Privacy Policy

The data controller is:

• ORBITALMZ SAS, a French simplified joint-stock company (SAS) with share capital of €5,000, registered with the Grasse Trade and Companies Register (RCS) under number 108 992 595
• Registered office: 6 Chemin du Vallon Notre Dame, 06140 Vence, France
• Represented by its President, Dr Héloïse MAUREL
• Contact for any question relating to personal data: contact@orbitalmz.com

This Policy covers only data processed via the Site. The data you entrust to us as part of an engagement (AI test, audit, installation) is processed by OrbitalMZ as a processor, on your behalf, in accordance with the engagement contract and its data processing agreement.

We only collect data strictly necessary for the purposes described in Article 3.

Via the diagnostic questionnaire:

• your answers (technical and organisational information about your company). They are processed in your browser and are not sent to us unless you book the video call;
• at the end of the diagnostic, the labels of the answers you chose pre-fill the calendar field “Ce qu'il est utile de savoir avant la visio” (what is useful to know before the call), to prepare the call. They are kept in your browser tab, for the calendar of the Contact page, until you change your need or close the tab. The calendar receives them in your browser, without them passing through the address of a page or through our servers. You can review, edit or delete them; they are only recorded if you confirm the booking.

Via the video call booking (Cal.com calendar, self-hosted free software):

• mandatory: name, business email address, company and chosen time slot;
• optional: website, LinkedIn profile and the field “Ce qu'il est utile de savoir avant la visio”;
• where applicable, the email addresses of the people you invite to the call: OrbitalMZ informs each of them in the invitation email, with a link to this Policy.

The booking is recorded in the calendar, hosted on our server in the European Union. Confirmation and invitation emails are sent from rdv@orbitalmz.com (Gandi email), a mailbox used only for this purpose.

Via your emails to contact@orbitalmz.com: your email address and the content of your messages.

Via the video call (Jitsi Meet or, as a backup, MiroTalk): display name you choose; IP address and technical connection data needed for the call. OrbitalMZ does not record or transcribe the call: recording, streaming and transcription features are disabled on our servers. We ask every participant not to record the call without everyone's consent.

Via the servers' technical logs: IP address, date and time, page requested.

We do not ask for any “sensitive” data within the meaning of Article 9 GDPR (health, opinions, biometrics): please do not include any in the notes or in your messages. Some questions concern the type of data your company processes (for example health data) or the people affected by an AI project (applicants, employees): they describe your activity and do not concern any specific individual. Do not enter any personal data about your customers or employees.

Each processing operation rests on an explicit legal basis:

• Replying to your emails and sending you a quote after the video call — legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR)
• Keeping a record of our exchanges so that your request can be followed up later — legal basis: OrbitalMZ's legitimate interest in managing its business relationships (Art. 6(1)(f) GDPR)
• Organising and holding the video call (Cal.com calendar, Jitsi Meet video or, as a backup, MiroTalk, confirmation emails sent from rdv@orbitalmz.com) — legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR)
• Sending the invitation to, and holding the call with, the people you invite — legal basis: OrbitalMZ's legitimate interest in organising the meeting requested by the person who booked it (Art. 6(1)(f) GDPR)
• Preparing the video call from your diagnostic answers and the optional calendar fields — legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR)
• Displaying the diagnostic questionnaire and keeping your progress in your browser — legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR)
• Securing the Site, the calendar and the video call (server technical logs) — legal basis: OrbitalMZ's legitimate interest in protecting its services (Art. 6(1)(f) GDPR)
• Fulfilling legal obligations (accounting, responses to authorities) — legal basis: legal obligation (Art. 6(1)(c) GDPR)

The mandatory fields of the calendar (name, business email address, company) are needed to set up the appointment: without them, we cannot confirm it. The other fields are optional.

No data is used for unsolicited commercial prospecting, profiling or fully automated decision-making.

We retain data only for as long as strictly necessary for the purposes pursued:

• Video call bookings (including optional fields and notes from the diagnostic) and emails, that do not proceed: 3 years from your last contact on your own initiative (message, reply to an email, appointment), then erasure from the calendar and the mailbox.
• Backups of the calendar database: one copy per day, on the same server, kept for 14 days then deleted automatically. Data erased from the calendar therefore disappears from the backups within 14 days at the latest.
• Invitees' email addresses: same period as the booking to which they relate.
• Request followed by a contract: for the whole contractual relationship, then archived for the statutory limitation period (5 years) and, for accounting records, for 10 years.
• Video call (Jitsi Meet or MiroTalk): OrbitalMZ does not record or transcribe the call: recording, streaming and transcription features are disabled on our servers. We ask every participant not to record the call without everyone's consent. No content (image, sound, chat) is kept after the call; technical connection data follows the server log retention below.
• Diagnostic questionnaire answers: kept only in your browser, so that you can resume the questionnaire, until you restart the diagnostic or clear your browsing data; the labels prepared for the calendar stay in the tab until you change your need or close the tab; if you book the video call, the labels attached to the booking notes follow the retention of appointment requests above (3 years if the request does not proceed, or the duration of the contractual relationship).
• Server technical logs (security): 1 year maximum, then automatic deletion.

At the end of these periods, data is deleted or irreversibly anonymised.

Data is intended exclusively for authorised ORBITALMZ personnel. We only use the technical processors needed to operate the Site:

• OVH SAS (OVHcloud) (registered office in Roubaix, France) — dedicated server located in the European Union, hosting the Site, its files (images, fonts), the Cal.com calendar with its database and backups, Jitsi Meet video and the MiroTalk backup video.
• Gandi SAS (63-65 boulevard Masséna, 75013 Paris, France) — email: receiving your messages at contact@orbitalmz.com and sending booking emails from rdv@orbitalmz.com.

The Cal.com calendar, Jitsi Meet video and the MiroTalk backup video are free software installed and operated by OrbitalMZ on its own server: their publishers receive no data. We use no third-party public video service.

Each of these processors acts on the instructions of the data controller, under the processing clauses compliant with Article 28 GDPR provided for in its contract.

No data is transmitted to advertising networks, data brokers or third parties outside the above list.

All processing, including the calendar, video calls and email, is operated on infrastructure located within the European Union (OVHcloud and Gandi data centres in the European Union).

No personal data is transferred outside the European Union. OrbitalMZ applies a European digital sovereignty doctrine (100% EU) across its entire infrastructure.

The Site does not measure its audience: no visitor statistics tool is installed on it. It sets no advertising or tracking cookies.

The Site sets no cookie requiring your consent. It only stores in your browser the language chosen (session cookie and local storage), the display theme chosen, the dismissal of the information banner and the questionnaire progress; the calendar and the video call likewise keep your display settings (name, microphone, camera): this information stays on your device and is not sent to us.

This information is strictly necessary for the Site to work: it is exempt from consent pursuant to Article 82 of the French Data Protection Act.

Pursuant to Articles 15 to 22 GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation that data concerning you is being processed and receive a copy.
• Right to rectification (Art. 16): obtain correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): obtain deletion of your data, subject to legal retention obligations.
• Right to restriction (Art. 18): obtain limitation of processing in certain cases.
• Right to portability (Art. 20): for the data you provided to us and that is processed for pre-contractual measures, receive it in a structured, machine-readable format.
• Right to object (Art. 21): object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (security logs, business relationship follow-up, organising the call with the people you invite).
• Right regarding automated decisions (Art. 22): not be subject to a fully automated decision. OrbitalMZ makes no such decision via the Site.
• Instructions after death: set instructions for the retention, erasure and communication of your data after your death.

How to exercise your rights: by sending an email to contact@orbitalmz.com or by post to our registered office (6 Chemin du Vallon Notre Dame, 06140 Vence, France). We respond within one month of receiving your request. Taking into account the complexity or number of requests, this period may be extended by a further two months; we will then inform you within one month of receiving your request, stating the reasons for the delay (Article 12(3) GDPR). Exercising your rights is free of charge.

If you are dissatisfied, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, www.cnil.fr.

ORBITALMZ implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR:

• encryption in transit (HTTPS) across the Site, the calendar and the video call;
• internal access restricted to authorised persons, on a least-privilege basis;
• server technical logs kept for one year at most;
• daily backup of the calendar database on the server, in the European Union, kept for 14 days.

In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours at the latest after becoming aware of it (Article 33 GDPR), and inform you individually if the risk is high (Article 34 GDPR).

OrbitalMZ has not designated a Data Protection Officer (DPO), as the mandatory designation conditions set out in Article 37 GDPR are not met (no large-scale processing of sensitive data, no systematic large-scale monitoring, not a public authority).

OrbitalMZ reviews annually whether the designation of a DPO is required, taking into account the evolution of data volumes and the nature of processing, and will proceed with such designation without delay should any criterion of Article 37 GDPR become applicable.

Any question or complaint relating to data protection must be addressed to contact@orbitalmz.com.

The competent supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL), with which you may lodge a complaint at any time (www.cnil.fr).

This Policy may be updated to reflect changes in processing operations or applicable regulations. The version in force is available on the Privacy Policy page, and the last update date is indicated at the top of the document.

In the event of a substantial modification affecting your rights or data already collected, we will inform you by an appropriate means (information banner on the Site, email).