Privacy policy

1. Who is responsible for your data?

The data controller is CNEXT CONSULTING, a French simplified joint-stock company (SAS) with share capital of €20,000, registered with the Pontoise Trade and Companies Register under number 812 197 721, with its registered office at La Turbine, 32 boulevard du Port, 95000 Cergy, France.

For any question about your data: contact@cnext-consulting.fr, or by post to our registered office. CNEXT has not appointed a data protection officer, as this is not required for its activities.

2. What data do we collect, why, and for how long?

We only collect the data needed for each purpose. Optional fields are marked as such in our forms.

Contact form

• Data: first name, last name, business email, company, phone (optional), subject, message, plus the date sent and technical data (IP address, browser).
• Purpose: to answer your request and follow up on the business relationship.
• Legal basis: steps taken at your request prior to entering into a contract, and CNEXT’s legitimate interest in responding to enquiries.
• Retention: 3 years from your last contact, then deletion.

Job applications and freelance consultants

• Data: the contact form data when you choose the “Recruitment / Freelance” subject, and any information you send us afterwards (CV, experience, availability).
• Purpose: to review your application and, with your agreement, offer you assignments that match your profile.
• Legal basis: steps taken at your request prior to entering into a contract, and CNEXT’s legitimate interest in building a pool of consultants.
• Retention: 2 years from your last contact, unless you ask us to delete it sooner.

Client and partner accounts

• Data: first name, last name, email, username, password (stored in encrypted form and never readable by CNEXT), company, job title and business phone.
• Purpose: to create and approve your account, give you access to your area (procedures, available consultants, project requests) and secure that access.
• Legal basis: performance of the contract between us, or steps taken prior to entering into it.
• Retention: as long as your account is active; it is deleted at your request or 3 years after your last login.

Project requests (client area)

• Data: identity and business contact details, type of need, reference of the requested profile, desired start date, estimated duration and description of the need.
• Purpose: to review your request, propose profiles and prepare a proposal.
• Legal basis: steps taken at your request prior to entering into a contract.
• Retention: 3 years from the last contact; if a contract is signed, for the term of the contract and then the legal retention periods.

Employee area (Microsoft sign-in)

• Data: first name, last name, business email address and Microsoft 365 account identifier, provided by Microsoft when you sign in. Your Microsoft password is never shared with the website.
• Purpose: to authenticate you and give you access to internal information reserved for employees.
• Legal basis: performance of the employment contract and CNEXT’s legitimate interest in informing its employees.
• Retention: for the duration of your employment; your website account is deactivated when you leave.

Website security

• Data: IP address, date and time, pages visited and login attempts.
• Purpose: to protect the website and accounts against attacks and fraudulent logins (web application firewall).
• Legal basis: CNEXT’s legitimate interest in keeping its website secure.
• Retention: 30 days at most.

Visitor statistics

• Data: pages visited, date of visit, referring website, device type and browser. No cookie is set and the IP address is not stored: an anonymous identifier, calculated from the IP address and browser and renewed every day, is used only to count the day’s visitors.
• Tool: Koko Analytics, installed on our own server in France. No data is shared with third parties or used for advertising.
• Purpose: to understand how the website is used and improve its content.
• Legal basis: CNEXT’s legitimate interest. This anonymous audience measurement, used only for our own statistics and not combined with other data, does not require your consent.
• Retention: statistics are kept for 25 months, then deleted automatically.

Advertising: the website does not use any advertising or cross-site tracking tool.

3. Cookies

The website only sets cookies that are necessary for it to work. They do not require your consent and are not used to track you or show you advertising.

Cookie	Purpose	Duration
pll_language	Remember your chosen language (French or English).	1 year
wordpress_test_cookie	Check that your browser accepts cookies before you log in.	Session
wordpress_logged_in_*, wordpress_sec_*	Keep you logged in to your member area.	Session, or 14 days if you tick “Remember me”
wfwaf-authcookie-*	Security: identify logged-in users to the firewall.	12 hours
cmplz_*	Store your cookie choices.	365 days

You can view the details and change your preferences at any time on our cookie policy page, or block cookies in your browser settings (some features, such as logging in, will then stop working).

4. Who has access to your data?

• Authorised CNEXT staff, depending on the subject: management, sales, human resources and back office.
• Our technical processors, acting only on our instructions: OVH SAS (website and backup hosting, in France), Microsoft Ireland Operations Ltd (Microsoft 365 email, which delivers form submissions, and employee sign-in through Microsoft Entra ID), Defiant Inc. (publisher of the Wordfence firewall, which may process IP addresses).
• Public authorities, only where required by law.

Your data is never sold or rented.

5. Transfers outside the European Union

The website is hosted in France. Microsoft may process some data outside the European Union, and Defiant Inc. is based in the United States. These transfers are covered by the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

6. How do we protect your data?

• Encrypted connection (HTTPS) across the whole website.
• Passwords stored in encrypted form; employees sign in with their business Microsoft account.
• Access to member areas restricted according to each account’s role, and restricted pages excluded from search engines.
• Web application firewall, regular updates and daily backups.

7. Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the right to:

• access your data and obtain a copy;
• have it corrected or completed;
• have it erased;
• restrict its processing;
• object to its processing, in particular to direct marketing;
• receive the data you provided in a reusable format (portability);
• give instructions on what happens to your data after your death.

To exercise your rights, write to contact@cnext-consulting.fr or by post to our registered office. We reply within one month. If we have reasonable doubts about your identity, we may ask you for proof.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

8. Children

This website is intended for professionals. It does not knowingly collect data about people under 15.

9. Changes

This policy may change, in particular if the website offers new services. The date of the last update is shown at the top of the page. The French version prevails.