Data controller
The controller for the processing described here is Nautilus Solutions, a French single-shareholder simplified joint-stock company (SASU), share capital €4,000, RCS Paris 941 945 891, registered office 10 boulevard Raspail, 75007 Paris, France. Contact: contact@nautilus-solutions.fr.
Data collected
Contact forms collect name, email, optionally organization and position, request type, subject, message and originating page. Quotation requests collect first and last names, email, optionally phone, organization, country, organization type, goals, optionally headcount, target date and message, plus originating action or page. Required fields are indicated in the relevant form. Related correspondence may contain replies, attachments and transmission status. Authorized administrators use professional email, roles, authentication and multifactor data, approved devices and audit logs. For abuse prevention, a cryptographic fingerprint derived from an IP address may be used to limit submissions over a rolling 24-hour period; such fingerprints may still qualify as personal data. Technical security logs may be generated by service providers. The public website currently uses no audience measurement, advertising or profiling tool.
Purposes
We process data to respond to contact requests; assess quotation requests and provide proposals; send related confirmations and replies; securely administer the website and publications; and prevent abusive or automated submissions.
Legal bases
Quotation requests may be processed under Article 6(1)(b) GDPR, for steps requested before entering a contract. Professional contact requests and site security may rely on legitimate interests under Article 6(1)(f). Certain records may be retained to comply with legal obligations under Article 6(1)(c), where applicable.
Recipients
Data is available only to authorized Nautilus Solutions personnel involved in handling requests or administering the website. It is not sold, rented or transferred to third parties for commercial purposes.
Processors and technical services
Services include Supabase/PostgreSQL for database, administrator authentication and file storage; Brevo for transactional emails and responses; and OVHcloud for domain registration and DNS. Exact providers and processing arrangements remain subject to the actual service configuration.
International transfers
Where a provider processes personal data outside the EU, applicable GDPR transfer rules and safeguards must be assessed, which may include an adequacy decision or the European Commission's standard contractual clauses. Individual data flows must be verified.
Retention periods
Contact and quotation requests and associated exchanges are kept as necessary to handle the request and the relationship, with deletion or archiving according to applicable legal obligations; their exact operational schedules require confirmation. Technical submission-control fingerprints are designed for a 24-hour window. Browser-based quotation drafts expire after two hours of inactivity, no later than 24 hours. Administrator accounts are maintained for the duration of their authorization.
Security
Measures include HTTPS transmission encryption, controlled access with multifactor authentication for administration, segregation of access, private files with temporary access links and logging of sensitive actions, subject to ongoing technical verification.
Your rights
Depending on applicable conditions, you may have rights of access, rectification, erasure, restriction, objection and data portability, and rights concerning instructions about the handling of data after death under French law.
Exercising your rights
Requests can be sent to contact@nautilus-solutions.fr or by post to Nautilus Solutions, 10 boulevard Raspail, 75007 Paris, France. Proof of identity may be requested if there is reasonable doubt. We generally respond within one month, subject to statutory extensions.
Complaint to the CNIL
You may lodge a complaint with the French data-protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
Updates
This policy may change following new processing activities or regulatory developments. See also the Cookies and trackers policy. The revision date appears at the top of the page.
