Privacy policy

01 Data controller

02 Data collected and purposes

Visitors to kalisecu.com

No personal data is collected simply by visiting the site. No tracking, third-party analytics or advertising cookies are set. We only measure aggregate, anonymous statistics (page views, clicks per plan), with no cookie, no stored IP address and no identifier that could recognise you (legal basis: legitimate interest, art. 6.1.f).

Diagnostic or subscription request

• Identity: first name, last name, professional email
• Company: name, address, phone (where applicable)
• Website concerned: URL, technologies, test access (as provided by the Client)
• Electronically signed authorisation document
• Payment data (processed exclusively by our payment provider)

Purposes: delivery of the subscribed service (diagnostic, monitoring, reporting), billing, contractual communication, support, service improvement.

Legal bases: performance of the contract (art. 6.1.b GDPR) for data needed to deliver the service; legal obligation (art. 6.1.c) for billing and accounting retention; legitimate interest (art. 6.1.f) for platform security and fraud prevention.

Technical data produced by the service

While delivering the services, Kalisecu produces and stores technical data about the Client’s site (observed configuration, detected vulnerabilities, recommendations, screenshots). This data is strictly confidential and accessible only to the Kalisecu team and the account holder.

03 Retention periods

• Prospect data (request with no follow-up): 3 years from the last contact.
• Active client data: for the duration of the contractual relationship.
• Reports and technical data: kept for 12 months after the end of the subscription, then deleted or archived at the Client’s explicit request.
• Accounting data (invoices): 10 years, in accordance with article L.123-22 of the French Commercial Code.
• Platform technical logs: 12 months maximum, for security purposes.

04 Hosting and sub-processors

All operational data (reports, personal space, service database) is hosted in mainland France, with no transit through servers outside the EU.

All sub-processors have signed a data processing agreement (DPA) compliant with articles 28 and 32 of the GDPR. No data is transferred to jurisdictions lacking an adequacy decision from the European Commission.

05 Security

Personal and technical data is protected by the following measures:

• Encryption in transit (TLS 1.2 minimum) and at rest
• Multi-factor authentication on administrator accounts
• Strict per-client isolation (logical multi-tenancy)
• Access logging and quarterly review
• Encrypted backups, tested restore
• Documented breach-notification procedure (authority within 72h)

06 Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access: obtain confirmation and a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: request deletion (subject to legal obligations)
• Right to restriction of processing
• Right to portability: retrieve your data in a structured format
• Right to object to processing based on legitimate interest

To exercise a right, write to bonjour@kalisecu.com. We reply within one month at the latest. You also have the right to lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris, France).

07 Changes to this policy

This policy may be updated to reflect legal or organisational changes. The last-updated date is shown below. Clients are notified by email of any substantial change.