Data protection

Privacy policy

Last updated: May 2026 · Compliant with the GDPR (EU 2016/679) and the amended French Data Protection Act (Informatique et Libertés)

1. Data controllers

Personal data collected via the website https://thortank.fr is processed jointly by the two co-publishers operating the Thortank brand:

• Mathieu Lepretre (SIRET 899 675 409 00036), sole trader (micro-entrepreneur);
• Flora Lepretre (SIRET 939 662 565 (SIREN · full SIRET to be confirmed)), sole trader (micro-entrepreneur).

Single point of contact for any question regarding the processing of your data: m.lepretre@saegone.fr

2. Data collected

Depending on how you interact with the site, we may collect:

2.1 Data provided directly

• Contact form / quote request: first name, last name, email, phone number, company, job title, message, project content;
• Appointment booking: first name, last name, email, phone number, chosen time slot;
• Newsletter (where applicable): email, first name;
• Client area: login credentials, profile data, exchanges, invoices, project files;
• Invoicing: company name, SIRET, billing address, bank details where applicable.

2.2 Data collected automatically

• IP address, browser type, operating system, screen resolution;
• Pages visited, visit duration, traffic source, browsing path;
• Identifiers of the cookies placed.

3. Purposes and legal bases

4. Recipients and processors

Your data is never sold or transferred to third parties for commercial purposes. It is accessible only to the two Thortank co-publishers and, within the limits of their respective assignments, to the following technical processors:

• Hosting: o2switch SAS (222-224 Boulevard Gustave Flaubert, 63000 Clermont-Ferrand, France) · hosting of the site and databases;
• Transactional and marketing email: Brevo (formerly Sendinblue), headquartered in Paris · sending of contact emails, quotes, newsletter (where applicable);
• Audience analytics: Google Analytics (Google Ireland Limited), with IP anonymization;
• Internal productivity tools: Notion, Google Workspace, Stripe (payment), for client management and invoicing needs;
• Occasional subcontractors: freelancers or partner agencies working on specific services, bound by confidentiality commitments.

Each processor acts in compliance with the GDPR and is covered by a data processing agreement in accordance with Article 28 of the GDPR.

5. Retention periods

• Contact requests / quotes not converted: 3 years from the last contact;
• Client data (contracts, exchanges, deliverables): duration of the contractual relationship + 5 years (civil and commercial limitation period);
• Invoices and accounting documents: 10 years (Article L.123-22 of the French Commercial Code);
• Newsletter: until unsubscription or 3 years of inactivity;
• Connection logs: 12 months;
• Cookies: depending on their nature, 13 months maximum.

6. Your rights

In accordance with Articles 15 to 22 of the GDPR and Articles 49 et seq. of the French Data Protection Act, you have the following rights over your data:

• Right of access: obtain confirmation that data concerning you is being processed and receive a copy of it;
• Right to rectification: correct inaccurate or incomplete data;
• Right to erasure ("right to be forgotten"): request the deletion of your data, unless there is a legal retention obligation;
• Right to restriction: temporarily restrict processing;
• Right to portability: recover your data in a structured, readable format;
• Right to object: object to processing on grounds relating to your particular situation, and without any grounds for commercial prospecting;
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing;
• Right to set directives regarding what happens to your data after your death.

7. Cookies and trackers

The site uses cookies divided into several categories:

• Strictly necessary cookies (session, preferences, security): placed without consent, essential for the site to function;
• Audience measurement cookies (Google Analytics, anonymized configuration): placed after consent;
• Third-party cookies (embedded videos, social networks, targeted advertising): placed after explicit consent.

You can change your preferences at any time via the cookie management module available in the footer, or via your browser settings (Chrome, Firefox, Safari and Edge offer options to block, delete or restrict cookies).

8. Security

We implement reasonable technical and organizational measures to protect your data:

• TLS/HTTPS encryption of all communications with the site;
• Passwords stored in hashed form (never in plain text);
• Access to data restricted to authorized persons and logged;
• Regular, encrypted database backups;
• Regular updates of WordPress and security plugins.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, you will be informed as soon as possible in accordance with Article 34 of the GDPR.

9. Transfers outside the European Union

Some of our processors (notably Google) may transfer or host data outside the European Union. These transfers are covered by the safeguards provided for by the GDPR: standard contractual clauses of the European Commission, certifications, or adequacy decisions.

10. Exercising your rights / Contacting us

To exercise your rights or for any question regarding the protection of your data, you can contact us at:

We undertake to reply within one month of receiving your request (extendable by two months for complex requests). Proof of identity may be requested if there is reasonable doubt about your identity.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):

11. Changes to this policy

This privacy policy may be amended at any time to reflect changes in legislation, our practices or our tools. The applicable version is the one online on the date of your visit. Substantial changes will be notified to you by appropriate means (email, information banner).