Client Area

Privacy Policy

1. Introduction

This privacy policy describes how LinkTec collects, uses and protects the personal data you provide when using our website bn-linktec.fr and our services.

LinkTec is committed to respecting the privacy of its users and to protecting personal data in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French Data Protection Act (Loi Informatique et Libertés, Act No. 78-17 of 6 January 1978, as amended).

Our services are intended exclusively for business professionals (B2B).

2. Data Controller

The data controller is:

LinkTec — Sole Proprietorship (Entreprise Individuelle)
Rue des Chrysanthèmes, 59700 Marcq-en-Barœul, France
SIRET: 99990251300012
Email: contact@bn-linktec.fr

LinkTec has not appointed a Data Protection Officer (DPO). For any questions regarding your personal data, please contact us at the address above.

3. Data Collected

We collect the following data depending on the context of interaction:

3.1 Contact Form

  • Full name *
  • Email address *
  • Phone number (optional)
  • Company, country and professional role *
  • Desired service, estimated budget and timeline *
  • Message *
  • Form language, subject and source page
  • utm_source, utm_medium, utm_campaign, utm_content and utm_term campaign parameters only when present, after filtering and without retaining the full URL

Fields marked with * are required.

The form does not collect any advertising click identifier. Each request receives an internal follow-up status: new, contacted, qualified, proposal, won or lost.

3.2 Client Area

  • Name, surname, email address
  • Password (stored in encrypted form — bcrypt)
  • Project-related documents (uploaded by the administrator)
  • Messages exchanged via the integrated messaging system
  • Profile information editable in settings

3.3 Payments

Payments are processed directly by Stripe (credit card) and PayPal. LinkTec does not store any payment data (card numbers, banking credentials). Only transaction confirmations (amount, date, status) are retained in the client area.

3.4 Anti-Spam

The contact form uses an anti-spam mechanism (hidden "honeypot" fields and timestamp verification). Values entered in honeypots are not retained. To limit abusive submissions, a pseudonymous hash of the IP address is used within a one-hour window and expired entries are removed during the next check. Neither the plain IP address nor the form content appears in technical anti-spam logs.

3.5 Diagnostic Booking

The booking form is hosted by LinkTec on linktec.fr. It only requests: name, work email, company, country, time zone, role, priority issue and relevant branch (Labs Audit, Studio, Modules or other). The selected time, confirmation, rescheduling or cancellation actions and an encrypted management token are stored in the MySQL database hosted by OVHcloud. The appointment is synchronised with LinkTec's Zimbra calendar through CalDAV and emails are sent through OVH/Zimbra SMTP. A separate Zoom meeting is created with its scheduled time and a generic title. The booking API does not send Zoom the prospect's name, email, company or priority issue. When participants join the video meeting, Zoom nevertheless processes the information required to provide the service, including the display name entered, device and network data, and audio and video streams. Automatic recording is disabled. The booking system does not retain the raw IP address: a temporary hash is used solely to limit abuse. No internal document or sensitive data should be submitted.

3.6 Internal Campaign Measurement

If a page is opened with permitted UTM parameters, LinkTec filters and limits them and associates them with the request only when the contact form, BETA signup or booking is voluntarily submitted. A random UUID event_id, unrelated to the email address, deduplicates the conversion. The full URL, external referrer, advertising click IDs and parameters containing an email, telephone number or URL are not retained. No LinkedIn/Meta pixel or Conversions API call is used.

4. Legal Bases for Processing (Art. 6.1 GDPR)

Each processing activity relies on a specific legal basis:

  • Contact form and qualification: pre-contractual steps requested by the individual — Art. 6.1(b)
  • Client area (account, projects, messaging): performance of a contract — Art. 6.1(b)
  • Payments (via Stripe / PayPal): performance of a contract — Art. 6.1(b)
  • Studio notification (email redirect): consent — Art. 6.1(a)
  • Diagnostic booking: pre-contractual steps requested by the individual — Art. 6.1(b)
  • Internal request attribution: legitimate interest in managing business activity without advertising profiling — Art. 6.1(f)
  • Anti-spam (honeypot, timestamp): legitimate interest (security) — Art. 6.1(f)

5. Purposes of Processing

  • Responding to your contact and quote requests
  • Qualifying and tracking the request in the internal sales pipeline
  • Linking a request to its source page and campaign, without advertising profiling
  • Scheduling, confirming, reminding, rescheduling or cancelling a diagnostic and preventing calendar conflicts
  • Managing your client area, projects and documents
  • Processing payments and invoicing
  • Ensuring website security and preventing abuse
  • Complying with our legal and tax obligations

6. Data Retention

  • Contact form and qualification: 3 years from the last business contact; a protected purge removes requests that have reached the end of this period
  • Booking and qualification data: up to 3 years after the last business contact, with earlier deletion on request unless legally required
  • Conversion deduplication: random UUID and timestamp without contact data, up to 30 days; UTM data then follows the retention period of the relevant lead
  • Client area: duration of the business relationship + 3 years (civil statute of limitations)
  • Billing data: 10 years (accounting obligation — Art. L123-22 French Commercial Code)
  • Data entrusted for an engagement: engagement duration + 30 days, unless the contract sets another period
  • Logins: last login retained with the account; failed attempts deleted after a successful login or when entries older than 24 hours are purged. HTTP logs follow the host's policy.

Beyond these periods, data is deleted or anonymised.

7. Recipients and Sub-Processors

Your personal data is never sold or rented to third parties. It may be shared with the following sub-processors, strictly for the provision of our services:

  • OVHcloud (SAS, France) — website hosting, databases, booking system, Zimbra calendar and SMTP email delivery. Data stored in France / EU.
  • Zoom Video Communications, Inc. (United States) — creation and delivery of the diagnostic video meeting. The LinkTec API only sends its scheduled time and a generic title; Zoom then processes participation data when attendees join the meeting.
  • Stripe (Stripe Payments Europe Ltd, Dublin, Ireland) — credit card payment processing. Data processed in the EU; transfers to Stripe Inc. (US) are governed by Standard Contractual Clauses (SCCs) of the European Commission.
  • PayPal (PayPal (Europe) S.à r.l., Luxembourg) — PayPal payment processing. Data processed in the EU; transfers to PayPal Inc. (US) are governed by SCCs.
  • jsDelivr — delivery of JavaScript animation libraries. IP address and request metadata may be processed by nodes outside the EU.

Your data may also be disclosed to competent authorities where required by law.

Campaign sources, event identifiers and form data are sent neither to LinkedIn nor Meta. Advertising performance is reconciled exclusively in LinkTec's internal pipeline.

8. Transfers Outside the European Union

Some of our sub-processors may transfer data outside the European Union. These transfers are governed by the following mechanisms:

  • Stripe Inc. (United States): Standard Contractual Clauses (SCCs) + Stripe DPA
  • PayPal Inc. (United States): Standard Contractual Clauses (SCCs) + PayPal Privacy Policy
  • Zoom Video Communications, Inc. (United States): international transfers may occur and are governed by Zoom's applicable contractual mechanisms — see its Privacy Statement and subprocessor list.
  • jsDelivr (GSAP / ScrollTrigger): JavaScript files are loaded from CDN nodes, some of which may be located outside the EU. The visitor's IP address and request metadata are transmitted (legitimate interest — proper functioning of the website). The jsDelivr DPA incorporates the European Commission SCCs.
  • Google Fonts (Arabic pages only): possible transfers to the United States, covered by the EU–US Data Privacy Framework and, where required, SCCs — see Google's transfer frameworks.

Note: FR, EN and DE pages host their fonts locally. Arabic pages load IBM Plex Sans Arabic through Google Fonts, with possible transfer of the IP address and request metadata.

9. Cookies and Similar Technologies

Our website only uses strictly necessary or preference cookies, exempt from prior consent under CNIL guidelines. For the full breakdown, see our Cookie Policy.

9.1 Strictly necessary cookies

  • PHPSESSID — PHP session for the client area. Deleted on browser close.
  • remember_token — "Remember me" option at login (30 days, HttpOnly, Secure).
  • CSRF token — protects forms against cross-site request forgery (session duration).

9.2 Preference cookies (CNIL exemption)

  • linktec_lang — selected language (FR/EN/AR/DE). Duration: 1 year.
  • linktec_theme — dark/light theme. Duration: 1 year.

These cookies result from an explicit action of yours (choosing a language or theme) and serve only your comfort. No consent required (CNIL 2020 guidelines).

9.3 Local storage (localStorage / sessionStorage)

  • linktec-theme, linktec-lang — local copy of the preferences above (fallback if cookies are disabled).
  • linktec-intro-played — indicates whether the introduction animation has been played (sessionStorage, deleted on tab close).

This data remains on your device and is never transmitted to our servers.

9.4 No Advertising or Tracking Cookies

We do not use any advertising cookies, tracking pixels (Facebook, Google Analytics, etc.) or behavioural tracking tools. Internal UTM measurement creates no browser storage and contacts no advertising platform. No cookie consent banner is therefore necessary.

10. Your Rights

In accordance with the GDPR (Articles 15 to 22), you have the following rights:

  • Right of access (Art. 15): obtain a copy of your personal data
  • Right to rectification (Art. 16): correct inaccurate or incomplete data
  • Right to erasure (Art. 17): request the deletion of your data
  • Right to restriction (Art. 18): request the restriction of processing of your data
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format
  • Right to object (Art. 21): object to processing based on legitimate interest
  • Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing
  • Post-mortem directives (French Data Protection Act, Art. 85): define instructions regarding the handling of your data after your death

11. How to Exercise Your Rights

To exercise your rights, send your request by email to: contact@bn-linktec.fr

Please include your identity details (name, surname, email associated with your account if applicable). We may request proof of identity in cases of reasonable doubt.

We are committed to responding within one month of receiving your request. This period may be extended by two months in case of complexity or a high volume of requests, in which case you will be informed.

12. Security

We implement appropriate technical and organisational measures to protect your data:

  • HTTPS connection (SSL/TLS certificate)
  • Hashed passwords (bcrypt)
  • CSRF protection on forms
  • Restricted data access (principle of least privilege)
  • Non-contractual OVHcloud restore points; no independent backup guaranteed by default
  • OVHcloud hosting in France

See Security & data for the verified measures, their limits and the active subprocessors.

13. Policy Changes

We reserve the right to modify this privacy policy at any time. The date of the last update is indicated at the bottom of this page. We recommend checking this page regularly.

14. Contact and Complaints

For any questions regarding this policy or to exercise your rights:

Email: contact@bn-linktec.fr

If you believe the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the CNIL:

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
www.cnil.fr

Last updated: July 2026