Privacy policy

Data controller

GDN, 1b Impasse Bellevue, 30100 Alès, France. For any question regarding your personal data, you can write to us at: dpo@gdn.fr.

Data we collect

We only collect what you voluntarily provide. The site has no member area, no sign-up and no account database.

Contact form and appointment booking

Name, email address, phone number and the content of your message. No sensitive data is requested.

Interactive assessments (Resources section)

The assessments offered in the Resources section run in two stages, and the line between them is a clear one.

  • During the questionnaire, we record the subject you declare (project name, type, website address if you provide one, business criticality) and your answers to the questions. No identifying data is requested at this stage, and your summary is displayed without you having to provide any.
  • If you request the detailed report, your first name and professional email address are added, then, entirely optionally, your company, your role and your intended timeframe.
  • Where applicable, we also record the campaign parameters present in the address you arrived through (utm_source, utm_medium and the like), so that we know which content led to the tool.

Technical logs

To prevent automated submissions, our forms record in a security log the IP address and browser of rejected and accepted submissions, together with a fingerprint of the email address rather than the address itself. These logs serve that purpose only and are never matched against your file.

Purposes and legal basis

Contact form data is used to respond to your requests, organize a complimentary strategy session and follow up on the relationship. Assessment data is used to produce your summary, generate the detailed report, send it to you and, if you invite us to, go through that summary with you.

Processing is based on your consent and on GDN's legitimate interest in responding to its prospects and clients. Sending our publications rests on your consent alone, collected through a box that is never pre-ticked: the report is sent to you whether you tick it or not.

An assessment score is computed from your declarative answers alone. It produces an internal callback priority indicator. No automated decision producing legal effects or significantly affecting you is taken on that basis: the score serves to write a report and, possibly, to have a human being call you back sooner.

Recipients and subprocessors

Your data is intended solely for GDN's teams. Three providers act as subprocessors: Mailjet (transactional email delivery, including reports and verification codes), Calendly (appointment scheduling) and Google Analytics (anonymized audience measurement, subject to your consent). No data is sold or transferred to third parties for commercial purposes, and your assessment answers are passed to no one outside GDN.

How your data is protected

The subject of our assessments touches on information you would rather not see circulate. We would therefore rather describe what we do than assert that your data is safe.

  • Encrypted at rest. Your answers, your summary and the PDF report are encrypted with AES-256-CBC then signed with HMAC-SHA-512 before being written. The key is not in the file: a copy of the storage, without it, yields nothing readable. A file altered by a single byte is rejected rather than read incorrectly.
  • Tied to your session alone. Your file is linked to a 32-byte random identifier that never travels in an address, is not readable by the page's JavaScript and is signed server-side. A hand-crafted identifier is refused without the storage even being consulted.
  • Stored out of reach of the web. The files live in a directory that denies all HTTP access and carries a second, password-based protection. Their names are fingerprints, not identifiers: listing the files yields no access key.
  • Verified resumption. The resume link we may email you opens nothing on its own: it asks for a one-time code, sent to that same address and valid for ten minutes. An email that is forwarded, or that reaches the wrong recipient, therefore does not open your answers.

Retention period

Data related to a request is kept for as long as necessary to process it, then archived or deleted within three years of the last contact. The same period applies to assessment summaries and their associated reports.

Two shorter periods also apply: a resume link stops working after thirty days, and the verification code it asks for after ten minutes. Anti-spam security logs are kept for twelve months.

Your rights

In accordance with Regulation (EU) 2016/679 (GDPR), you have the right to access, rectify, erase, restrict, object to and port your data. You can exercise these rights at any time by writing to dpo@gdn.fr. Deleting an assessment summary is requested the same way, or simply by replying to the email through which you received it. You also have the right to lodge a complaint with the CNIL (French data protection authority).

Cookies

The site uses functional and audience measurement cookies. Audience measurement cookies are set only after your consent, which you can change at any time from the banner provided for that purpose.

Two functional cookies are not subject to consent, because the service cannot be delivered without them: the one carrying your browsing session, and the one tying an assessment in progress to that session. The latter is kept for ninety days, is not readable by the page's JavaScript and serves no advertising tracking and no cross-site matching.

Last updated: 2 September 2026.