Privacy
Privacy policy
This policy describes the personal data collected on gregory-buffard.dev, why it is collected, how long it is kept and how to exercise your rights.
Last updated: 11 November 2026
Data controller
The data controller is Grégory Wilhelm Stehlík--Buffard, a sole trader registered under number 21833982, whose address is Le Cannet (06110), France.
Contact: [email protected].
Data collected
Contact form: name, email address, company, project type, budget, message and, where applicable, website address.
Diagnostic form: name, email address and website address.
The site collects no browsing data for advertising purposes and sets no advertising cookies.
Technical logs (IP address, timestamp, country) may be processed by the host for security and availability.
Purposes
To reply to your enquiry and qualify your project.
To prepare a quote, a meeting or a proposal.
To manage the commercial relationship and meet accounting obligations.
To improve the site using aggregated, anonymous statistics.
Legal basis
Legitimate interest in responding to a professional enquiry (Article 6(1)(f) GDPR).
Pre-contractual measures where your enquiry concerns a quote or a service (Article 6(1)(b)).
Legal obligation for the retention of accounting documents.
Recipients
Data is accessible to Grégory Wilhelm Stehlík--Buffard, to its host Cloudflare, and to the self-hosted CRM on a server located in the European Union (Marseille).
No data is sold, rented or transferred for advertising purposes.
Transfers outside the European Union
Cloudflare may process certain data in the United States as part of its hosting and security services. These transfers rely on the European Commission's standard contractual clauses and, where applicable, the Data Privacy Framework.
The CRM is hosted in the European Union.
Retention
Contact and prospecting data is kept for three years from the last contact, in line with CNIL guidance for B2B prospecting.
Accounting documents are kept for ten years.
Cookies and analytics
This site sets no advertising cookie and no third-party analytics cookie.
Analytics, when enabled, uses Cloudflare Web Analytics: a cookie-less service that does not track individual visitors or build profiles.
Cloudflare may set a security cookie (__cf_bm) during a bot check. It is strictly necessary for the service.
Artificial intelligence
An automated assistant may qualify and summarise received messages before Grégory Wilhelm Stehlík--Buffard reads them.
No automated decision producing legal effects is taken. No reply is sent to you without human approval.
In line with Article 50 of the European AI Act, this assistance is disclosed on the forms concerned.
Your rights
You have the right to access, rectify, erase, restrict, object and port your data.
To exercise these rights, email [email protected]. A reply will be provided within one month.
You may also lodge a complaint with the CNIL.
Security
The site is served over HTTPS. The form sends data to a Cloudflare function that signs it (HMAC-SHA256) before forwarding it to the CRM.
Secrets are never exposed in client code. Access to the CRM is restricted.
Changes
This policy may be updated. The date at the top of the page indicates the latest version.
Substantial changes will be flagged on this page.