. 6.1.f GDPR), or steps you ask for before a contract (art. 6.1.b) | 3 years after our last exchange |
| Whitepaper requests | Whitepapers chosen, name, email, company (optional), your consent choices with their wording, date | Sending you the whitepapers by email; keeping a record of your consent | Your consent (art. 6.1.a GDPR), given with the first box of the form | 3 years after the request or our last contact |
| Business emails | Name, email, company | Writing to you about our products and services, only if you ticked the box “contact me by email” | Your consent (art. 6.1.a GDPR), which you can withdraw at any time | Until you withdraw it, or 3 years without contact |
| Job applications | First and last name, email, phone (optional), LinkedIn profile (optional), CV (PDF), message, the job applied for, our assessment and notes | Assessing your application and contacting you about it | Steps taken at your request before a possible employment contract (art. 6.1.b GDPR) | Up to 2 years after our last contact with you, then deleted automatically. If you are hired, your file is kept as part of your employee record. |
| Security and operation of the site | IP address, browser, pages requested, date and time (server logs) | Keeping the site secure and fixing faults | Our legitimate interest in running a secure website (art. 6.1.f GDPR) | Up to 12 months |
We do not sell your data, do not use it for advertising, and make no automated decisions or profiling about you.
Job applications
Applications sent from our careers page are emailed to [email protected] and stored on the website, where only the Plenesys staff involved in recruitment can see them. CVs are kept outside the public folders of the site and can only be opened by those authorised staff once logged in.
If your application is not successful, we may keep it for up to 2 years after our last contact so that we can offer you another position, unless you ask us to delete it sooner. Applications are then deleted automatically.
Who receives your data
Your data is only accessed by the Plenesys staff who need it. It is also processed, on our instructions and under contract, by the following service providers:
- OVH SAS (Roubaix, France): hosting of the website.
- Microsoft Ireland Operations Ltd: Microsoft 365, our business email, where the form messages and applications are received.
- SendLayer LLC (United States): delivery of the emails sent by this website: the confirmations and whitepaper links you receive, and the notifications of your messages and applications that we receive (including the attached CV).
- Cloudflare, Inc. (United States): the network that protects this website and delivers its pages; it handles the technical data of your visit (IP address, pages requested). When you send a form, Cloudflare Turnstile also checks that it comes from a person and not a robot, using technical data from your browser and connection (IP address, browser type).
Transfers outside the European Union
Microsoft Corporation is certified under the EU-US Data Privacy Framework and also relies on the European Commission’s standard contractual clauses.
Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; its data processing agreement also includes the European Commission’s standard contractual clauses.
SendLayer LLC is based in the United States, where the emails it delivers are processed.
Cookies
This site only uses cookies that are needed for it to work. Under article 82 of the loi Informatique et Libertés and the guidelines of the CNIL, these cookies do not require your consent.
| Cookie | Purpose | Duration |
|---|---|---|
| pll_language | Remembers the language version you use (English or French) | 1 year |
| plx_notice | Remembers that you closed the cookie notice | 1 year |
| wordpress_*, wp-settings-* | Login and preferences of the site administrators only; never set for visitors | Session to 1 year |
We use no analytics, advertising or social-media tracking cookies. The links to LinkedIn are plain links: nothing from LinkedIn is loaded until you click. If we ever add audience-measurement tools, we will ask for your consent first and update this policy.
Your rights
You can ask to access your data, to correct or delete it, to restrict its processing, to object to its processing (in particular when it is based on our legitimate interest) and to receive it in a portable format. You can withdraw your consent at any time, without affecting what was done before. Under French law, you can also give instructions on what should happen to your data after your death.
Write to [email protected] or to PLENESYS, 1900 route des Crêtes, 06560 Valbonne, France. We answer within one month. If we have reasonable doubts about your identity, we may ask you for additional information.
If you consider that your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France · www.cnil.fr.
Security
The site is served over an encrypted connection (HTTPS), access to the administration is limited to authorised staff, and the data is hosted in France.
Changes to this policy
We may update this policy, for example when we add a feature to the site. The date at the top shows the latest version. See also our legal notice.