This policy describes how the personal data of visitors is collected, used and kept, under regulation (EU) 2016/679, the GDPR, and French law no. 78-17 of 6 January 1978 as amended. It completes the legal notice and the cookie management page.
Who is the data controller
The data controller is S.A.S. PLM, whose registered office is at 73 rue du Château, 92100 Boulogne-Billancourt, France, registered under number 983 663 634, operating the site under the PAT-INDUSTRY trade mark.
Any question on personal data can be addressed to pat-industry@pat-industry.com, or by post to the registered office. A data protection officer has been designated with the CNIL under number DPO-177288, with effect from 28 August 2026. They can be reached at pat-industry@pat-industry.com or by post at the registered office, 73 rue du Château, 92100 Boulogne-Billancourt.
What data is actually collected
Two sources of data, and no other to date.
- The contact form. What you enter yourself: name, possibly role and company, email address, telephone if you provide it, and the content of your message. Exact list of fields: name, company, work email address and the free text describing your process, these four being what lets us answer you; then role, telephone and subject, all optional. A separate optional tick box subscribes you to our publications; that one rests on consent and can be withdrawn at any time. The form also carries an invisible anti-robot check field, holding no personal data, whose content does not travel with your message. Please do not include confidential information about your processes, or sensitive data within the meaning of article 9 of the GDPR.
- Server connection logs. Generated automatically by the hosting: IP address, date and time of the request, page requested, response code, browser and operating system. They serve the operation and the security of the site.
At this stage this site operates no customer area, no online ordering, no profiling and no automated decision-making, and transfers no data to third parties.
Why this data is processed, and on which legal basis
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact form | Receiving your request, answering it, following the professional exchange that follows | Legitimate interest, answering an approach that comes from you |
| Unsolicited communications | Possible sending of information, invitations or a newsletter | Consent, collected separately and revocable at any time |
| Connection logs | Operation of the site, incident diagnosis, security | Legitimate interest (security and availability of the service) and, where applicable, legal obligation |
Answering a request you have made does not suppose your consent: legitimate interest is enough. Any later approach unconnected with that request rests on consent, which can be withdrawn with no reason given.
Who has access to this data
The data is accessible to the people at S.A.S. PLM handling your request, within the limits of what they need, and to technical providers acting as processors within the meaning of article 28 of the GDPR, on instruction and under written contract.
| Provider | Function | Place of processing |
|---|---|---|
| OVH SAS | Hosting of the site | Gravelines, France |
| Brevo | Sending of emails and publications | France |
| Livestorm | Running webinars | France |
| Microsoft Ireland Operations Limited | Business email, receipt and retention of the messages addressed to us | European Union, with possible access from the United States |
| Seafile | Internal storage of working documents and exchanges | Germany |
| Calendly LLC | Online booking of the first conversation | United States, framed by the standard contractual clauses |
This list is exhaustive at the date this policy was updated.
Beyond them, data is disclosed only on a proper judicial or administrative order, or for the defence of a right in law.
How long data is kept
| Data | Period | Starting point |
|---|---|---|
| Messages received through the form, with no commercial follow-up | 3 years | Last contact coming from you |
| Customer data, commercial exchanges | Duration of the relationship, then 3 years | End of the relationship |
| Records of the contractual relationship (contracts, correspondence), kept as evidence | 5 years, in a separate archive | End of the relationship |
| Accounting records (invoices, purchase orders) | 10 years | Close of the financial year |
| Proof of consent to communications | 3 years | Withdrawal of consent or last contact |
| Technical copy of the notification email sent by the site | 7 days | Date of sending |
| Server connection logs | 12 months, at the host; we keep no copy | Date of the request |
The technical copy above is the site’s send log. For seven days it keeps the subject, the recipient and the body of the notification email your message triggers, long enough to confirm that no send has failed. It is purged automatically, and the message itself is kept for the period given on the first line.
Once these periods have run, data is deleted or anonymised. Evidential archives and accounting records are kept separately, with restricted access, and are used only to meet a legal obligation or to defend a right in law.
Data transfers outside the European Union
The hosting of the site entails no transfer outside the European Union. It is provided by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, on a shared Performance offering whose data centre is at Gravelines (eu-west-gra), France. The site’s email sending is handled by Brevo, in France, and browsing data stays within that perimeter: no audience analytics, advertising or behavioural tracking tool is used on this site.
One processing operation involves a provider belonging to a group established outside the European Union: business email. The messages addressed to us are received and kept in a Microsoft 365 business mailbox, provided by Microsoft Ireland Operations Limited. The data is stored in the European Union, and access from the United States remains possible in the course of support and maintenance operations.
That transfer is framed by the standard contractual clauses adopted by the European Commission and by Microsoft’s certification under the EU–US Data Privacy Framework. No data other than the content of the messages you send us voluntarily is concerned.
The content of a message stays under your control: please do not include confidential information about your processes, or sensitive data within the meaning of article 9 of the GDPR. A confidentiality agreement signed before any detailed exchange is the normal route, and we propose it as a matter of course.
Your rights, and how to exercise them
On the data concerning you, you have the rights of access, rectification, erasure in the cases provided by the regulation, restriction, objection to processing based on legitimate interest for reasons relating to your particular situation, and portability of the data you have provided where the processing is automated and rests on consent or on a contract. You can withdraw a consent given at any time, without that withdrawal calling into question the lawfulness of earlier sendings, and set directives on what becomes of your data after your death.
These rights are exercised through pat-industry@pat-industry.com, or by post to 73 rue du Château, 92100 Boulogne-Billancourt, France. An answer is provided within one month, extendable by two months for a complex request, in which case you are informed. Where there is serious doubt about your identity, proof may be requested. It is not kept afterwards.
Complaint to the CNIL
If, after contacting us, you consider that your rights are not respected, you can refer the matter to the Commission nationale de l’informatique et des libertés, the French data protection authority:
CNIL (Service des plaintes, 3 place de Fontenoy, 75007 Paris), telephone +33 (0)1 53 73 22 22, www.cnil.fr, where a complaint can also be filed online.
Data security
The site is served over HTTPS only. Access to its administration is through named accounts, reserved for the people who need it, and the list of those accounts is not publicly exposed. WordPress, its extensions and the theme are kept up to date. The contact form is protected against automated submissions. The host, OVH, makes automatic backups of the site.
No transmission and no storage can be guaranteed inviolable. In the event of a breach likely to give rise to a high risk to your rights and freedoms, you would be informed under the conditions of article 34 of the GDPR.
Last updated: 21 September 2026.