This page tells you, in plain language, what we do with your information when you visit this site, contact us or register for a training.
Last updated · 31 October 2026
What you need to remember.
01
We only collect what we need to reply to you, manage your training registration and, if you wish, send you our publications.
02
No tracking cookies, no advertising pixels. Only cookieless audience measurement, which can neither identify you nor follow you from one site to another.
03
Your data stays stored in the European Union when technically possible. When it isn’t, we cover the transfer with the European Commission’s standard contractual clauses.
04
You can access your data at any time, have it corrected or deleted, and unsubscribe from the newsletter in one click.
01
Who decides what’s done with your data.
The data controller within the meaning of Article 4(7) GDPR is:
Company name
Pills.
Legal form
EURL (single-member limited liability company under French law)
SIREN
884 060 013
Registered office
289 chemin de la Qualité, 34980 Montferrier-sur-Lez
Given the size of the activity (sole practitioner), Pills. is not required to designate a Data Protection Officer (DPO). For any question about your data, you can still write directly to the address above.
02
What we collect, and why.
2.1 · You write to hello@pills.legal, or you book a slot in our online calendar
Data
First name, last name, email address, company, role, the content of your message
Purpose
Reply to your request, call you back, send you an engagement proposal
Legal basis
Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR): replying to your enquiry and, if you wish, sending you a proposal
Retention
3 years after our last exchange
2.2 · You subscribe to our publications from the Publications page
Data
Email address
Purpose
Send you our publications
Legal basis
Consent (Art. 6(1)(a) GDPR), with double opt-in by confirmation email
Retention
Until you unsubscribe (one click on the link at the bottom of every send)
2.3 · You write to us from the form on the Contact page
Data
First name, last name, work email, organisation, subject and message; phone and job title if you provide them
Purpose
Answer your request
Legal basis
Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR)
Retention
3 years after our last exchange
2.4 · You register for a training on the Training page
Data
First name, last name, email, phone, job title, organisation, AI tool used; who to invoice: company name, SIRET or SIREN, VAT number, purchase order, postal address; for one-to-one coaching, your possible days; the date and time you accepted the terms of sale and, if you buy as a private individual, your request to start before the end of the withdrawal period
Purpose
Record your registration, send you its confirmation with our terms of sale, run the training, issue the invoice, keep proof of the contract
Legal basis
Performance of the contract (art. 6.1.b GDPR); legal accounting and evidence obligations (art. 6.1.c GDPR)
Retention
3 years after the training ends for the relationship; 10 years for invoices (art. L123-22 French Commercial Code) and for proof of a contract of €120 or more with a private individual (art. L213-1 French Consumer Code)
2.5 · You join the waiting list of a full session
Data
First name, last name, email, organisation, message
Purpose
Tell you when the next session opens
Legal basis
Pre-contractual steps taken at your request (art. 6.1.b GDPR)
Retention
Until the next session opens, 12 months at most
2.6 · You attend a training by video on Microsoft Teams
Data
Your name, image and voice during sessions, your messages in the discussion group, session recordings
Purpose
Deliver the training and let you watch sessions again
Legal basis
Performance of the contract (art. 6.1.b GDPR). You can turn off your camera and microphone at any time
Retention
Recordings and discussion group: 3 months after the last session
2.7 · You look up your company in the registration form to fill in the invoicing details
Data
The company name or SIREN you type
Purpose
Pre-fill the company name, SIRET, VAT number and address from the public business register
Legal basis
Pre-contractual steps taken at your request (art. 6.1.b GDPR)
Retention
24-hour technical cache; your IP address is not sent to the register
2.8 · You browse the site
Data
Technical logs: IP address, browser type, pages visited, timestamps
Legitimate interest (Art. 6(1)(f) GDPR): keeping the site operational
Retention
12 months maximum (our host’s logs)
2.9 · You submit a form
Data
A non-reversible fingerprint of your IP address or email (never the address itself)
Purpose
Limit abusive submissions and protect training places
Legal basis
Legitimate interest (art. 6.1.f GDPR): the security of the site and our services
Retention
24 hours at most
What we don’t do
We never sell your data to third parties.
We use no advertising cookies, no social network pixels and no profiling tools.
We do not profile your visits and make no automated decisions about you.
We do not cross-reference what you entrust to us with third-party databases.
03
Who receives your data.
Your data is accessible only to Steve Chrétien, in his capacity as data controller. We use the providers below, strictly necessary to operate the site, deliver the trainings and our relationship with you.
Vercel Inc.
Purpose
Site hosting; audience measurement (Vercel Web Analytics) and performance measurement (Speed Insights), with no cookies
Location
United States (parent company), with processing in an EU region (Paris) for served content
Guarantees
European Commission’s standard contractual clauses. SOC 2 Type II and ISO 27001 certifications.
Resend (Drasner, Inc.)
Purpose
Sending emails (replies, registration confirmations, newsletter) and managing the newsletter list
Location
United States (parent company), EU region (Ireland) selected for storage
Guarantees
Standard contractual clauses. Documented GDPR compliance. Data stored in the EU.
Plausible Insights OÜ
Purpose
Cookieless audience measurement for the site
Location
European Union (Estonian company, servers in the EU)
Guarantees
Processing within the European Union. No cookies, no persistent identifiers, aggregated data.
Lemcal (LEMPIRE SAS)
Purpose
Online appointment booking (calendar)
Location
France (LEMPIRE SAS, Paris), databases hosted in the European Union
Guarantees
Databases hosted within the EU. Any transfers are covered by an adequacy decision or the standard contractual clauses.
Microsoft 365 (Microsoft Ireland Operations Ltd)
Purpose
Mailbox for hello@pills.legal (receiving your messages and registrations); video sessions, recordings and discussion group of the trainings (Microsoft Teams)
Location
Ireland (Microsoft Ireland Operations Ltd), data stored in the European Union; parent company in the United States
Guarantees
Microsoft EU Data Boundary. Standard contractual clauses and EU–US Data Privacy Framework.
Qonto (Olinda SAS)
Purpose
Online payment for trainings and invoicing
Location
France (Qonto, Paris) and the Netherlands (Mollie), European Union
Guarantees
Payment institution licensed and supervised in France. Card payments go through Mollie, a payment institution licensed in the Netherlands and Qonto’s provider. We never see your card details.
Upstash, Inc.
Purpose
Technical database: training places, form submission limits and tracking of online training payments
Location
United States (parent company)
Guarantees
Counters and non-reversible fingerprints, deleted after 24 hours at most. While a payment is tracked, your registration (name, email, billing details) is kept there encrypted, then deleted 30 days after registration at most. Standard contractual clauses.
API Recherche d’entreprises (DINUM)
Purpose
Public business register, queried to pre-fill invoicing details
Location
France (French State administration)
Guarantees
Public service. Only the text you type is sent, without your IP address.
04
When your data leaves the EU.
Sensitive section. GDPR strictly governs transfers outside the EU. Here is exactly what happens to your data.
Four of our providers (Vercel, Resend, Microsoft, Upstash) have their parent companies in the United States. Plausible, Lemcal and Qonto are established in the European Union. For the US providers, data is stored and processed within the European Union where possible:
Resend
newsletter and email data stored in Ireland (selected EU region).
Vercel
content served from an EU region; technical logs may transit through the United States.
Microsoft
mailbox, recordings and discussion group stored in the European Union (EU Data Boundary).
Upstash
counters and non-reversible fingerprints, deleted after 24 hours at most; for payment tracking, the encrypted registration, deleted after 30 days at most.
When a transfer outside the EU takes place, it is covered by the standard contractual clauses adopted by the European Commission (decision 2021/914), and where applicable by the EU–US Data Privacy Framework.
05
What you can require from us.
GDPR and the French Data Protection Act grant you 8 rights over your personal data. You can exercise them at any time, free of charge, without giving any specific reason.
5.1
Access
Obtain a copy of the data we hold about you.
5.2
Rectification
Correct inaccurate or incomplete data.
5.3
Erasure
Request the deletion of your data (“right to be forgotten”).
5.4
Restriction
Have processing suspended, for example while a dispute is being resolved.
5.5
Objection
Object to processing based on our legitimate interest.
5.6
Portability
Receive your data in a structured, commonly used and machine-readable format.
5.7
Withdraw consent
At any time, without justification. For the newsletter: one click is enough.
5.8
Instructions for after your death
Define what happens to your personal data after your death.
How to exercise them
An email to hello@pills.legal. is enough. We reply within one month, in line with Article 12 GDPR. To unsubscribe from the newsletter, the link at the bottom of each email is enough.
In case of serious doubt about your identity, we may ask for proof of identity before acting, always within the principle of minimisation.
06
No trackers, no pixels.
0tracking cookies
This site uses no advertising cookies, no social network pixels and no profiling tools (Google Analytics, Meta Pixel, Hotjar: none of that).
We use only:
Local storage
Your light or dark theme choice, if you change it. It stays on your device and is never sent to us.
Technical cookies
Our host may set cookies strictly necessary for the site to work (load balancing, security). They are exempt from consent under Article 82 of the French Data Protection Act.
Audience measurement
Plausible Analytics and Vercel Web Analytics count page views and a few actions (clicks to the Contact page and to booking a meeting, newsletter sign-ups, opening a training registration, reaching payment). Vercel Speed Insights measures page performance, with no cookies. No cookies, no persistent identifiers, no cross-site tracking. Data is aggregated: we see volumes, never people.
07
How we protect your data.
7.1
Encryption in transit
All communications with this site go through HTTPS (TLS 1.3).
7.2
Encryption at rest
Data stored at our sub-processors is encrypted at rest (AES-256).
7.3
Restricted access
Only Steve Chrétien can access messages, registrations and the subscriber list, from devices protected by strong authentication.
7.4
Minimisation
We collect only what is strictly necessary for the stated purpose.
7.5
Breach notification
In case of a data breach posing a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform you individually if the risk is high (Articles 33 and 34 GDPR).
If our reply doesn’t satisfy you, you can file a complaint with the CNIL (Commission nationale de l’informatique et des libertés), the French supervisory authority.
31 October 2026 update: added training registration and invoicing, the waiting list, video sessions (Microsoft Teams) and their recordings, pre-filling from the public business register, and protection against abusive submissions. Microsoft, Qonto, Upstash and the public business register join the list of recipients.
17 October 2026
17 October 2026 update: Lemcal, the booking tool, joins the list of sub-processors. Every enquiry (email, form or calendar) now rests on the same legal basis: pre-contractual steps taken at your request.
16 October 2026
16 October 2026 update: typefaces are now served from our own domain, so Google Fonts no longer receives any data and is removed from the list of sub-processors. The first-visit indicator no longer exists; only your theme choice is kept on your device.
9 October 2026
October 2026 update: the ROI calculator, the call for applications and the Pills. Academy waitlist have been removed from the site. The related processing operations have been removed from this policy. Added the contact form and the related processing operation.
14 August 2026
August 2026 update: the contact form has been removed from the site; getting in touch now happens by email or through the online calendar. Added the processing operations tied to the ROI calculator, the Pills. Academy waitlist and calls for applications. Added cookieless audience measurement (Plausible, Vercel) to the sub-processors and to the Cookies section.