Privacy Policy

Who controls your data

Josh Willett Consultancy, a French single-member limited liability company (EURL), is the controller of the personal data collected through this website.

Processing is governed by the General Data Protection Regulation (GDPR) and the French Data Protection Act. Where it concerns people in the United Kingdom, the UK GDPR also applies. Josh Willett Consultancy is not required to appoint a data protection officer. Privacy requests go to the email address above.

What information is collected

The data collected depends on how you use the website.

• When you send an enquiry, the form collects your name, your email address, your website address and your message.
• When you correspond by email or telephone, the information you provide becomes part of the business correspondence.
• Google Analytics 4 may collect usage information such as the pages viewed, approximate location, device, browser, the source of the visit and interactions with the website.
• Cloudflare may process technical request data, including the IP address, browser information and security signals, in order to deliver and protect the website.

Josh Willett Consultancy does not knowingly collect sensitive data through the form. Please do not send confidential information that is not needed for your enquiry.

Why the information is used and on what legal basis

Personal data is used to reply to enquiries, discuss the services requested, prepare a proposal, deliver the agreed work, keep business records, protect the website and understand how it is used.

The legal basis depends on the activity:

• enquiries and early discussions rely on steps taken at your request before entering into a contract and, depending on the context, on the legitimate interest in replying to a business enquiry
• client work is processed to perform a contract
• invoicing, accounting and administrative records are kept to comply with legal obligations
• protecting and securing the website relies on legitimate interest
• business-to-business prospecting emails rely on legitimate interest: they concern an offer relevant to the recipient's job, and every message offers a way to opt out
• non-essential audience measurement cookies rely on your consent where consent is required

Cookies and analytics

The website uses technologies that are necessary for its security and operation. Cloudflare may use essential cookies to protect and deliver the website.

Google Analytics 4 is used to measure traffic and how the website is used. You can limit or delete cookies in your browser settings.

You can also use the opt-out tools Google provides for Google Analytics.

Service providers and recipients

Data is available only to the people and providers who need it to run the website, reply to enquiries or deliver the work concerned.

• Cloudflare for hosting, content delivery and website security
• Resend for passing form enquiries to the company's email inbox
• Google Workspace for email and business correspondence
• Google Analytics 4 for website measurement
• Google Fonts for delivering fonts when they are loaded from Google's services
• the company's accountant, for invoicing and accounting records

These providers act under their own terms and data protection commitments. Josh Willett Consultancy does not sell or rent your personal data.

Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area, including in the United States. Where that happens, the processing is covered by an adequacy decision such as the EU-US Data Privacy Framework, by standard contractual clauses or by another transfer mechanism provided for by the GDPR, depending on the provider.

How long information is kept

• Enquiries and prospect correspondence are kept for up to three years after the last contact.
• Client records and contracts are kept for the length of the contract and five years after it ends.
• Invoices and accounting records are kept for ten years.

Technical security data and audience measurement data follow the retention periods configured with the providers concerned.

Your rights

Depending on the circumstances, you can ask for:

• access to your personal data
• correction of data that is inaccurate
• erasure of your data
• restriction of processing
• portability of the data concerned
• an end to processing based on legitimate interest, by objecting to it
• withdrawal of your consent where consent is the legal basis
• instructions to be recorded about what happens to your data after your death, a right provided by French law

Exercising your rights

To exercise a right, write to [email protected]. Proof of identity may be requested only where it is needed to confirm who is making the request.

You can also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or visit cnil.fr. If you are in the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk.

Data security

Proportionate technical and organisational measures are used to protect data against unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security.

Changes to this policy

This policy may be updated when the website, the providers or the legal requirements change. The date of the last revision is shown at the top of the page.

Details of the publisher and the host are in the legal notice.