Privacy policy
This policy describes how Atelier d'Étude Volta (ADEV) collects, uses and protects your personal data when you visit the etudevolta.fr website, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
Atelier d'Étude Volta (ADEV), SAS, share capital €1 000, SIREN 989 208 145, RCS Évry.
Registered office: Palaiseau (91120), France.
For any question about the processing of your data: contact@etudevolta.fr. We will reply within a maximum of one month.
2. Browsing data, anonymized analytics
The etudevolta.fr website uses an anonymized, in-house analytics system hosted on the same OVH server as the site. No third-party analytics tool is used (no Google Analytics, no Matomo, no Plausible, no Cloudflare Analytics). We do not perform any visitor profiling.
For each pageview, the following data is collected and stored locally:
- Visitor hash, SHA-256 of (IP address + User-Agent + a random salt that rotates every UTC day). The hash is irreversible and changes daily, making it impossible to follow a visitor across days.
- Country, resolved from the IP address using a local database (db-ip.com Country Lite). The IP itself is never stored.
- Page visited (URL path) referrer domain (host only, no full URL) browser family (Chrome / Firefox / etc., without version) OS family (Windows / macOS / etc.), and whether the device is mobile.
- Maximum scroll depth reached on the page (0–100%) and time spent on the page (capped at 1 hour).
What is NOT stored: raw IP address, raw User-Agent, cookies of any kind, browser fingerprint (canvas / WebGL / fonts), cross-page tracking identifiers.
Legal basis: legitimate interest (GDPR art. 6.1.f), statistical measurement of audience and improvement of the website.
Retention period: 13 months maximum (in accordance with CNIL guidance for analytics).
Compliance: this analytics setup is exempt from prior consent under CNIL deliberation 2020-091, because it is strictly limited to audience measurement, anonymized, and not shared with any third party.
Server logs (HTTPS access logs) are also kept by our host OVH for a maximum of 12 months for technical and security purposes (intrusion detection, debugging). These logs contain the IP address, the requested URL, the timestamp and the User-Agent. They are not used for marketing or profiling purposes. Legal basis: legitimate interest (GDPR art. 6.1.f), technical security of the site.
3. Contact form
When you submit the contact form, we collect the following data:
- Last name and first name
- Email address
- Company / organisation (optional)
- Subject and message
- Browser and language information (User-Agent)
- IP address (hashed, retained for 1 hour for anti-spam protection only)
Purpose: replying to your request, qualifying business projects, sending a commercial proposal where applicable.
Legal basis: legitimate interest (GDPR art. 6.1.f), responding to an enquiry you initiated yourself and qualifying business projects, and, where applicable, pre-contractual measures taken at your request (GDPR art. 6.1.b). The form is filled in voluntarily; no consent checkbox is required because the processing is limited to handling your enquiry.
Retention period: 3 years after the last contact for cold leads, 5 years after the end of a contractual relationship for active customers (commercial accounting obligations).
4. Anti-spam protection
The contact form integrates a local anti-spam mechanism: a simple question (mathematical or general knowledge) generated server-side, signed with HMAC-SHA256. The user must answer correctly to submit the form.
No data is transmitted to any external service (no Google reCAPTCHA, no Cloudflare Turnstile, no hCaptcha). We made this deliberate choice to preserve our visitors' privacy and to maintain consistency with our activity (we work on sensitive projects in space and defence electronics).
5. Sub-processors and transfers
To operate, our website relies on the following providers:
- OVH SAS (France), web hosting and email. French company, data stored in France. No transfer outside the EU.
No other provider is involved. Typography fonts are self-hosted on our server (no request to Google Fonts or any other CDN). The site therefore loads no third-party resource from outside the European Union, ensuring a 100% EU data flow.
6. Cookies and similar technologies
The public etudevolta.fr website does not deposit any cookie on visitors' browsers. No tracking cookie, no advertising cookie, no analytics cookie. No data is collected for profiling, retargeting or behavioural analysis purposes.
A single technical session cookie is used only on the private administration interface (/admin), accessible to ADEV staff only and protected by username + password. This cookie is strictly necessary for authentication and is exempt from prior consent under article 82 of the French Data Protection Act.
As a result no consent banner ("cookie banner") is displayed to visitors, in accordance with the CNIL recommendation of 17 September 2020 (deliberation 2020-091).
7. Brochure download form
When you request the ADEV brochure by submitting the dedicated form, we collect:
- Your professional email address (mandatory)
- Your company / organisation (optional)
- Your country (resolved from IP, IP itself not stored)
- Source domain (referer host, e.g. google.com)
Purpose: deliver the brochure, qualify business leads, and contact you about ADEV's engineering services if relevant.
Legal basis: explicit consent (GDPR art. 6.1.a), you tick the consent checkbox before submission.
Retention period: 3 years from your last interaction with ADEV.
You can request the deletion of your data at any time by emailing contact@etudevolta.fr.
8. Your rights
In accordance with the GDPR, you have the following rights regarding your data:
- Right of access to your data
- Right of rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to withdraw your consent at any time
- Right to lodge a complaint with the CNIL (French data protection authority)
To exercise any of these rights, write to us at contact@etudevolta.fr. We will reply within a maximum of one month.
9. Data security
We implement reasonable technical and organisational measures to protect your data:
- Forced HTTPS / TLS 1.2+ on the entire site
- Modern security HTTP headers (HSTS, CSP, X-Frame-Options, etc.)
- Server-side input validation (sanitisation, length limits)
- Per-IP rate-limiting on the contact form (anti-bruteforce)
- IP hashed and retained for only 1 hour for anti-spam purposes
- Email notifications signed via SPF / DKIM / DMARC
Despite these measures, no system can be 100% secure. In the event of a personal data breach, we will inform you without undue delay if there is a high risk to your rights and freedoms (GDPR art. 34).
10. Updates to this policy
This policy may be updated to reflect changes in our practices or applicable regulations. The publication date below indicates the version currently in force. Any substantial change will be communicated by a clear notice on the site for a minimum of 30 days.