Privacy Policy

1. Introduction

Welcome to Anomaly Lab. We operate in full compliance with the European General Data Protection Regulation (GDPR). This Privacy Policy explains how we process the very limited data generated when you visit our website or interact with us.

As a company based in France, we act as the Data Controller for any information processed through this website.

2. Data We Collect and Why

We only process data that is strictly necessary to run a secure, functional website and to respond to your inquiries. We do not perform any user profiling or cross-site tracking.

A. Contact Form Data

When you fill out our contact form, we collect:

• Your Email Address: To reply to your inquiry.
• Message Content: Any information you voluntarily provide in the text field.

Legal Basis: This processing is based on your Consent (Art. 6(1)(a) GDPR) or our Legitimate Interest (Art. 6(1)(f) GDPR) to respond to incoming business and user inquiries.

B. Website Usage Data (Analytics & Logs)

To ensure our website remains secure, functional, and optimized, our servers and analytics setup automatically process technical usage data, which includes:

• Anonymized or truncated IP addresses (ensuring individual users cannot be identified).
• Browser type and operating system version.
• Pages visited and the date/time of access.
• Referrer URL (the page you arrived from).

Legal Basis: This processing is based on our Legitimate Interest (Art. 6(1)(f) GDPR) to safeguard our technical infrastructure and monitor aggregate website performance without identifying individuals.

3. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third parties. Your data is only shared with trusted service providers (Data Processors) required to host our website or deliver your emails, strictly operating within the European Economic Area (EEA) or under strict data protection adequacy frameworks:

• Hosting & Server Provider: [Placeholder: e.g., OVHcloud / Scaleway / Infomaniak], located in France/Europe.
• Email Routing Service: Used strictly to transmit your contact form message to our team.

4. Data Retention

• Contact Emails: We keep your emails only for as long as necessary to fully resolve your inquiry or maintain an active business relationship. Inactive conversations are systematically deleted within 24 months.
• Usage Logs: Technical server logs are strictly decoupled from individual identities and automatically purged or fully anonymized within 14 days.

5. Your GDPR Rights

Since we operate from Europe, you benefit from full data subject rights under the GDPR regarding your email data:

• Right to Access: You can ask for a copy of the communication data we hold about you.
• Right to Rectification: You can ask us to correct or update your email address or details.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete all your past emails and contact details from our systems.
• Right to Restrict or Object to Processing: You can object to us processing your message or ask us to restrict how we use it.

To exercise any of these rights, please contact our privacy officer directly via the contact information listed below.

6. Data Protection Authority

If you feel your data rights have been infringed, you have the right to lodge a complaint with a supervisory authority. In France, the competent authority is:

CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, 75007 Paris, France
Website: www.cnil.fr

7. Contact Information

For any questions regarding this Privacy Policy or to exercise your GDPR rights, please contact us at: