Privacy policy

This policy explains what personal data collabas.com collects, why we collect it, who else handles it and what you can ask us to do about it. It covers this website only.

In short: the personal data this site collects is what you type into the enquiry form and choose to send us, plus audience measurement if — and only if — you accept it. There is no advertising, no profiling and no newsletter, and we do not sell or rent anyone’s data.

Who is responsible

The controller is Collabas, a French société par actions simplifiée (SAS), registered office 24 Résidence le Trimaran, 11370 Leucate, France. Its full registration details are in the legal notice.

We have not appointed a data protection officer — we are not required to. Privacy questions and requests go to contact@collabas.com, which reaches the two of us directly.

What we collect

Your enquiry

The enquiry form asks for your name, your email address, what you would like help with, and a description of the project. You can also add your company or project name and a link to an existing website. Nothing else is asked, and nothing is filled in behind the scenes.

Sending an enquiry is entirely up to you, and there is no consequence to not sending one. Those first four answers are the ones the form requires, because without a name, a way to reply and some idea of the project there is nothing for us to answer; everything after them is optional.

The guided brief, if you use it

After sending an enquiry you can answer a set of optional questions about the project: what you are building, its goals and audience, the scope and features you have in mind, what material you already have, when you would like to launch, and the investment range you are considering. Every question is optional and you can stop at any point. Some answers — the budget range and the timing, for instance — are commercial rather than personal, but they are attached to your enquiry and so are covered by this policy.

Documents you attach, if you attach any

You can upload up to 5 supporting files of up to 15.0 MB each — a brief, requirements, a sitemap, wireframes, a presentation. We do not open them looking for personal data, but whatever they contain reaches us with them, which is why we ask you not to attach anything confidential that is not yours to share.

Technical data

Like every web server, ours records the requests it receives. Those technical logs include IP addresses, and they are kept in our own hosting project rather than by Google on its own account.

When you submit an enquiry your IP address is also counted, briefly and in the server’s memory only, so that a single connection cannot flood the form. It is not written to a database, not attached to your enquiry and not sent to anyone.

Audience measurement, if you accept it

We use Google Analytics to understand how the site is used — which pages are read, how visitors arrive, roughly which country or region they are in, and what kind of device and browser they use. Google derives the approximate location from the IP address and does not report the address itself to us.

It runs only if you accept it. Until you do, nothing is requested from Google and no analytics cookie is written — refusing, or simply ignoring the question, means it never runs at all. You can change your answer at any time with “Manage cookies” in the footer. The cookie policy lists the cookies involved and how long they last.

This measurement tells us how the site performs. It is not used to identify you, to build a profile, or for advertising of any kind, and it is never combined with an enquiry you send us.

Why we use it, and on what basis

• To answer your enquiry — reading it, asking follow-up questions, judging whether the project is one we can do well, and preparing a proposal. This is processing carried out at your request before any contract, under Article 6(1)(b) GDPR.
• To keep a record of enquiries — so that we recognise you if you come back, do not lose an ongoing conversation, and can show how an engagement began. Where no contract follows, we rely on our legitimate interest in managing and following up on business enquiries, under Article 6(1)(f).
• To keep the form working and unabused — the rate limiting described above, and the checks on uploaded files. Our legitimate interest in the security of the site, under Article 6(1)(f).
• To meet our legal obligations — once you become a client, accounting and commercial record-keeping under French law, under Article 6(1)(c).
• To measure how the site is used — your consent, under Article 6(1)(a), given through the banner and withdrawable at any time from “Manage cookies” in the footer. This is the only thing on this site we ask your permission for.

We do not ask you to consent to the rest of it, because consent is not the right basis for answering a message someone chose to send us — and a form that made you tick a box before it would reply would be asking for permission it does not need.

We do not send marketing emails, we run no newsletter, and we do not use your enquiry to build a profile or to make any automated decision about you.

Who else handles it

These providers process personal data on our behalf, under contracts that require them to act only on our instructions and to protect it:

• Google Cloud — Google Cloud France, established in France, as part of the Google group. Hosts this website and runs the server that receives enquiries. Keeps the technical logs any web server keeps.
• Google Analytics — Google Ireland Limited, established in Ireland. Measures how the site is used — pages viewed, roughly where visitors come from, which device and browser they use. It runs only for visitors who have accepted it, and never before.
• Attio — Attio Limited, established in the United Kingdom. The CRM where your enquiry, your brief answers and any documents you attach are recorded, so we can pick the conversation up and answer it.

What reaches our CRM is your name, your email address, and the content of your enquiry, your brief answers and any files you attached. Your IP address and your browser details are not sent there.

Beyond the providers listed above, we share personal data with no one. We do not sell it, rent it or trade it, and we pass it to public authorities only where the law requires it.

Where it is processed

Google Cloud. Google acts as our processor under its Cloud Data Processing Addendum. Where processing or technical support takes place outside the European Economic Area, that addendum applies the European Commission’s standard contractual clauses. Read Google Cloud’s data processing terms.

Google Analytics. Google acts as our processor under its data processing terms for Google Analytics, which apply the European Commission’s standard contractual clauses where analytics data is handled outside the European Economic Area. Read Google Analytics’s data processing terms.

Attio. Attio acts as our processor under its data processing addendum, which incorporates the European Commission’s standard contractual clauses, together with the UK international data transfer addendum, for transfers outside the EEA and the UK. Read Attio’s data processing terms.

You can ask us for a copy of the safeguards any of these transfers rely on, by writing to contact@collabas.com.

How long we keep it

• Enquiries that do not lead to work: three years from your last contact with us, which is the reference period the CNIL applies to prospect records. After that we delete the record, unless you tell us you would like us to keep it.
• Enquiries that become projects: for as long as we work together, and then for three years from the end of that relationship. Documents we are required to keep for longer — invoices and accounting records, which French commercial law puts at ten years — are archived separately for that period and used for nothing else.
• Documents you attach: with the enquiry they belong to, on the same timetable.
• Server logs: the site runs in our own Google Cloud project, so the request logs belong to us rather than to Google. They are kept for the period configured on that project’s log storage — Google’s default is 30 days — and used only to keep the site running and secure.
• Rate-limiting counts: a few minutes, in memory, and gone when the server restarts.
• Analytics: the cookies expire after 13 months and are not silently renewed; the statistics Google holds for us are kept on the retention period set on our Analytics property. Refusing, or withdrawing your acceptance, clears those cookies from your device.

You can ask us to delete your enquiry sooner, and we will unless we are required to keep it.

Your rights

Under the GDPR you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything inaccurate or incomplete;
• delete it;
• restrict what we do with it while a question about it is being resolved;
• stop processing that rests on our legitimate interest, by objecting to it — we will stop unless we have compelling grounds not to;
• hand you, or another provider, the data you gave us in a portable format, where we process it by automated means for the purposes of a contract or steps leading to one;
• and, for analytics, withdraw your consent whenever you like — “Manage cookies” in the footer, as easily as it was given. Withdrawing does not undo measurement that already happened, which is the only thing withdrawal cannot do.

Write to contact@collabas.com and we will reply within one month. We may need to check that the request comes from you before acting on it.

If you are not satisfied with how we handle it, you can complain to the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

Security

The site is served over HTTPS and the enquiry endpoints validate and size-limit everything they receive. Uploaded files are checked against their declared type before they are stored, and the reference the browser carries between the steps of the enquiry is signed, so an enquiry cannot be read or added to by someone who did not create it. Access to the CRM is limited to the two of us.

Changes to this policy

If what we do with personal data changes, this page changes with it, and the revision date at the top will tell you when. If the change is significant we will say so here rather than leaving you to spot it.

Contact

Collabas, 24 Résidence le Trimaran, 11370 Leucate, France — contact@collabas.com.