Data protection policy

Last updated: 23 August 2026

NORMYA advises its clients on GDPR compliance. It would be poor form not to be exemplary on our own site. This policy sets out, plainly, the few processing operations we carry out when you visit us or write to us.

I. Controller

The controller is NORMYA, a SASU with share capital of €1,000, registered office at 46 rue de la Duchesse, 44100 Nantes, France, registered with the Nantes Trade and Companies Register under number 898 052 253.

For any question about your data: contact@normya.fr or +33 7 79 82 47 99.

II. The data we collect

When you write to us

This site has no forms. Contact is made by e-mail or telephone. We then receive the data you choose to send us: your name, e-mail address, where applicable your telephone number, organisation and role, and the content of your message.

This data is what you send us on your own initiative. In a first exchange, we invite you to share only what is needed to understand your request.

When you browse the site

Our hosting provider records technical connection logs (IP address, date and time of the request, page requested, browser type), needed to operate and secure the service. We do not use these logs to track individuals.

III. Purposes and legal bases

• Answering your enquiry and discussing your needs — NORMYA's legitimate interest in handling the enquiries addressed to it (Article 6(1)(f) GDPR).
• Preparing a quotation and delivering the engagement if we work together — performance of a contract or of pre-contractual steps taken at your request (Article 6(1)(b)).
• Keeping the site secure and operational — legitimate interest (Article 6(1)(f)).
• Meeting our accounting, tax and legal obligations once an engagement has been invoiced — legal obligation (Article 6(1)(c)).

We do not use your data for automated marketing, profiling or automated decision-making, and we neither sell nor rent it to anyone.

IV. Retention periods

• Enquiry with no follow-up: 12 months from your last contact.
• Contractual relationship: for the duration of the relationship, then archived for as long as needed to meet our legal obligations and defend our rights.
• Accounting records: 10 years, under Article L123-22 of the French Commercial Code.
• Technical connection logs: kept by the hosting provider for the period strictly necessary to secure the service.

V. Recipients

Your data is handled only by those within NORMYA who need to see it.

One processor is involved within the meaning of Article 28 GDPR: Gandi SAS, which hosts the site and the mailboxes, on servers located within the European Union.

Your data may also be shared with our advisers (accountant, lawyer) or with administrative and judicial authorities where the law requires it.

VI. Transfers outside the European Union

No transfer of your data outside the European Union takes place.

VII. Security

The site is served entirely over HTTPS. Access to mailboxes and working tools is protected by strong passwords and reinforced authentication. Appropriate technical and organisational measures are in place to preserve the confidentiality, integrity and availability of your data.

In the event of a data breach likely to result in a high risk to your rights and freedoms, you would be informed without undue delay, in accordance with Article 34 GDPR.

VIII. Cookies and trackers

IX. Your rights

Under the conditions set out in the GDPR, you have the following rights over your data:

• right of access and information;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object, in particular where processing rests on our legitimate interest;
• right to portability, for data you have provided to us and which is processed on the basis of contract or consent;
• right to give directions on what becomes of your data after your death (French law).

These rights may be exercised at contact@normya.fr or by post to NORMYA, 46 rue de la Duchesse, 44100 Nantes, France. We reply within one month. Proof of identity may be requested where there is reasonable doubt as to your identity.

If, having contacted us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

X. Changes to this policy

This policy may be amended to reflect changes to the site, to our practices or to the applicable rules. The date it was last updated appears at the top of the page.

← Back to home