How Idun Group collects and processes your personal data, in line with the GDPR (EU Regulation 2016/679) and the French Data Protection Act. This page is kept up to date in line with applicable French and EU regulations.
Idun Group, headquartered at 61 rue de Lyon, 75012 Paris, France (SIREN 981 732 175), is the controller of personal data collected via idun-group.com.
Contact: contact@idun-group.com.
No Data Protection Officer (DPO) has been appointed; appointment is not mandatory given our activity and size (GDPR article 37).
Audience measurement, if you accept it: PostHog receives your IP address (anonymised), browser type, pages viewed, visit duration and traffic source, including the parameters of the link you followed (the campaign and, for a link we sent, the name of the company it was sent to), as well as your clicks, mouse movements, how far you scroll each page, the first field you enter in a form and the outcome of a newsletter sign-up (whether it went through, never what you type), how fast pages display and the page's technical errors; Google Analytics receives your IP address, the address of the pages viewed with the campaign parameters of the link you followed (never the company name), the traffic source, the browser's characteristics and clicks on our buttons (contact, sign-up, article vote).
Session recording, if you accept audience measurement: PostHog records how your visit unfolds (pages, clicks, scrolling, the page's technical logs and network request headers), including what you type into the site's fields, such as your newsletter email address. Where relevant, these recordings carry the name of the company a link we sent you was meant for, never your name.
If you reject cookies, only the pages viewed (address, title, duration), the source of the visit, including the parameters of the link you followed, and the browser's technical characteristics are sent to PostHog, with no cookie or identifier; no clicks, no input, no session recording, nothing to Google Analytics.
Blog newsletter sign-up: your email address, with the address and title of the page you sign up on, sent to HubSpot, the tool in which we manage our contacts; HubSpot also receives your browser's IP address.
Article usefulness vote, if you accept audience measurement: your answer (yes or no) is counted in audience measurement, and the optional comment offered when you answer no is sent to PostHog. If you reject it, the vote is sent nowhere and no comment is asked for.
Direct exchanges: email address and content of messages you send to h.geoffrey@idun-group.com or via our scheduling link (Google Calendar).
No special-category data within the meaning of GDPR article 9 (health, political opinions, religion, sexual orientation, biometrics) is collected.
Audience measurement, session recording, comments on our articles and site improvement: your prior consent to analytics cookies (GDPR art. 6.1.a).
Counting visits without cookies, when you reject analytics cookies (site traffic, the effect of what we send): legitimate interests (GDPR art. 6.1.f).
Replying to your enquiries, scheduling calls, commercial demonstrations: performance of pre-contractual measures or legitimate interests (GDPR art. 6.1.b and 6.1.f).
Newsletter sign-up: your consent (GDPR art. 6.1.a), withdrawable at any time via the unsubscribe link in every email.
IT security and technical logging: legitimate interests (GDPR art. 6.1.f).
Compliance with our accounting and tax obligations (invoices, contracts): legal obligation (GDPR art. 6.1.c).
PostHog audience data, including comments on our articles: 12 months from collection.
PostHog session recordings: 90 days.
Google Analytics data: 14 months at most, depending on the retention period set on the property.
Newsletter email addresses: until you unsubscribe, then 3 years for permitted commercial prospecting.
Commercial email exchanges: 3 years from the last contact.
Customer data (contracts, invoices): 10 years from the close of the financial year (accounting obligation, French Commercial Code art. L.123-22 and General Tax Code art. 286).
Consent choice (browser local storage): 12 months, after which the banner is shown again.
PostHog Inc.: audience measurement, EU hosting in Germany. The data your browser sends reaches it through d.idun-group.com, a relay PostHog runs on Cloudflare's network.
HubSpot: management of our contacts, including newsletter sign-ups, EU hosting in Germany.
Google LLC (Google Analytics): audience measurement, if you accept it, United States.
Google LLC (Firebase Hosting): website hosting, United States.
Google LLC (Google Calendar): call scheduling via external link, United States.
No data is sold. No advertising profiling or automated decision-making producing legal effects is carried out.
Google Analytics, Firebase Hosting and Google Calendar are operated by Google LLC in the United States. These transfers rely on Google's participation in the EU–US Data Privacy Framework, complemented by Standard Contractual Clauses adopted by the European Commission.
Audience-measurement data is hosted by PostHog in the European Union. It reaches PostHog through a relay that runs on Cloudflare Inc. (United States), a PostHog sub-processor: the connection is handled by the Cloudflare data centre closest to you, usually in Europe for a visitor in Europe, outside the European Union for a visitor connecting from elsewhere. According to PostHog, nothing is kept there, neither the content of the requests nor a log of them.
HubSpot stores our contacts in its EU data centre (Frankfurt, Germany). HubSpot Inc., a US company, may access them from the United States for support and maintenance; this access relies on its participation in the EU–US Data Privacy Framework and on Standard Contractual Clauses.
Under GDPR articles 15 to 22 and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your personal data. You may also withdraw your consent, where processing is based on it.
You may also issue post-mortem directives regarding your data (article 85 of the French Data Protection Act).
Send your request, together with proof of identity where necessary, to h.geoffrey@idun-group.com. We will respond within one month, extendable by two months in case of particular complexity.
If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online via cnil.fr/en/plaintes. Visitors based in another EU member state may also lodge a complaint with their local supervisory authority.