Privacy policy

Data controller

The data controller within the meaning of article 4-7 GDPR is The Dark Agency, whose full contact details are listed in our legal notice.

Given the scale and nature of the processing operations performed, The Dark Agency is not required to appoint a Data Protection Officer (art. 37 GDPR). The data controller acts as the reference point for all matters relating to your personal data and can be reached at contact@thedarkagency.fr.

Data we collect

Depending on your interaction with the site, we collect the following categories of data, strictly limited to what is necessary for the purpose pursued:

• Contact form: first name, last name, email address, phone (optional), offer of interest, free message, IP address, timestamp.
• Brief form: first name, last name, email, phone, company name, sector, company size, objectives, preferred callback slots, locale, IP address, user agent.
• Customer review form: first name, last name, email, company, LinkedIn URL (optional), rating, review content, IP address, locale.
• Application form (Careers page): full identity (first name, last name, city, country), email, phone, LinkedIn (optional), CV in PDF format (stored on private disk), motivation, salary expectations (optional), position-specific answers, IP address, user agent.
• Newsletter (footer form): email address only, collected on the basis of explicit consent via opt-in.
• Customer account (subscriber area): email, hashed password (never stored in plain text), billing data and Stripe identifiers.
• Cookies strictly necessary for the site to function: session token, CSRF token, language preference.

Purposes and legal bases

Each category of data is processed for a specific, explicit purpose, on the basis of one of the legal grounds listed in article 6 GDPR:

Retention periods

Data is retained for the period strictly necessary for the purpose pursued, then archived or deleted according to the following durations:

• Contact requests and briefs: 3 years from the last exchange with the prospect, in accordance with CNIL recommendations on commercial prospecting.
• Job applications: 24 months from submission, with automatic monthly purge (command `applications:purge`) thereafter. CVs are deleted from the private disk together with the record.
• Published customer reviews: duration of publication on the site, removal on simple request from the contributor.
• Newsletter: until unsubscription request, and at the latest after 3 years of inactivity in accordance with CNIL recommendation.
• Active customer accounts: duration of the contractual relationship, extended by applicable limitation periods.
• Accounting and billing data: 10 years from the end of the fiscal year (art. L.123-22 French Commercial Code).
• Technical cookies: browser session duration, or maximum thirteen months for the language preference.

Recipients and subprocessors

Your data is accessible only to authorized persons within The Dark Agency within the limits of their duties. In accordance with article 28 GDPR, certain data is transmitted to subprocessors operating under Data Processing Agreements and, where required, the Standard Contractual Clauses adopted by the European Commission:

• Stripe Payments Europe Ltd (Dublin, Ireland) — payment processing and billing. Data hosted within the EU. Stripe DPA applicable.
• Resend Inc. (San Francisco, USA) — transactional emails and notification delivery. Resend DPA supplemented by the Standard Contractual Clauses (decision 2021/914).
• Cloudflare, Inc. (San Francisco, USA) — file storage via Cloudflare R2. Transfer outside the EU framed by the Standard Contractual Clauses and the Cloudflare Data Processing Addendum.
• Hostinger International Ltd (Larnaca, Cyprus) — hosting of the site and databases. Data retained within the EU.

No data is sold to third parties, used for external targeted advertising, or transferred to data brokers or advertising platforms.

Transfers outside the European Union

Some processing operations involve a transfer of personal data to the United States (Cloudflare, Resend). These transfers are framed by the Standard Contractual Clauses adopted by the European Commission in its decision 2021/914 of 4 June 2021, supplemented by appropriate technical and organizational measures: encryption in transit (TLS 1.2+) and at rest, access control, logging, regular audit of subprocessors.

No transfer is made to a country lacking an adequacy decision from the European Commission or appropriate safeguards within the meaning of articles 45 and 46 GDPR.

Your rights

In accordance with articles 15 to 22 GDPR and the provisions of the French "Informatique et Libertés" Act, you have the following rights over your personal data:

• right of access: obtain confirmation that your data is being processed and receive a copy;
• right of rectification: have any inaccurate or incomplete data corrected;
• right to erasure ("right to be forgotten"): obtain the deletion of your data in the cases provided for in article 17 GDPR;
• right to restriction of processing: temporarily suspend the processing of your data;
• right to object: object to processing on grounds relating to your particular situation, or unconditionally with respect to commercial prospecting;
• right to data portability: receive your data in a structured, commonly used and machine-readable format;
• right to withdraw your consent at any time, where processing is based on this ground;
• right to define directives on the fate of your data after your death (art. 85 of Act 78-17).

To exercise these rights, contact us at contact@thedarkagency.fr. We will respond within one month of receipt of your request, in accordance with article 12 GDPR. This period may be extended by two additional months due to complexity or the number of requests, in which case you will be informed.

We may ask you for additional elements to verify your identity, in particular in the event of reasonable doubt about the person making the request.

You also have the right to lodge a complaint with the French data protection authority CNIL (Commission Nationale de l'Informatique et des Libertés): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — https://www.cnil.fr.

Data security

The Dark Agency implements appropriate technical and organizational measures to ensure the confidentiality, integrity and availability of your data: encryption of communications (HTTPS/TLS), password hashing (bcrypt algorithm), access control, logging of sensitive actions, regular backups, audit of subprocessors. As no measure is infallible, the agency cannot, however, guarantee absolute security.

Cookies

The site only deposits cookies strictly necessary for its operation (session token, CSRF token, language preference). In accordance with article 82 of the French Act 78-17 as amended and CNIL guidelines of 17 September 2020, these cookies are exempt from prior consent.

No advertising, third-party audience measurement or profiling cookies are placed on the site.

In the event that the agency introduces in the future an audience measurement tool or a non-strictly-necessary cookie, a consent banner compliant with CNIL requirements will be implemented prior to any deposit.

Changes to this policy

This privacy policy may be modified at any time to reflect regulatory, technical or operational changes within the agency. The last updated date indicated at the top of the page prevails. In the event of a substantial modification, the users concerned will be informed by display on the site and, where necessary, by direct notification.