Privacy Policy

1. Who we are

TANTO42 is a coaching and facilitation practice based in France. We are the data controller for personal data collected through this website. Full legal details (company name, address, registration) are in our Legal notice. Contact: privacy@tanto42.com

2. What data we collect

• Contact forms: name, email address, organisation (optional), and message (optional).
• Newsletter: email address only, with explicit consent.
• Workshop registrations: name, email, and billing information (via our ticketing and payment providers).
• Call bookings: the details you enter in the booking form on our contact page: your name, email address, chosen date and time, and an optional note. We send them to Microsoft Bookings to create the appointment.
• Server log files: when you visit the site, our web server automatically records your IP address, the date and time, the page requested, and browser and device information. These technical logs are needed to deliver and secure the website.
• Website usage: anonymised statistics (see section 9). No cookies are used and IP addresses are anonymised before storage.

3. Legal basis for processing

• Consent (Art. 6(1)(a)): contact forms and newsletter subscriptions.
• Contract (Art. 6(1)(b)): workshop registrations and payments, and call bookings (steps taken at your request before entering into a contract).
• Legal obligation (Art. 6(1)(c)): keeping accounting and billing records.
• Legitimate interests (Art. 6(1)(f)): server log files (security and operation of the site) and anonymised website statistics (understanding and improving our website).

4. How we use your data

• To respond to enquiries and arrange exploratory calls.
• To send the monthly leadership digest (newsletter subscribers only).
• To manage workshop registrations and payments. We never sell or share your data for marketing.
• To operate, secure and improve the website.

5. Recipients and processors

We share personal data only with service providers that process it on our behalf, under a data processing agreement, and only as far as necessary for the service:

• OVH (France): web hosting and server operation.
• Brevo (France): sending emails and newsletters.
• Mollie (Netherlands): payment processing for workshop registrations.
• Microsoft Ireland (Ireland): scheduling of calls and appointments via Microsoft Bookings.
• Matomo: self-hosted on our own server, so no third party receives analytics data.

We do not sell personal data. Our processors are established in the European Union. Where any processing involves a transfer outside the European Economic Area, it is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Data retention

• Contact form data: 24 months maximum.
• Newsletter: until you unsubscribe.
• Client data: the duration of the engagement plus five years, as required by law.
• Billing and accounting records: 10 years, as required by French commercial law.
• Server log files: for as long as technically necessary to operate and secure the website, and no longer than the retention period applied by our hosting provider (OVH).
• Raw analytics data: 90 days; aggregated statistics contain no personal data.

7. Your rights under GDPR

Access · Rectification · Erasure · Restriction · Portability · Withdraw consent · Object to processing based on legitimate interests (Art. 21). Contact us at privacy@tanto42.com. We respond within 30 days. You can object to analytics at any time using the opt-out in section 9.

8. Cookies and similar technologies

Our own pages do not use cookies, local storage or similar technologies for tracking, analytics, advertising or profiling. Fonts and scripts are hosted on our own servers, and we do not load advertising networks, social-media plug-ins or embedded videos. Because nothing non-essential is stored on or read from your device, no cookie consent banner is required (Art. 5(3) of the ePrivacy Directive 2002/58/EC, Art. 82 of the French Loi Informatique et Libertés).

Booking form: the booking form on our contact page is part of our own website. Your browser communicates only with our server, not with Microsoft, so no Microsoft cookies or scripts are loaded and your IP address is not sent to Microsoft by your browser. When you confirm a booking, our server transmits the booking details to Microsoft Bookings (see sections 2 and 5).

The only cookie that may be set is a short-lived, strictly necessary session cookie in the administration area, which is not accessible to visitors. If we introduce services that need cookies or third-party content, we will ask for your consent beforehand and update this policy.

9. Website analytics (Matomo)

We use Matomo, an open-source analytics tool, to understand how our website is used and to improve it. Matomo is self-hosted on our own server: no data is shared with Matomo's developers or any other third party.

Matomo runs without cookies and stores nothing on your device. Per visit it records the pages viewed, the referring website, date and time, browser, operating system, device type and approximate location (country/region). Your IP address is anonymised before storage by removing 2 bytes, so you cannot be identified from it. We do not combine this data with other data and do not track you across websites. If your browser sends a “Do Not Track” signal, we respect it.

Legal basis: our legitimate interest in the technical operation and improvement of our website (Art. 6(1)(f) GDPR). You may object at any time, with effect for the future, using the setting below or by writing to privacy@tanto42.com.

10. Further information

• Spam protection: the contact form uses a self-hosted proof-of-work check (Altcha). It sets no cookies and sends no data to third parties.
• External links: our pages link to LinkedIn. Once you follow the link you leave our website and the provider's own privacy policy applies.
• Automated decisions: we do not use automated decision-making or profiling.

11. Complaints

You may lodge a complaint with the CNIL (France), the supervisory authority for this website, or with the data-protection authority in your country of residence.