Privacy Policy
This privacy policy describes how Orkestr8 / QR Communication collects, uses and protects your personal data when you use the orkestr8.io website, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and applicable data protection law.
1. Data Controller
QR Communication (SAS)
SIREN: 940 163 496
Registered office: 23 rue de Richelieu, 75001 Paris, France
DPO contact: contact@qrcommunication.com
2. Data Collected
We collect only the data strictly necessary for the provision of our services. Here are the categories of data processed:
Contact form
- First and last name
- Professional email address
- Company name (optional)
- Message content
Technical cookies (session and language)
- Language preference (locale)
- Cookie consent (tarteaucitron)
Analytics (with consent only)
- Pages visited and visit duration
- Interface interaction events
- Technical data: browser type, operating system, screen resolution
- IP address (anonymized)
This data is collected via PostHog only if you have accepted analytics cookies.
3. Purposes and Legal Bases
| Purpose | Data | Legal basis | Duration |
|---|---|---|---|
| Responding to contact requests | Name, email, company, message | Legitimate interest (art. 6.1.f) | 3 years |
| Technical operation of the site | Session cookies, language preference | Legitimate interest (art. 6.1.f) | Session / 1 year |
| Cookie consent | Consent choice | Legal obligation (art. 6.1.c) | 13 months |
| Improving the site (analytics) | Pages visited, events, anonymized IP | Consent (art. 6.1.a) | 26 months |
| Sending transactional emails | Email address | Contract performance (art. 6.1.b) | Duration of the relationship |
4. Data Recipients
Your personal data may be shared with the following processors, strictly for the purposes described above:
- Hetzner Online GmbHWebsite hostingGermany (EU)
- Scaleway SASApplication hostingFrance (EU)
- ResendTransactional email deliveryUnited States
- PostHogAnalytics — with consent onlyUnited States / EU (configurable)
- iDrive e2 (IDrive Inc.)S3-compatible object storage (files, documents, backups)France and Ireland (EU)
We never sell your personal data to third parties.
5. Transfers Outside the European Union
Some of our processors are established outside the European Union. In such cases, we ensure that appropriate safeguards are in place:
- Hetzner Online GmbH: hosted in Germany (EU). No transfers outside the EU.
- Scaleway SAS: hosted in France (EU). No transfers outside the EU.
- Resend: governed by the European Commission's Standard Contractual Clauses (SCCs).
- PostHog: can be configured to process data within the EU. Governed by SCCs outside that configuration.
- iDrive e2 (IDrive Inc.): object storage hosted exclusively in France and Ireland (EU). No transfers outside the EU.
6. Retention Period
- Contact data: retained for 3 years from the last contact, then deleted or archived in accordance with legal obligations.
- Technical cookies: maximum duration of 13 months, in accordance with CNIL recommendations.
- Analytics data: retained for a maximum of 26 months in PostHog.
- Server logs: retained for 90 days in accordance with legal obligations (art. L34-1 CPCE).
7. Your Rights
In accordance with the GDPR, you have the following rights regarding your personal data:
Right of access (art. 15)
Obtain a copy of the data we process concerning you.
Right to rectification (art. 16)
Correct inaccurate or incomplete data.
Right to erasure (art. 17)
Request the deletion of your data, within legal limits.
Right to data portability (art. 20)
Receive your data in a structured, machine-readable format.
Right to object (art. 21)
Object to the processing of your data based on legitimate interest.
Right to restriction (art. 18)
Request the temporary suspension of the processing of your data.
Withdrawal of consent
Withdraw your consent at any time for processing based on it (analytics, marketing cookies).
To exercise these rights, contact us at contact@qrcommunication.com. If you are not satisfied with our response, you may lodge a complaint with the CNIL (French Data Protection Authority).
8. Cookies
For detailed information about the cookies used on this site and how to manage them, please consult our Cookie Policy.
9. Policy Updates
We may update this privacy policy at any time. Substantial changes will be notified to you via a visible banner on the site. The date of the last update is indicated at the top of this page.
We encourage you to regularly check this page to stay informed about how we protect your information.
10. Contact — Data Protection Officer
For any questions regarding the protection of your personal data or to exercise your rights, you can contact our data protection officer:
DPO — Orkestr8 / QR Communication
Email: contact@qrcommunication.com
Response time: maximum 30 days (GDPR legal deadline)