Personal data

The site sets no cookies and does not measure its audience. It receives data in four cases, summarised here and detailed below.

The map, the YouTube videos, the automatic translation and the two-player game come from third-party services and only load after a click. They are described in the Third-party content section.

The controller of this processing is Dylan Avronsart EI, trading as NOEMA, who publishes this site. Contact details are in the legal notice.

For any question about your data, write to contact@noemaworks.net.

This page covers the noemaworks.net website. The Nœma mobile app has its own privacy policy, available from within the app.

When you send the quote builder form, your name, your email, your message if any, the chosen services and the estimated total are transmitted. The service receiving the submission also sees your IP address.

Why: to reply and prepare the quote you ask for. Legal basis: steps taken at your request before a contract (article 6(1)(b) GDPR). Name and email are needed to reply to you. The message is optional.

By whom: the form goes through Web3Forms, a service of Web3Creative, a business based in Kerala, India. Web3Forms sends your request to me by email, to the inbox linked to my Web3Forms account. This inbox is contact@noemaworks.net, on my Infomaniak business mailbox described below, in the Emails section. Web3Forms stores submissions with Amazon Web Services and relies in particular on Cloudflare and Hetzner (Germany, Finland). Its anti-spam filters, CleanTalk and Akismet (Automattic), receive your IP address and email. The full list of its sub-processors is in its data processing agreement.

Transfers outside the European Union: to India and the United States. India has no adequacy decision from the European Commission. In its privacy policy, Web3Forms states that it covers transfers from the European Economic Area with the European Commission's standard contractual clauses.

How long: Web3Forms keeps submissions for up to three years, then deletes them automatically. The copy received by email: 3 years after our last exchange if no service follows. If you become a client, the duration of the service plus 5 years, and 10 years for signed quotes and invoices (accounting obligation).

The Feedback page is used to report a bug, ask a question or suggest an idea for the Nœma app. Its online form is closed for now: the page invites you to write to me at support@noemaworks.net. Your message is then an email like any other, handled as described in the Emails section.

Please avoid writing health information in this message: it is not needed to handle feedback.

When you write to me at contact@noemaworks.net or support@noemaworks.net, your email address and the content of your message arrive in my mailbox. This also applies to feedback on the Nœma app sent from the Feedback page.

I send your quotes and invoices from facturation@noemaworks.net, on the same mailbox.

Why: to reply to you. Legal basis: steps taken before a contract if you ask me for a service (article 6(1)(b) GDPR), otherwise my legitimate interest in answering the messages I receive (article 6(1)(f)).

By whom: the domain's email is provided by Infomaniak Network SA, a Swiss company located at Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva). Switzerland benefits from an adequacy decision of the European Commission.

How long: 3 years after our last exchange if no service follows. If you become a client, the duration of the service plus 5 years, and 10 years for signed quotes and invoices (accounting obligation).

Like any web host, Netlify receives on every visit your IP address, technical information about your browser and the address of the requested page. This information is needed to send you the page.

Why: to serve the site, keep it running and protect it from abuse. Legal basis: my legitimate interest in running and securing the site (article 6(1)(f) GDPR).

By whom: Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, United States. Netlify acts as a processor under its data processing agreement. Its own sub-processors are listed on its website.

Transfers: to the United States. Netlify is certified under the EU-US Data Privacy Framework and also relies on the European Commission's standard contractual clauses.

How long: Netlify does not publish a retention period for these logs.

The Mods pages also call a function of the site to show the list of mods. To block abuse, this function keeps your IP address and the time of your requests from the last minute in memory, for as long as the server stays active.

The delivery portal (the /livraison section) is used to hand over the Noema Studio software to my clients, through a personal link protected by a password. The software installed at their premises also contacts this portal for its updates and support requests.

Legal basis: performance of the contract with my clients (article 6(1)(b) GDPR). For anti-abuse, my legitimate interest in protecting the portal (article 6(1)(f)).

Where: this data is stored in Netlify Blobs, Netlify's storage, in its default region in the United States (Ohio). Netlify is certified under the EU-US Data Privacy Framework and also relies on the European Commission's standard contractual clauses.

Four outside services only load if you click: the map of Saint-Étienne on the home page (Google Maps), the videos on the Deltarune page (YouTube), the automatic translation (Google Translate), offered to devices without French among their languages unless their time zone is that of mainland France or a French overseas territory, and the two-player mode of the easter egg (public PeerJS server and connection relays). On click, your IP address goes to these services, which apply their own rules (for Google: Google privacy policy).

Details, service by service, are on the Cookies and storage page.

Your data is only used for the purposes described on this page. I do not sell it and I do not rent it out. The site shows no advertising. No automated decision is made based on your data.

The site is served over HTTPS. Portal passwords are stored hashed and salted (scrypt), never in plain text.

You can ask to access your data, correct it, erase it, restrict its use or object to its processing. For data sent to obtain a quote, you can also ask to receive it in a machine-readable format (portability). You can also set instructions about what happens to your data after your death.

Right to object: for processing based on my legitimate interest (article 6(1)(f) GDPR, stated above for each one), you can object at any time on grounds relating to your particular situation.

To exercise these rights, write to contact@noemaworks.net. I reply within one month. If I have reasonable doubts about your identity, I may ask you for something to verify it.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

I update this page when a processing operation changes. The date at the top of the page shows the latest version.