Your data,
in plain language.
Pills. is a Legal Operations practice. We know what personal data is worth and what the GDPR requires. This page tells you, in plain language, what we do with your information when you visit this site or contact us.
What you need
to remember.
We only collect what we need to reply to you and, if you wish, send you our publications.
We use no tracking cookies, no behavioural analytics, no advertising pixels.
We use cookieless audience measurement. It stores nothing on your device and cannot identify you or follow you from one site to another.
Your data stays stored in the European Union when technically possible. When it isn't, we frame the transfer with the European Commission's standard contractual clauses.
You can at any time access your data, have it corrected or deleted, and unsubscribe from the newsletter in one click.
Who decides
what's done with your data.
The data controller within the meaning of GDPR article 4.7 is:
- Company name
- Pills.
- Legal form
- EURL (single-member limited liability company under French law)
- SIREN
- 884 060 013
- Registered office
- 289 chemin de la Qualité, 34980 Montferrier-sur-Lez
- Contact
- hello@pills.legal
Given the size of the activity (sole practitioner), Pills. is not required to designate a Data Protection Officer (DPO). For any question about your data, you can still write directly to the address above.
What we collect,
and why.
We never sell your data to third parties.
We use no advertising cookie, no social network pixel and no profiling tool.
We do not profile your visits and make no automated decisions about you.
We do not cross-reference what you entrust to us with third-party databases.
Who receives
your data.
Your data is accessible only to Steve Chrétien, in his capacity as data controller. We use 4 technical sub-processors strictly necessary to operate the site and our relationship with you.
- Location
- United States (parent company), with processing in an EU region for served content
- Guarantees
- European Commission's standard contractual clauses. SOC 2 Type II and ISO 27001 certifications.
- Location
- United States (parent company), EU region (Ireland) selected for storage
- Guarantees
- Standard contractual clauses. Documented GDPR compliance. Data stored in EU.
- Location
- United States
- Guarantees
- Standard contractual clauses and EU–US Data Privacy Framework
- Location
- European Union (Estonian company, servers in the EU)
- Guarantees
- Processing within the European Union. No cookie, no persistent identifier, aggregated data.
When your data
leaves the EU.
Sensitive section. GDPR strictly governs transfers outside the EU. Here is exactly what happens to your data.
Three of our four sub-processors (Vercel, Resend, Google) have their parent companies in the United States. Plausible is established in the European Union and involves no transfer. For the other three, data is stored and processed within a European region where possible:
- Resend: newsletter and email data stored in Ireland (selected EU region).
- Vercel: content served from an EU region; technical logs may transit through the United States.
- Google Fonts: direct loading from Google servers, may involve a transfer to the United States.
When a transfer outside the EU takes place, it is framed by the standard contractual clauses adopted by the European Commission (decision 2021/914), and where applicable by the EU–US Data Privacy Framework.
What you can
require from us.
GDPR and the French Data Protection Act grant you 8 rights over your personal data. You can exercise them at any time, free of charge, without giving any specific reason.
Obtain a copy of the data we hold about you.
Correct inaccurate or incomplete data.
Request the deletion of your data ("right to be forgotten").
Suspend processing, notably while resolving a dispute.
Object to processing based on our legitimate interest.
Recover your data in a structured and readable format.
At any time, without justification. For the newsletter: one click is enough.
Define what happens to your personal data after your death.
An email to hello@pills.legal. is enough. We reply within one month, in line with GDPR article 12. To unsubscribe from the newsletter, the link at the bottom of each email is enough.
In case of serious doubt about your identity, we may ask for a justification before acting, always within the principle of minimisation.
How we
protect your data.
- Encryption in transit
All communications with this site go through HTTPS (TLS 1.3).
- Encryption at rest
Data stored at our sub-processors is encrypted at rest (AES-256).
- Restricted access
Only Steve Chrétien accesses contact messages and the subscriber list, from devices protected by strong authentication.
- Minimisation
We collect only what is strictly necessary for the stated purpose.
- Breach notification
In case of a data breach posing a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform you individually if the risk is high (GDPR art. 33 and 34).
A question,
a dispute?
Write to us first at hello@pills.legal. We reply within one month.
If our reply doesn't satisfy you, you can file a complaint with the CNIL (Commission nationale de l'informatique et des libertés), the French supervisory authority.
Version actuelle · 14 August 2026
›Versions précédentes
- 14 August 2026August 2026 update: the contact form has been removed from the site; getting in touch now happens by email or through the online calendar. Added the processing operations tied to the ROI calculator, the Pills. Academy waitlist and calls for applications. Added cookieless audience measurement (Plausible, Vercel) to the sub-processors and to the Cookies section.