Last updated: 22 August 2026
REZA & ASSOCIATES, a French simplified joint-stock company (SAS) with a share capital of €2,000, registered with the Paris Trade and Companies Register under number 842 978 066, with registered office at 66 avenue des Champs-Élysées, 75008 Paris (hereinafter « DPO-SPRING », « we », « us »), acting as data controller within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (the « GDPR ») and of the revised Swiss Federal Act on Data Protection of 25 September 2020 (the « FADP ») (hereinafter together the « Regulations »), attaches great importance to the protection of your personal data and privacy.
This policy (hereinafter the « Policy ») is intended to inform you of how we collect, use and share the personal data you provide us through our website dpo-spring.com (hereinafter the « Website »).
This Policy applies only to the processing of information (hereinafter « Personal Data ») capable of identifying or making identifiable the users of the Website (hereinafter « Users »), directly or indirectly.
As our business is precisely to help organisations comply with the Regulations, we apply to ourselves the same requirements we help our clients meet. We undertake to limit the processing of Personal Data to the cases listed in this Policy, and to keep it up to date.
1. What data do we collect?
The Website is a showcase website. It does not offer user accounts, a client area, comments, file uploads, or online payment.
Data you provide us directly
Via our contact form:
- Your name
- Your email address
- The content of your message
Via our rights request form:
- Your first and last name
- Your email address
- The nature of your request
- Where applicable, a description of your request
- Where applicable, proof of identity, only where there is reasonable doubt as to your identity
Data collected automatically
- Your IP address
- The type and version of your browser, your operating system
- The timestamp of your visit
- Your cookie and tracking preferences
This technical data is collected by our security systems and our consent management platform, solely for the purposes described in section 2.
What we do not collect
We do not collect any special category data within the meaning of Article 9 GDPR and Article 5(c) FADP, any banking data, or any data relating to minors, via the Website. We do not acquire any data from data brokers or third-party sources.
Mandatory fields in our forms are marked as such. If you do not fill them in, we will not be able to process your request.
2. For what purposes do we process your data?
We process your Personal Data for the following purposes only:
- Responding to your information requests and arranging the discovery call you request
- Ensuring the security, integrity and proper functioning of the Website, and preventing intrusion attempts and automated submissions
- Collecting, retaining and proving your consent regarding cookies and trackers
- Processing rights requests addressed to us
- Complying with our legal and regulatory obligations, and where applicable asserting our rights in court
We do not use your data for marketing purposes. The contact details you provide via the contact form are used only to respond to your request. We do not add you to any newsletter without your express request, and we do not disclose, rent or sell your data to anyone.
We do not carry out any profiling or automated individual decision-making producing legal effects concerning you.
3. On what legal basis do we process your data?
| Purpose | Legal basis |
|---|---|
| Responding to your requests via the contact form | Your consent (Art. 6(1)(a) GDPR), or performance of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) |
| Website security and abuse prevention | Our legitimate interest in protecting the Website and its users (Art. 6(1)(f) GDPR) |
| Collecting and proving cookie consent | Our legal obligation (Art. 6(1)(c) GDPR) |
| Processing rights requests | Our legal obligation (Art. 6(1)(c) and Art. 12 GDPR) |
| Retention for evidentiary purposes and legal defence | Our legitimate interest (Art. 6(1)(f) GDPR) |
Cookies and trackers that are not strictly necessary are only placed after your consent has been obtained, which you may withdraw at any time (see section 9).
4. What are your rights?
In accordance with the Regulations, you have the following rights over your Personal Data:
- Right of access: obtain confirmation that your data is being processed and obtain a copy of it
- Right to rectification: have inaccurate or incomplete data corrected
- Right to erasure: obtain the deletion of your data, in the cases provided for by the Regulations
- Right to restriction: obtain the temporary suspension of the processing of your data
- Right to object: object to the processing of your data based on our legitimate interest
- Right to data portability: receive your data in a structured, machine-readable format
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal
- Right to set post-mortem directives concerning the fate of your data after your death
How to exercise your rights
You may exercise all of these rights via our dedicated rights request form, available on this page.
We respond to your request within one month of receipt. This period may be extended by a further two months, taking into account the complexity or number of requests; in that case we would inform you within one month.
Where there is reasonable doubt as to your identity, proof of identity may be requested, solely to reduce the risk of fraud or identity theft. This document is deleted immediately after verification.
Right to lodge a complaint
If, after contacting us, you consider that your rights have not been respected, you have the right to lodge a complaint with a supervisory authority:
In France: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr
In Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch
5. Specific provisions for individuals located in Switzerland
As our business also serves organisations established in Switzerland, we process certain Personal Data falling within the scope of the FADP.
The rights recognised by the FADP are equivalent to those described in section 4, and are exercised in the same way:
- Right of access (Art. 25 FADP)
- Right to the release or transmission of data, equivalent to data portability (Art. 28 FADP)
- Right to rectification of inaccurate data (Art. 32 FADP)
- Right to object to processing, request its erasure or restriction (Art. 32 FADP)
- Right not to be subject to an automated individual decision producing legal effects (Art. 21 FADP)
The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.
6. Who receives your data?
Your Personal Data is strictly confidential. It is intended for our internal team in charge of client relations and compliance, strictly limited to what is necessary for the performance of their duties.
We use the following processors, each bound by a contract compliant with Article 28 GDPR:
| Provider | Role | Location of data |
|---|---|---|
| OVH SAS | Hosting of the Website and email | France (European Union) |
| Usercentrics A/S (Cookiebot) | Management and proof of cookie consent | European Union |
| Google Ireland Ltd / Google LLC (reCAPTCHA) | Protecting forms against automated submissions | European Union and United States (see section 7) |
Our Website is also protected by a security solution that runs directly on our servers. The data it processes, in particular IP addresses associated with intrusion attempts, is stored solely within our hosting in France and is not shared with any third party.
Except where required by law, accounting or judicial obligations, we do not disclose, rent, sell or transfer your Personal Data to any other third party.
7. Where is your data transferred?
The Website and our email services are hosted in France, within the European Union.
Only one of our tools involves a data transfer to the United States:
- Google reCAPTCHA, which protects our forms against automated submissions and, for this purpose, processes your IP address and your interactions with the page
This transfer is covered by the appropriate safeguards provided for in Chapter V of the GDPR, namely the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework for certified providers, supplemented where applicable by the standard contractual clauses adopted by the European Commission.
For individuals located in Switzerland, this transfer relies on the Swiss-U.S. Data Privacy Framework recognised by the Federal Council, or failing that on the standard contractual clauses recognised by the FDPIC.
You may obtain a copy of these safeguards by submitting a request via our rights request form.
8. How long do we keep your data?
Your Personal Data is kept only for as long as is strictly necessary for the purposes pursued. After this period, it is deleted or anonymised.
| Purpose | Legal basis | Active retention period | Archiving |
|---|---|---|---|
| Messages received via the contact form | Consent / pre-contractual steps | 3 years from your last contact | None |
| Rights requests | Legal obligation | 1 year from the response provided | 5 years for evidentiary purposes |
| Proof of identity, where applicable | Legal obligation | Deleted immediately after verification | None |
| Proof of cookie consent | Legal obligation | 6 months from collection, then re-collected | None |
| Security logs and IP addresses | Legitimate interest | 6 months | None |
| Data necessary for legal defence | Legitimate interest | Duration of the applicable statutory limitation period | — |
9. Cookies and trackers
The Website uses cookies and trackers. Cookies strictly necessary for its operation and security are placed without your consent, in accordance with the Regulations. All others are only placed after your consent has been obtained.
You may at any time review the details of the cookies used, accept or reject each category, and change your choices, via the consent management banner accessible from every page of the Website.
You may also configure your browser to reject cookies. This may nonetheless impair certain features of the Website.
10. How do we protect your data?
We implement appropriate technical and organisational measures to ensure the security and confidentiality of your Personal Data, in particular:
- Encryption of exchanges between your browser and the Website (HTTPS/TLS protocol)
- Application firewall and intrusion detection
- Strong authentication and restricted administration access
- Regular updates of the Website’s software components
- Restricting access to Personal Data to authorised personnel only, on a need-to-know basis
- Regular backups
In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours and, where the risk is high, inform you as soon as possible.
11. Changes to this Policy
We may occasionally amend this Policy to comply with regulatory, case law, editorial or technical developments.
Where applicable, we update the “last updated” date at the top of this Policy. Where necessary, we will inform you and, where the Regulations so require, seek your consent again.
We invite you to review this page regularly.
Exercer vos droits
Utilisez ce formulaire pour exercer vos droits. Un justificatif d’identité pourra vous être demandé uniquement en cas de doute raisonnable sur votre identité, et sera supprimé immédiatement après vérification.