This is an English translation. For business clients, the French version prevails in case of discrepancy; for consumers, any ambiguity is interpreted in their favour.
This policy explains how SYHEA Group SAS processes your personal data in accordance with the EU General Data Protection Regulation (GDPR) and French data protection law.
1. Controller
SYHEA Group SAS, 8 Rue des Epinettes, 78630 Morainvilliers, France. Contact: contact@syheagroup.com.
2. Data, purposes and legal bases
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering contact and quote requests | Name, email, phone, company, subject, project type, package, budget, message | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) | 3 years from last contact |
| Client management (quotes, contracts, invoicing, support, plan cancellations) | Identity, contact and billing details, correspondence | Contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) | Duration of the relationship, then 5 years; accounting records: 10 years |
| Site security and abuse prevention | IP address, technical connection data | Legitimate interest (Art. 6(1)(f)) | A few minutes in memory for rate limiting; technical logs: short period set by the host, then deleted automatically |
Mandatory fields. First name, last name, email, subject and message are required to handle your request; without them we cannot reply. Other fields are optional.
No automated decision-making or profiling takes place. Your data is never sold.
3. Recipients and processors
| Recipient | Role | Location | Safeguards |
|---|---|---|---|
| Vercel Inc. | Website and form hosting | USA | Data Privacy Framework (DPF) certified and standard contractual clauses |
| Plus Five Five, Inc. (Resend) | Delivery of form emails | USA | DPF certified and standard contractual clauses |
| OVH SAS | Receiving and storing our emails | France | European Union |
| Accountant, bank, invoicing tool | Invoicing and accounting (clients only) | France / EU | European Union |
You can obtain a copy of the safeguards covering transfers outside the EU by emailing contact@syheagroup.com. Data may also be disclosed to public authorities where the law requires.
4. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to give instructions on what happens to it after your death. Contact contact@syheagroup.com or write to our registered office; we reply within one month.
You may lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr), or with the supervisory authority of your EU country of residence.
Data Protection Officer. We have not appointed a DPO, as one is not required for our processing. Contact contact@syheagroup.com with any question.
5. Security
HTTPS encryption, security headers, rate limiting, input validation, restricted access and data minimisation.
6. Cookies
The site uses no advertising or analytics cookies requiring consent. Details in our cookie policy.
7. Minors
Our services are intended for businesses and adults. Children under 15 should not send us personal data without parental consent. We do not enter into contracts with unemancipated minors.
8. Client projects
When we build or host a website for a client, we act as a processor under Article 28 GDPR for that client's data; the related commitments are set out in our terms of sale.