Privacy policy
The only data we receive is what you send us deliberately. With your consent, this site also uses Google Analytics to measure how it’s used — see “Cookies and analytics” below for what that involves and how to refuse or change your mind.
What this site collects
Nothing, until you fill something in — and nothing either if you browse without accepting analytics.
2 forms can collect your details:
- The contact forms — name, organisation, email, phone, and the message you write. The type of request and the page you wrote from are attached.
- The assistant — only if you explicitly ask to be contacted. It then passes on the same details, plus a summary of the exchange.
In both cases a checkbox records your consent, and the exact wording you agreed to is stored alongside your request: that is what demonstrates what you consented to, not merely that you ticked a box.
Why, and on what basis
To answer your contact, callback or audit request. The legal basis is your consent, given by ticking the box before sending and withdrawable at any time.
Your data is never sold, rented or passed on. It feeds no automated prospecting.
How long we keep it
3 years from your request, then deletion.
That period follows the CNIL reference framework for client and prospect management — the CNIL being the French data protection authority. The GDPR itself sets no fixed period: article 5.1(e) requires only that data is not kept longer than necessary for the purpose it was collected for.
Deletion is automatic: a weekly task removes requests that fall outside that window. You can ask us to erase your data sooner, at any time.
Who has access
- KARIGUARD, handling your request.
- OVH (France), which hosts the site’s server, where your request is recorded before being sent.
- Microsoft, which hosts the
contact@kariguard.commailbox your message lands in.
The message is delivered directly from the site’s server to that mailbox, with no third-party sending service in between: no other provider sees your details.
Hosting changed with this site. The previous one was in the United States (Texas); data is now processed in France.
Cookies and analytics
Only with your consent. On your first visit, a banner offers to turn on Google Analytics 4 to measure how the site is used (pages viewed, where visits come from) and whether it’s doing its job. Until you click “Accept”, no cookie is set and no data goes to Google.
If you accept, Google sets two measurement cookies
(_ga and _ga_…), kept for at most
2 months, and receives the pages you viewed, an
anonymous visit identifier, and technical information about your
browser. This site does not enable Google signals or personalised
advertising: only plain analytics is turned on. KARIGUARD’s Google
Analytics account is linked to a Google Ads account for internal
management purposes, but personalised advertising is switched off on
that link — no data from this site feeds advertising targeting.
You can refuse, or change your mind at any time, via the “Manage cookies” link at the bottom of every page.
One other thing only is stored in your browser: the current conversation with the assistant, in session storage. It never leaves your device unless you ask for it to be sent, and it disappears when you close the tab. No consent is required for this storage, strictly necessary to the service you opened.
Security
We apply to this site what we advise our clients to do:
- encryption end to end, for the site (HTTPS) and for mail delivery;
- a strict content security policy, blocking any script or resource from an external origin;
- a cap on submissions per address, against automated sending;
- request files readable only by the service account, on a hardened server.
Vulnerabilities are reported under our disclosure policy.
Your rights
You have the right to access, rectify, erase, object, restrict, and port your data, and to set directives on what happens to it after your death.
To exercise them, write to contact@kariguard.com. We reply within one month.
If our answer doesn’t satisfy you, you can complain to the French data protection authority: cnil.fr.
Your data as a client
This section concerns the commercial relationship, beyond this website.
- Identification data: the duration of the contract, plus 3 years.
- Service connection logs: 6 months.
- Accounting and financial records: 10 years, under legal obligations.
- Commercial prospecting: 3 years after the last contact.
Changes
This policy may change along with the site. Any substantial change will be flagged on this page.
