Privacy and Cookie Policy

Last updated: September 2026.
‍

Document reference	GDPR_DPP_3_A
Version	vf
Status	In progress
Author	Data Protection Officer
Classification	Public
Distribution	TEHTRIS websites
Owner	Data Protection Officer
Scope	Websites, events and marketing communications. Does not cover processing carried out through the TEHTRIS solution on behalf of clients, which is governed by separate documentation.

Version history

Version	Date	Nature
1.0	2018-05-25	Creation
1.1	2020-08-07	General update
1.2	2022-03-15	General update
2.0	2023-12-04	Compliance update and extension to subsidiaries
3.0	2026-09-03	Change of data controller (Reak-T), website redesign, update of trackers and processors, overhaul of transfers outside the EU, addition of the missing information required under Articles 13 and 14 of the GDPR

‍

Submit

Version	Approved by	Department	Date	Status
2.0	DPO	Legal	2023-12-04	OK
3.0	DPO	Legal	2026-09-03	OK

Introduction

Privacy and Cookie Policy

TEHTRIS is committed to protecting your personal information and to being clear and transparent about the information we collect and how we use it.

This policy explains who we are, how we collect, use, and disclose your personal data when you use our websites, participate in our events, or interact with us, and how you can exercise your rights.

We may provide additional information specific to a given site, event, product, or service. This information supplements this policy without replacing it.

For any questions regarding the use of your personal data, you may contact us using the details provided in section 11.

‍

1. Data Controller

Reak-T, a simplified joint-stock company with a capital of 1,000 euros, registered with the Paris Trade and Companies Register under number 106 496 029, with its registered office located at 56-58, rue de Ponthieu — 75008 Paris, operating under the trade name "TEHTRIS" (hereinafter "TEHTRIS," "we," or "our"), is the data controller for personal data collected on the Site within the meaning of Regulation (EU) 2016/679 of April 27, 2016 ("GDPR") and the amended Act No. 78-17 of January 6, 1978.

‍

2. Scope

‍

This policy is intended for users of our websites, registrants and participants in our events, and individuals with whom we interact for marketing purposes (hereinafter the "data subjects").

It describes the collection, use, and disclosure of data, in our capacity as data controller:

• information obtained through TEHTRIS websites that link to this policy (the "Site");

• information collected during registration for our events or related to participation in events organized by us or our partners (the "Events");

• marketing communications we send you when we have obtained your contact details through another channel.

The Site may contain links to third-party websites, including those of our partners. These sites have their own privacy policies, for which we assume no responsibility. We encourage you to review them before providing any information to them.

3. Data collected, purposes, and legal bases

The GDPR defines personal data as any information relating to an identified or identifiable natural person.

You can browse the Site without providing any personal data. To access certain features or to send us a request, we may need to collect data, limited to what is strictly necessary for the intended purpose (data minimization principle). We limit access to your data to the relevant departments.

‍

Purpose	Data subjects and data	Legal basis	Retention	Recipients
COMMERCIAL AND CONTRACTUAL RELATIONSHIP
Respond to your requests for information about our products and services; give you access to a demonstration or evaluation instance	Prospects Last name, first name, business email, job title, company, country, phone (optional)	Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR)	3 years from the last contact	Relevant internal departments Group companies HubSpot
Perform our obligations and enforce our rights under any contract entered into with you, including customer relationship and support management	Clients, partners Last name, first name, email, job title, company, relationship tracking data	Performance of the contract (Art. 6(1)(b) GDPR)	5 years from the end of the contractual relationship	Relevant internal departments Group companies
Send you marketing communications about our products and services, in line with your preferences	Prospects, clients Last name, first name, email, job title, company	Consent (Art. 6(1)(a)) for non-client prospects Legitimate interest (Art. 6(1)(f)) for clients, regarding similar products	Until consent is withdrawn or objection is raised, and no later than 3 years after the last contact	Relevant internal departments HubSpot
Sector analysis, measurement of commercial performance and improvement of our offering	Prospects, clients Last name, first name, email, company, job title	Legitimate interest (Art. 6(1)(f)), balanced against your rights and freedoms	3 years after the last contact (prospects); 5 years after the end of the contract (clients)	Relevant internal departments Group companies
Comply with our accounting and tax obligations	Clients, suppliers Billing data	Legal obligation (Art. 6(1)(c) GDPR)	10 years from the end of the financial year (Art. L. 123-22 of the French Commercial Code)	Internal departments Statutory auditor Tax authorities
RECRUITMENT
Process your application for a position or internship and communicate with you during the recruitment process	Candidates Identity, contact details, background and any information contained in your application	Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR)	2 years after the last contact, unless you object	Human Resources department Relevant managers
EVENTS
Manage your registration and participation in our events	Attendees, speakers Last name, first name, email, company, job title	Consent (Art. 6(1)(a)) or performance of the contract, as applicable	2 years after the event	Relevant internal departments Registration provider, where applicable
Promote our products, services and events, in particular through the publication of photographs and recordings made at events	Attendees, speakers Image, voice, name, job title, company	Consent (Art. 6(1)(a)) where you are identifiable	2 years after the event, unless consent is withdrawn	Relevant internal departments Social media
COMMUNICATION
Send you our newsletter	Subscribers Email address	Consent (Art. 6(1)(a) GDPR)	Until you unsubscribe	Relevant internal departments HubSpot
Handle requests sent through our contact forms, including requests addressed to the Data Protection Officer	Any requester Last name, first name, email, company, job title, country, message content	Pre-contractual measures or legitimate interest in responding to your request Legal obligation for requests to exercise rights	2 years after the last contact 3 years for requests to exercise rights, for evidentiary purposes	Relevant internal departments HubSpot
WEBSITE OPERATION AND SECURITY
Ensure the operation, maintenance and security of the Website, and prevent and detect incidents	Visitors IP address, technical logs, browser and operating system type, pages viewed	Legitimate interest (Art. 6(1)(f) GDPR)	13 months from collection	Relevant internal departments Hosting provider
Measure Website traffic and improve its content	Visitors Tracker ID, IP address, pages viewed, browsing path, visit source	Consent (Art. 82 of French Act No. 78-17 and Art. 6(1)(a) GDPR)	Trackers: 13 months Data from trackers: 25 months	Relevant internal departments Google

3.1 Mandatory or optional nature of requested information

On our forms, fields that must be provided to process your request are marked as mandatory. If you do not fill them out, we will be unable to follow up on your request. Other fields are optional; leaving them blank has no consequences.

Subscription to our newsletter is independent of any other request and never conditions the processing of such requests.

3.2 Data not provided by you

We may receive information about you from our business partners, particularly when you have expressed interest in our products to them, downloaded content, or agreed to be contacted. The categories of data concerned are your professional contact details and your job title. We will inform you of this during our first communication, no later than one month after obtaining the data, in accordance with Article 14 of the GDPR.

3.3 Absence of automated decision-making

The processing described in this policy does not involve any decision based exclusively on automated processing that produces legal effects concerning you or similarly significantly affects you.

4. Retention periods

The durations applicable to each purpose are listed in the table in section 3. Upon the expiration of these periods, the data is deleted or anonymized, subject to the following cases:

• intermediate archiving of client and partner data for five years after the end of the relationship, for evidentiary and complaint management purposes, with restricted access;

• retention of accounting documents for ten years from the end of the financial year (Article L. 123-22 of the French Commercial Code);

• retention of data strictly necessary for the establishment, exercise, or defense of legal claims, for the duration of the applicable statute of limitations.

5. Cookies and trackers

When you visit the Site, information relating to your device's navigation may be saved in cookie files installed on your device, subject to the choices you express and which you may modify at any time.

5.1 What is a cookie?

A cookie is a small data file placed on your device by the website you are visiting. It allows the site to recognize your device and store certain information about your preferences or past actions, in order to enable its functionality or improve its performance.

Cookies may be placed by the Site itself or by a third party. They can be session cookies—deleted when the browser is closed—or persistent cookies, in which case they have an expiration date.

Other technologies may be used for the same purposes, including web beacons (invisible pixels used in combination with cookies to analyze user journeys) and the use of IP addresses, which are technical identifiers that can be used to determine the approximate location of a device.

5.2 Obtaining your consent

In accordance with Article 82 of the French Data Protection Act (Law No. 78-17 of January 6, 1978, as amended), we obtain your prior consent before placing or reading any trackers that are not strictly necessary for the provision of the service you request.

Your choices are collected via the Axeptio consent management platform. They are stored for six months, after which you will be asked for your choice again. You can view and modify your settings at any time using the "Cookie Management" module, which is permanently accessible on the Site.

Refusing trackers is just as easy as accepting them, and you may withdraw your consent at any time without affecting your access to the Site's content. If you do not make a choice, it is treated as a refusal: no non-exempt trackers will be placed until you have accepted them.

5.3 Tracking pixels and similar technologies

In addition to cookies, the Site and our electronic communications may use tracking pixels, also known as web beacons, clear GIFs, or pixel tags. These are typically very small, transparent images invisible to the naked eye, or snippets of code, loaded from a third-party server when you view a page or message.

Tracking pixels are subject to the same legal framework as cookies. Article 82 of the French Data Protection Act (Law No. 78-17 of January 6, 1978, as amended) covers any operation aimed at writing information to your device or accessing information already stored there, regardless of the technology used. Consequently, with the exception of those strictly necessary to provide the service you request, no tracking pixel is activated without your prior consent, collected under the conditions described in section 5.3. You may withdraw this consent at any time, with the same effect as for cookies.

The tracking pixels we use are listed in the table in section 5.4, alongside the cookies with which they are associated. Their duration of activity and the retention period for the data they collect are identical to those indicated for the corresponding cookies.

Pixels embedded in our electronic communications

When you subscribe to our newsletter or receive our commercial communications, a pixel may be embedded in the message to let us know if it has been opened and if the links it contains have been clicked. We use this information to measure the relevance of our mailings and to stop contacting inactive recipients. This tracking is based on the consent you provided when subscribing. You can opt out by configuring your email software to block the automatic loading of remote images, or by unsubscribing at any time using the link at the bottom of each message.

5.4 Trackers used

Category	Issuer / tool	Domain	Purpose and notes
Strictly necessary (exempt from consent)	Axeptio	axeptio.eu	Stores your tracker preferences. This tracker is essential to record your consent and to comply with it. Duration: 6 months.
	Webflow	Webflow.io	Technical cookies required for the display and proper functioning of the Website.
Audience measurement (subject to consent)	Google Analytics 4	Analytics.google.com	Statistical analysis of traffic and browsing paths. Tracker duration: 13 months. Data retention: 25 months.
	Google Tag Manager	Googletagmanager.com	Tag manager that triggers third-party trackers. Its loading is conditional on your consent when it is used to deploy non-exempt trackers.
Marketing and customer relationship (subject to consent)	HubSpot tracking pixel	hubspot.com	Identifies visitors coming from our campaigns, tracks forms and personalizes the commercial relationship. Measures opens and clicks in our electronic communications.
Social media (subject to consent)	LinkedIn Insight Tag	linkedin.com	Measures the performance of LinkedIn posts and campaigns, and identifies visitors coming from this network.
	YouTube	youtube.com	Trackers set when an embedded video on the Website is played.

5.5 Other measurement tools

We also use Google Search Console, which provides us with aggregated statistics on the Site's visibility in search results. This tool does not place any trackers on your device and cannot be used to identify you.

5.6 Additional browser settings

Regardless of the Site's cookie management module, most browsers allow you to control the placement of trackers. While these settings do not constitute a valid way to express consent, they can supplement your choices:

• Google Chrome: support.google.com/chrome/answer/95647

• Microsoft Edge: support.microsoft.com — "Cookies and privacy" section

• Mozilla Firefox: support.mozilla.org — "Cookies" section

• Apple Safari: support.apple.com/en-us/safari

• Opera: help.opera.com — "Web preferences" section

To learn more about cookies, you can visit the CNIL website (www.cnil.fr) or www.youronlinechoices.com.

6. Recipients of your data

Your data is processed by authorized TEHTRIS personnel. We ensure that only those who need to know have access to it.

They may also be disclosed:

• to the group companies listed in section 1.2, for the purposes described in section 3;

• to our subcontractors, who act only on our documented instructions and within the framework of a contract compliant with Article 28 of the GDPR;

• to our advisors (lawyers, auditors) and, where applicable, to administrative or judicial authorities, in cases provided for by law.

Processor	Role	Location and safeguards
Webflow, Inc.	Website design and hosting	United States, adequacy decision under the EU-US Data Privacy Framework and/or standard contractual clauses
Google Ireland Ltd / Google LLC	Audience measurement (GA4), tag management (GTM)	Ireland and United States, adequacy decision under the EU-US Data Privacy Framework
HubSpot, Inc. / HubSpot Ireland Ltd	Customer relationship management, forms, sending of communications	Ireland and United States, adequacy decision under the EU-US Data Privacy Framework
Axeptio	Collection and storage of tracker preferences	European Union

We may be required to disclose your data by law, court order, or a request from a competent authority. We may also do so when reasonably necessary to assert our rights, enforce our terms and conditions, prevent or detect fraud, or protect our operations and users.

7. Transfers outside the European Union

Our data is hosted by service providers that we ensure offer an appropriate level of protection.

Some operations involve transferring data to countries outside the European Union. Before any transfer, we ensure it is governed either by an adequacy decision from the European Commission or by appropriate safeguards as defined in Article 46 of the GDPR, such as standard contractual clauses, supplemented where necessary by additional measures.

‍

Activity	Destination	Transfer safeguards
Website hosting and design (Webflow)	United States	Adequacy decision under the EU-US Data Privacy Framework
Audience measurement and tag management (Google)	United States	Adequacy decision under the EU-US Data Privacy Framework
Customer relationship and communications (HubSpot)	United States	Adequacy decision under the EU-US Data Privacy Framework
Distribution of content to social media	United States	Adequacy decision under the EU-US Data Privacy Framework and/or standard contractual clauses

You can obtain a copy of the safeguards in place by writing to our Data Protection Officer.

8. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized loss, misuse, alteration, disclosure, or destruction, taking into account the state of the art, implementation costs, and the risks involved.

These measures are reviewed and improved as technologies and threats evolve. However, as the Internet is an open network, we cannot guarantee the absolute security of data transmissions passing through it.

All of our staff and subcontractors are bound by a confidentiality agreement.

9. Under what circumstances will TEHTRIS contact you?

Our goal is not to be intrusive, and we are committed to not requesting irrelevant or unnecessary information.

Beyond the services you have requested and the communications you have consented to, we will only contact you in the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, in accordance with Article 34 of the GDPR.

10. Your rights

Subject to the conditions set forth by regulation and the legal basis of the processing in question, you have the following rights:

‍

Right	Scope
Right of access	Obtain confirmation as to whether data concerning you is being processed and, where applicable, obtain a copy of it as well as information about the purposes, the categories of data, the recipients, the retention periods and the origin of the data.
Right to rectification	Have inaccurate data concerning you corrected or incomplete data completed.
Right to erasure	Obtain the erasure of your data, in particular where it is no longer necessary in relation to the purposes, where you withdraw your consent and there is no other legal basis, where you object to the processing and there are no overriding legitimate grounds to the contrary, or where the data has been unlawfully processed.
Right to object	Object, on grounds relating to your particular situation, to processing based on our legitimate interest. You may object at any time and without giving reasons to processing for direct marketing purposes.
Right to restriction	Obtain the restriction of processing, in particular where you contest the accuracy of the data, where the processing is unlawful but you do not want it erased, or where you need the data for the establishment, exercise or defense of your rights.
Right to data portability	Receive the data you have provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
Withdrawal of consent	Withdraw your consent at any time, where the processing is based on it. Withdrawal does not affect the lawfulness of processing carried out before it.
Post-mortem directives	Set directives regarding the storage, erasure and communication of your data after your death (Article 85 of French Act No. 78-17).
Right to lodge a complaint	Lodge a complaint with the supervisory authority.

10.1 How to exercise your rights

You may exercise your rights by contacting our Data Protection Officer (see section 11). To protect your data, we may ask for proof of identity if we have reasonable doubts regarding the identity of the requester.

We will respond to your request within one month of receipt. This period may be extended by two months due to the complexity or number of requests; we will inform you of any such extension within one month of receiving your request.

10.2 Complaints to the CNIL

If, after contacting us, you believe your rights have not been respected, you may file a complaint with:

‍

Authority	French Data Protection Authority (CNIL)
Address	3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Phone	+33 1 53 73 22 22
Website	www.cnil.fr

11. Data Protection Officer contact details

For any questions regarding the processing of your data or the exercise of your rights, you may contact our Data Protection Officer:

By email	privacy@tehtris.com
By post	Reak-T, For the attention of the Data Protection Officer, 56-58 rue de Ponthieu, 75008 Paris, France
Via the Website	Contact form, "Legal & DPO" section

12. Third-party websites

The Site may contain links to third-party websites. We make no representations or warranties regarding these sites. Their publishers may collect, use, or transfer personal data under different terms than ours. We encourage you to review their privacy policies before providing them with any information.

13. Changes to this policy

This policy may be updated to reflect changes in our processes, tools, or regulations. The applicable version is the one published on the Site. In the event of a material change, we will notify you through appropriate means, such as a banner on the Site or, where appropriate, via a direct message.

Please check this page regularly.

Last updated: 09/03/2026