Privacy policy

This privacy policy describes how PARADEYES collects, uses, retains and protects the personal data of users of the paradeyesagency.com website, the dashboard.paradeyesagency.com client dashboard and the IRIS conversational agent, collectively referred to below as the Services.

It is drafted in compliance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, or GDPR) and the amended French Law no. 78 17 of 6 January 1978 (the French Data Protection Act).

1. Data controller

The controller of personal data processing is:

PARADEYES SASU, share capital 1,000 € 40 rue de Meudon, 92100 Boulogne Billancourt, France Nanterre Trade and Companies Register 994 727 154 Email: hello@paradeyesagency.com

Represented by Mr Basilide Baptiste Gonot, President.

When PARADEYES processes personal data on behalf of a client (for example, content and files stored by a client in their dashboard workspace), PARADEYES acts as a processor within the meaning of Article 28 of the GDPR. The conditions of this processing are described in the Terms and Conditions.

2. Data protection contact

Given the nature and scope of the processing carried out, PARADEYES is not required to appoint a Data Protection Officer within the meaning of Article 37 of the GDPR. An internal contact nonetheless oversees compliance and handles requests to exercise your rights.

Any request regarding personal data may be sent to:

Email: hello@paradeyesagency.com Post: PARADEYES, Data Protection Contact, 40 rue de Meudon, 92100 Boulogne Billancourt

3. Personal data collected and purposes

PARADEYES collects and processes the following categories of data, depending on how you use the Services:

3.1 Contact and commercial prospecting data

Data collected: last name, first name, job title, company name, business email, telephone number, content of the message.

Source: contact forms, IRIS conversational agent, appointment booking via Calendly.

Purposes: to respond to information requests, qualify projects, prepare and conduct commercial meetings, produce quotes and agreements, manage the commercial relationship.

Legal basis: performance of pre contractual measures taken at the request of the data subject (Article 6.1.b of the GDPR) and the legitimate interest of PARADEYES in developing its commercial activity (Article 6.1.f of the GDPR).

3.2 Appointment booking data

Data collected: last name, first name, email, telephone, time zone, booked slot, content of the brief.

Source: Calendly booking module integrated into the Services.

Purposes: to schedule appointments, send confirmations and reminders, prepare meetings.

Legal basis: performance of pre contractual measures (Article 6.1.b of the GDPR).

3.3 Data exchanged with the IRIS conversational agent

Data collected: content of exchanged messages, technical session metadata, any contact details voluntarily provided by the user during the conversation.

Source: voluntary interactions between the user and the conversational agent.

Specific processing: messages exchanged with IRIS are transmitted to the API of the language model provider Anthropic to generate contextualised responses. Anthropic retains these messages for thirty days for abuse prevention purposes, without using them to train its models.

Purposes: to provide contextualised responses, qualify needs, propose a follow up contact, improve the relevance of the service.

Legal basis: legitimate interest of PARADEYES in offering a commercial qualification service (Article 6.1.f of the GDPR). Use of IRIS remains optional.

3.4 Newsletter subscription data

Data collected: email, first name (optional), declared interests.

Source: dedicated subscription form.

Purposes: to send editorial communications, agency news, creative and cultural content related to our activity.

Legal basis: explicit consent of the data subject (Article 6.1.a of the GDPR), collected through active opt in. Consent may be withdrawn at any time via the unsubscribe link included in every communication.

3.5 Client dashboard data

Data collected: authentication email, session identifiers, content and files uploaded by the client (briefs, deliverables, project documents), billing information, appointment history, follow up exchanges.

Source: client account created by PARADEYES upon signature of the quote and populated by the client throughout the engagement.

Purposes: to provide the client with secure access to their project content, track the progress of engagements, share deliverables, organise billing, retain the commercial history.

Authentication: sign in is performed via a magic link sent to the client's email address (passwordless system), operated by Supabase.

Legal basis: performance of the service agreement between PARADEYES and the client (Article 6.1.b of the GDPR).

3.6 Navigation data and audience measurement

Data collected: pages viewed, viewing duration, referral source, device type, browser, operating system, truncated IP address, cookie identifiers.

Source: navigation on the Services and audience measurement tools.

Purposes: to understand how the Services are used, measure content performance, improve user experience, measure the effectiveness of advertising campaigns.

Legal basis: user consent collected via the cookie management banner (Article 82 of the French Data Protection Act), with the exception of strictly necessary and anonymised audience measurement, which is based on legitimate interest.

4. Commitment not to enrich incoming data

PARADEYES undertakes not to enrich data collected via the Services with third party prospecting or qualification tools (automated web searches, cross referencing with external databases). The data you entrust to us when you make a contact request, exchange with IRIS, book an appointment or subscribe to the newsletter is used solely for the purpose for which it was collected.

5. Mandatory or optional nature of data

Fields marked with an asterisk on the forms are mandatory for handling the request. If they are not provided, PARADEYES cannot respond. Other fields are optional.

6. Recipients and processors

The data collected is intended for authorised PARADEYES teams acting strictly within the scope of their duties. It may be transmitted to the following processors, who act on behalf of PARADEYES within the meaning of Article 28 of the GDPR:

PARADEYES does not sell, rent or transfer personal data to third parties for commercial purposes.

6 bis. Google Analytics 4

We use Google Analytics 4, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to statistically analyse the use of our site and improve its usability.

Data collected: pages visited, session duration, traffic source, device type, language, country, interaction events (CTA clicks, conversions). No directly identifying personal data is transmitted.

Purpose: audience measurement, site optimisation, conversion tracking.

Legal basis: your consent (Article 6.1.a of the GDPR).

Retention period: 14 months.

Transfer outside the EU: Google may transfer this data to the United States under the Standard Contractual Clauses approved by the European Commission.

Your rights: access, rectification, objection, withdrawal of consent via the cookie management module at the bottom of the page, or by contacting us at hello@paradeyesagency.com.

7. Transfers of data outside the European Union

Some of the processors listed above are located outside the European Union, mainly in the United States. Data transfers are governed by:

• the Standard Contractual Clauses adopted by the European Commission (implementing Decision (EU) 2021/914 of 4 June 2021);
• the EU U.S. Data Privacy Framework, for certified processors;
• where relevant, additional technical and organisational measures (encryption, pseudonymisation).

8. Retention periods

The retention periods applied by PARADEYES are as follows:

• Contact and prospecting data: 3 years from the last contact, in line with the French data protection authority (CNIL) recommendation for B2B prospecting.
• Contractual and billing data: 10 years from the end of the financial year, pursuant to Article L 123 22 of the French Commercial Code.
• Appointment booking data: 3 years from the appointment.
• Conversations with the IRIS agent: 12 months from the last interaction on the PARADEYES side, 30 days on the Anthropic side.
• Newsletter subscriptions: until unsubscription, then deleted within 30 days.
• Project data and files stored in the Dashboard: 12 months from the end of the contract, then permanently deleted. The client may request an export of the content at any time before that deadline.
• Dashboard authentication data: for the duration of the contract, then deleted within 30 days.
• Audience measurement data and cookies: 13 months maximum for information retention, 25 months maximum for aggregated statistics, in accordance with CNIL recommendations.
• Technical security logs: 12 months.

Upon expiry of these periods, the data is either deleted or irreversibly anonymised.

9. Security

PARADEYES implements technical and organisational measures to guarantee the security, integrity and confidentiality of the data processed. These measures include:

• encryption of data flows (HTTPS/TLS) across all Services;
• passwordless magic link authentication for the Dashboard, reducing the risk of credential compromise;
• separation of environments (production, staging, development);
• access control by role and logging of sensitive actions;
• careful selection of processors with regard to their GDPR compliance;
• regular and encrypted database backups;
• regular updates of software dependencies.

No system is infallible. PARADEYES undertakes to notify any data breach likely to result in a risk to the rights and freedoms of data subjects to the competent supervisory authority within 72 hours, and to inform the data subjects concerned as soon as possible when the breach is likely to result in a high risk.

10. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: to obtain confirmation that data concerning you is being processed and to receive a copy.
• Right of rectification: to correct inaccurate data or complete incomplete data.
• Right to erasure: to obtain the erasure of your data under the conditions provided for by the GDPR.
• Right to restriction of processing: to temporarily suspend the processing of your data.
• Right to data portability: to receive your data in a structured, commonly used format, or to have it transferred to another controller.
• Right to object: to object at any time to the processing of your data, in particular for commercial prospecting purposes.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to issue directives regarding the retention, erasure and communication of your data after your death.

These rights may be exercised by email at hello@paradeyesagency.com or by post to the registered office address, providing proof of identity. PARADEYES undertakes to respond within one month of receiving the request, extendable by two months in the event of complexity.

11. Complaint to the CNIL

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority:

CNIL 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 Telephone: +33 1 53 73 22 22 Website: https://www.cnil.fr

12. Cookies and trackers

The use of cookies and other trackers on the Services is covered by a dedicated policy, accessible from the footer under Cookie Policy. The choices expressed via the consent banner may be modified at any time via the Axeptio module accessible from the footer.

13. Automated decisions

The IRIS conversational agent generates its responses through an automated language model. It does not take any decision producing legal effects concerning you or significantly affecting you within the meaning of Article 22 of the GDPR. Any commercial decision (issuing a quote, contracting, refusing an engagement) is taken by a human PARADEYES operator.

14. Amendments to this policy

PARADEYES reserves the right to amend this privacy policy to reflect regulatory, case law or technical developments. Any substantial amendment will be notified on the Services and, where appropriate, communicated to the data subjects concerned by appropriate means.

The last updated date appears at the top of this document.