Privacy notice

Who handles your data

This is one analyst, not a firm with departments. The personal data covered here is controlled by whoever operates geo-lyon.com — that is me, Orane Velt, reading each enquiry myself. The General Data Protection Regulation (GDPR) makes me the controller. To raise a privacy point, or to act on a right you hold, write to hello@geo-lyon.com and it reaches me directly.

What is collected

One channel exists on this site: the enquiry form. When you submit it, these reach me —

• A name — so a reply can address you by it.
• An email address — so there is somewhere for that reply to land.
• A free-text message — where you set out the B2B firm, capability page, or company profile in question, the answer an AI assistant gave or failed to give about it, and any public source you think ought to inform that answer. Name and email are the only required fields; the message itself and anything in it are yours to leave out.

That is the entire collection. No account is created, no login is needed, and nothing is assembled into a profile in the background. The note arrives in an inbox and remains a note, read for one reason: to answer the enquiry you raised. To keep the form from being abused by automated traffic, the time of submission is recorded next to a salted SHA-256 hash of the sending IP address. The readable IP, browser fingerprints, and device metadata are not retained at any point.

What is not collected

• Tracking cookies are absent. Visit figures come from cookie-free analytics that fix no identifier capable of telling one visitor apart from the next.
• Advertising pixels, remarketing tags, and marketing-automation trackers are not present and not used.
• Profiling is not automated, and no automated decision produces a legal effect on you.
• Cross-site tracking does not happen, and personal data is not sold, rented, or passed to commercial partners — there is no machinery here for that to serve.

Why the law allows this

Handling your name, email, and message is grounded in Article 6(1)(b) of the GDPR: steps taken at your own request before any agreement is in place. The IP hash that defends the form rests separately on legitimate interest under Article 6(1)(f). Should payment-status data ever come into being for an invoiced engagement, the contractual basis would govern it.

How long it is kept

• Enquiry messages and the email exchange they begin: held while an engagement is live, then a further 24 months so the record of the exchange survives, and erased after that. An enquiry that leads to no engagement is held 12 months, then erased.
• IP hashes: held 90 days — the window needed to spot abusive patterns — then erased.
• Any payment records: should an invoiced engagement ever generate them, they are kept solely for the period tax and accounting law fixes, then erased.

Your rights

On the data you hand over, the GDPR lets you reach it, correct it, erase it, carry it elsewhere, hold its processing in check, or object to that processing outright. A single email to hello@geo-lyon.com starts whichever of these you want, with a reply due inside a month. If you think your data has been handled wrongly, you are also entitled to complain to the data-protection supervisory authority of the country you live in.

Where the data is held

The servers that run this site are in European Union (Germany). In the uncommon event that a further processor (email provider) works outside the European Union, that transfer relies on standard contractual clauses and on any additional safeguards the receiving party publishes.

Changes to this notice

Should the handling of data change in a way that matters, this notice is amended to reflect it and the "Updated" date at the top shifts accordingly. A change of genuine substance stays flagged on the home page for 30 days, so a returning visitor is not caught out by it.