Privacy and cookie policy

This site is deliberately simple: it sets no cookie, calls on no external analytics service and asks you to create no account. We count page views with an in-house mechanism that tracks nobody, described in section 8. The only personal data we process is what you send us yourself, by email.

1. Data controller

GRAVOSIG, 1 rue Saint Materne, 67220 Neubois, France — company number 852 566 009, operating the RB2S Conseil and RB2S IT Services brands. For any question about personal data: contact@rb2s.com. Given the nature and volume of our processing, we are not required to appoint a data protection officer; requests are handled by the company president.

2. Data processed, and where it comes from

• Data you send us: name, job title, company, email address, telephone number and the content of your message, when you write to contact@rb2s.com or reply to a quotation.
• Server logs: for security and diagnostic purposes, our host records the IP address, the date and time of requests, the page requested and the browser type. These logs are not used for commercial purposes.
• Messages sent to the site assistant: what you type into the assistant window, and the page you are writing from. Your IP address is used only to cap the number of questions per hour and to prevent abuse; it is tied to no profile. Conversations are not kept on our servers beyond the time needed to answer.
• Service delivery data: under a managed IT or hosting contract, we process the data needed to deliver the service (user accounts, asset inventory, tickets). That processing is covered by a data processing agreement under Article 28 GDPR, in which you remain the controller.

We collect no special category data within the meaning of Article 9 GDPR, and we neither buy nor sell prospecting lists.

3. Purposes and legal bases

• Answering your request, preparing a quotation and pre-contractual discussions — performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b)).
• Delivering and invoicing our services, providing support and managing the client relationship — performance of a contract (Art. 6(1)(b)).
• Keeping the site and our systems secure and working — legitimate interest (Art. 6(1)(f)).
• Meeting our accounting, tax and legal obligations — legal obligation (Art. 6(1)(c)).
• Sending you information about our services as a business customer — legitimate interest, with the right to object at any time by simply replying.

4. Retention periods

• Enquiries that go no further: three years from the last contact.
• Contracts, signed quotations and invoices: ten years, in line with accounting obligations.
• Operational data linked to a contract: for the duration of the contract, then deleted or returned within three months of its end.
• Server logs: as applied by our host, not exceeding twelve months.

5. Recipients and processors

Your data is neither shared nor sold to third parties for commercial purposes. It is accessible only to those within GRAVOSIG who need it, and to the following providers:

• OVH SAS (France) — hosting of this site and server logs.
• Microsoft Ireland Operations Ltd — Microsoft 365 email and office suite hosted in the European Union. For certain support operations Microsoft may access data from third countries; such transfers are covered by standard contractual clauses and the EU–US Data Privacy Framework.
• Google Ireland Ltd — the site's typefaces are currently loaded from Google Fonts, which transmits your IP address to Google when pages load. We plan to serve the fonts from our own server, which will remove that request.
• The artificial intelligence model provider — messages typed into the site assistant are passed to it, through our server, for as long as it takes to produce the answer. Do not write confidential or personal data there: for anything covered by business confidentiality, write to us directly.
• Our accountant and, where applicable, our legal advisers, for contractual and accounting documents.

6. Transfers outside the European Union

Our processing takes place within the European Union. The hosting and colocation services we offer are delivered exclusively in France, in our machine room in Sélestat, on dedicated hardware: no extraterritorial legislation such as the US Cloud Act applies to them. The only possible transfers are those listed in section 5, covered by appropriate safeguards.

7. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to set instructions on what happens to your data after your death. To exercise them, write to contact@rb2s.com; we answer within one month. If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr, or with the supervisory authority of your own country.

8. Cookies and trackers

This site places no cookie on your device: no analytics cookie, no advertising cookie, no social network cookie. No consent banner is therefore needed.

Our audience measurement is in-house and anonymous. For each page viewed, our server records the page address, the language and, where applicable, the domain name of the site that brought you here. To tell visitors apart without identifying them, your IP address and browser are reduced to a short fingerprint, hashed with a salt that changes every day: from one day to the next no correlation is possible, and the fingerprint cannot be traced back to you. Nothing is stored on your device, nothing is sent to a third party, and nothing is cross-referenced with any other processing. Only daily totals are kept, for at most thirteen months.

Loading typefaces from Google Fonts, mentioned in section 5, places no cookie but does involve a connection to a third-party server.

9. Security

The site is served over HTTPS only. Our accounts are protected by multi-factor authentication, backups are encrypted, and access to client systems is named and logged. In the event of a data breach likely to create a risk to your rights, we notify the CNIL within 72 hours and inform you without undue delay.

10. Changes

This policy may be updated to reflect technical, legal or organisational changes. The date of the last update appears at the top of the page.