Privacy policy

1. Data controller

The controller of personal data is:

KAYZEN EI, sole trader (entreprise individuelle, SIREN 493 857 262), hereinafter “KAYZEN”
Registered office: 6 rue Pierre Termier — 69009 Lyon, France
Email: contact@kayzen-lyon.fr
Telephone: +33 4 87 77 68 61

2. Data collected

We collect the following data in connection with your use of the Site:

• Contact data: surname, first name, business email address, telephone number, company name;
• Project data: type of project, budget, timeframe, desired features, existing URL, message;
• Browsing data: IP address, browser type, pages visited, length of visits (subject to your consent to analytics cookies);
• Cookies: strictly necessary technical cookies; audience measurement (Google Analytics 4) and Google advertising signals, subject to your consent.

3. Purposes of processing

Your personal data is processed for the following purposes:

• Responding to your quote requests and enquiries;
• Preparing personalised commercial proposals;
• Improving our services and the user experience;
• Measuring site traffic (Google Analytics 4, only after your consent);
• Complying with our legal and regulatory obligations.

4. Legal basis for processing

The processing of personal data is based on:

• Your consent (Article 6(1)(a) GDPR) for audience measurement and Google advertising signals, and for sending the contact form;
• Legitimate interest (Article 6(1)(f) GDPR) for cookies strictly necessary for the site to function;
• The performance of pre-contractual measures (Article 6(1)(b) GDPR) for processing quote requests.

5. Recipients and processors

Your data is never sold or rented. It is accessible to authorised personnel of KAYZEN and to the following processors, who act on our documented instructions within the meaning of Article 28 GDPR:

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, États-Unis — hosting of the Site and execution of the Edge Function that processes the contact form. Data: IP address, connection logs, content of the contact form while it is being transmitted. Transfer outside the EU governed by the European Commission’s standard contractual clauses and by EU-U.S. Data Privacy Framework certification.
• Brevo SAS, 7 rue de Madrid, 75008 Paris (France) — sending of contact form emails.
• Resend Inc. (United States) — sending of emails and of the PDF quote generated by the quote configurator. Transfer governed by standard contractual clauses.
• Supabase Inc. — database of quote requests, hosted in the European Union (eu-north-1 region, Stockholm), and execution of the server functions that relay the conversational assistant’s messages to Google Gemini and send the quote. Data: identity, contact details, project description, estimated amount; content of the assistant’s messages while they are being transmitted.
• Google Ireland Ltd — the Gemini service, used by our chatbot assistant (see section 11); Google Analytics 4, loaded only after your consent (see section 8); Google Maps, embedded in an iframe and loaded only after your explicit action.
• Calendly LLC (United States) — online appointment booking: calendar embedded in an iframe, loaded only after the appointment form has been submitted. Data: whatever you enter in the calendar.
• Cloudflare, Inc. (United States) — Turnstile anti-bot check on the contact, appointment and quote forms. Data: technical browser signals and IP address, used to tell a human from a bot; no advertising tracking cookie. Transfer governed by the standard contractual clauses and the EU-U.S. Data Privacy Framework certification.
• IONOS SARL, 7 place de la Gare, 57200 Sarreguemines, France — domain name and DNS. No form data passes through IONOS.

Your data may also be disclosed to administrative or judicial authorities where we are required to do so by law.

6. Retention period

• Form data: 3 years from the last contact;
• Analytics cookies: 13 months maximum, in line with the recommendations of the CNIL (the French data protection authority);
• Billing data: 10 years (statutory accounting obligations).

7. Your rights

Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

• Right of access: to obtain confirmation that your data is being processed and a copy of it;
• Right to rectification: to request the correction of inaccurate data;
• Right to erasure: to request the deletion of your data;
• Right to restriction: to request the restriction of processing;
• Right to data portability: to receive your data in a structured format;
• Right to object: to object to the processing of your data;
• Post-mortem directives: to set directives concerning what happens to your data after your death (Article 85 of the French Data Protection Act, loi Informatique et Libertés);
• Right to withdraw consent: to withdraw your consent at any time.

To exercise these rights, contact us at: contact@kayzen-lyon.fr

If you disagree, you may lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, the French data protection authority): www.cnil.fr (opens in a new tab).

8. Cookies

On your first visit to the Site, a banner informs you of the use of cookies and asks for your consent. You can change your preferences at any time by clicking the cookie icon at the bottom left of the Site.

Necessary cookies: essential for the site to function (theme preferences, cookie consent). They do not require your consent.

Analytics cookies: Google Analytics 4 (Google Ireland Ltd) measures use of the site (pages visited, time spent). It is loaded only after your prior consent.

Google advertising signals (ad personalisation): sent to Google only if you accept them.

Consent to cookies is valid for 13 months. After this period, your consent will be requested again.

9. Security

KAYZEN implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access. The Site uses the HTTPS protocol to encrypt communications.

10. Transfers outside the European Union

The Site is hosted by Vercel Inc., a company established in the United States, whose content delivery network serves pages from points of presence in Europe. The quote request database is hosted in the European Union (Supabase, eu-north-1 region). Some processors (Vercel, Resend, Google) are, however, established in the United States or operate servers there. These transfers are governed by:

• the processor’s participation in the EU-U.S. Data Privacy Framework, where certified (verifiable at dataprivacyframework.gov (opens in a new tab)); and/or
• the signing of the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by the additional technical measures recommended by the European Data Protection Board.

A copy of the applicable safeguards can be obtained on request from contact@kayzen-lyon.fr.

11. Conversational assistant (artificial intelligence)

The Site provides a conversational assistant available from every page. In accordance with Article 50 of Regulation (EU) 2024/1689 on artificial intelligence, we inform you that it is an artificial intelligence system, not a human.

• Technology used: Gemini model, provided by Google.
• Data transmitted: the content of the messages you type is sent to Google, via a server function run on Supabase (see section 5), in order to generate the response. Please do not share sensitive data, passwords or confidential information.
• Purpose and legal basis: answering your questions about our services — legitimate interest (Art. 6(1)(f) GDPR).
• Retention: conversations are not stored in our databases. They remain in your browser’s memory for the duration of the session and disappear when it is closed.
• Reliability: responses are generated automatically and may contain errors. They have no contractual value: only a signed quote is binding on KAYZEN.
• Human alternative: you can reach a member of the team at any time at contact@kayzen-lyon.fr, on +33 4 87 77 68 61, or via the Book an appointment page.

No decision producing legal effects concerning you is taken by automated means on the basis of these exchanges (Art. 22 GDPR).

12. Changes to this policy

KAYZEN reserves the right to amend this privacy policy at any time. Any change will be published on this page together with the date of the update. We encourage you to consult this page regularly.