Datenschutz und Datenschutz-Grundverordnung (DSGVO)

Purpose, binding effect and hierarchy of norms

This notice (the “Notice”) is issued under Articles 12, 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”), French Act No. 78-17 of 6 January 1978 as amended, CNIL guidance, and, where relevant, Articles 5 and 25 of Regulation (EU) 2024/1689 (EU AI Act) insofar as they require governance of input and output data for high-risk AI systems.

The Notice informs data subjects only. It is not a licence, assignment, admission of liability, performance warranty or waiver of defences. If it conflicts with a separate contract with Fleury Capital, the contract prevails for that contractual relationship; the Notice remains the GDPR information notice.

Use of the Site, forms, legal pages or CandidAct implies awareness of the published version. Fleury Capital may amend the Notice at any time; the version displayed on the day of consultation binds. A prior version does not bind the publisher once replaced, subject to rights already exercised under that version.

Controller, DPO and contact channels

The controller under Article 4(7) GDPR is Fleury Capital, a French SASU with variable capital, RCS Paris 980 921 258, registered office 34 avenue des Champs-Élysées, 75008 Paris, France, SIRET 980 921 258 00011, VAT FR96980921258.

No Data Protection Officer has been appointed under Article 37 where mandatory appointment conditions are not met. Data-protection requests must be sent exclusively via das auf der Website veröffentlichte Kontaktformular, the sole binding channel for rights requests. Postal mail to the registered office may take longer.

Anyone claiming to be a processor, joint controller or recipient must produce the relevant legal title. Absence of a written Article 28 processing agreement bars claims based on that status.

Material and territorial scope

The Notice covers personal-data processing (i) via candidact.com and its locales, (ii) via trial and contact forms, (iii) via the rubric generator when an email is collected, and (iv) via the recruiter app where Fleury Capital acts as controller or processor under contract.

Where a professional customer configures campaigns and assesses candidates, that customer is generally the controller for candidate data; Fleury Capital acts as processor under Articles 4(8) and 28 GDPR within the processing agreement. Claims treating Fleury Capital as controller for processing carried out solely on the customer’s behalf will be contested unless a binding text or decision provides otherwise.

The Notice applies to persons in the EU and, where Article 3 GDPR so requires, to persons outside the EU.

Data categories, sources and optional fields

Depending on forms used: identity and contact data (name, work email, optional phone, company); declarative professional data (role, hiring volume, job title); free-text contact messages; strictly necessary technical metadata (timestamps, locale, anti-abuse tokens, session indicators); optional referral or UTM parameters.

Data are collected from the data subject. No Article 9 special-category data are requested on the public Site. Users must not submit health, biometric, offence-related or other special-category data unless legally required. Unlawful submissions may be deleted without notice; liability rests with the submitter.

Optional fields do not condition Site access. Refusal to provide a mandatory field prevents handling of that request without constituting discrimination.

Specified, explicit and legitimate purposes

Purposes are limited to: (a) handling trial and contact requests; (b) pre-contractual steps at the person’s request; (c) B2B relationship management; (d) security, fraud and abuse prevention; (e) legal obligations; (f) technical improvement within minimisation and, where applicable, after pseudonymisation.

Incompatible purposes under Article 6(4) GDPR are excluded. Contact-form data are not sold, licensed for value, used for third-party behavioural advertising profiling, or merged into purchased prospect lists.

Legal bases (Article 6 GDPR)

Depending on purpose: legitimate interests (Art. 6(1)(f)) to answer unsolicited requests and secure the Site, subject to balancing; pre-contractual steps (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); consent (Art. 6(1)(a)) only where required (e.g. non-exempt trackers), in which case consent is free, informed, specific and withdrawable.

Legitimate interests are not a blanket reuse licence. Objection under Article 21 remains available subject to statutory exceptions.

Retention and archiving

Trial and contact messages are kept for at most twelve (12) months after the last meaningful exchange, then erased or irreversibly anonymised, except: (i) longer legal retention; (ii) establishment, exercise or defence of legal claims; (iii) ongoing administrative investigation; (iv) temporary backup strictly required for restoration.

Security and anti-abuse logs are kept for a proportionate period, generally up to twelve months, unless an incident justifies documented extension.

Recipients and processors

Data are accessible only to authorised Fleury Capital personnel on a least-privilege basis, and to strictly necessary processors: hosting/CDN (including Cloudflare, Inc.), CRM (Attio when configured), transactional email (Resend when configured for the contact form).

Processors are bound by Article 28 terms or Chapter V safeguards for extraterritorial processing. No file resale is authorised. Authorities receive data only under a valid legal request.

Transfers outside the EU/EEA

Some providers may process data outside the EEA. Fleury Capital relies, as applicable, on adequacy decisions, Commission standard contractual clauses, supplementary technical/organisational measures, and/or strictly construed Article 49 derogations.

Internet routing, DNS and caching may involve non-EU infrastructure. That technical fact is neither a GDPR waiver nor authorisation of incompatible processing.

Technical and organisational security measures

Fleury Capital implements Article 32 measures: TLS, access control, logging, environment segregation, minimisation, privacy by design/default, incident procedures. Measures are risk-based and state-of-the-art oriented; they are not an absolute guarantee.

Personal-data breaches are notified under Articles 33 and 34 where required. Requests for exhaustive security disclosure beyond legal requirements may be refused where they would create disproportionate risk.

Data-subject rights and how to exercise them

Under Articles 15–22 GDPR, data subjects have rights of access, rectification, erasure, restriction, objection, portability (where applicable), and rights related to solely automated decisions under Article 22, within statutory limits.

Rights are exercised via das auf der Website veröffentlichte Kontaktformular, with identity and a precise request. Additional identity checks may apply (Art. 12(6)). Response time is one month, extendable under Article 12. Manifestly unfounded, excessive or repetitive requests may be refused or charged (Art. 12(5)).

Complaints may be lodged with the CNIL (cnil.fr) or another competent supervisory authority.

Trackers, cookies and local storage

The Site may use strictly necessary trackers for operation, security, language, theme or session state. Exempt trackers under ePrivacy/CNIL guidance do not require prior consent.

Non-exempt trackers would be stored only after prior consent. Until a consent banner is deployed for such trackers, users may assume only exempt/strictly necessary trackers are used.

Minors

The Site and CandidAct target professionals and are not directed at persons under sixteen (16). Data collected in good faith from a minor will be erased promptly once a legal representative notifies Fleury Capital via das auf der Website veröffentlichte Kontaktformular.

Limits, non-waiver and liability

The Notice describes processing; it does not create rights beyond GDPR and national law. It cannot be used to compel disclosure of trade secrets, source code, full training sets, detailed security configurations or privileged correspondence, except under an enforceable title.

Failure to invoke a provision immediately is not a waiver. Liability is assessed under mandatory law; except for wilful misconduct or gross negligence and within permitted limits, indirect and consequential damages are excluded.

Updates

Fleury Capital may update the Notice for legal, technical or organisational change. The last-update date appears at the top of the page. Continued use after publication implies awareness. Users should review the current version periodically.