Privacy policy

1. What data do we collect and when?

1.1 Browsing the site

When you visit the site, technical data may be collected: IP address, date and time of connection, pages viewed and information about the browser used. This is used to keep the site running and secure, and to measure audience in aggregate. Any use of cookies is set out in section 5.

1.2 Contact form

The site has no user account, personal area or newsletter: the only direct collection is via the contact form, which collects your name, e-mail address, company (optional) and message, solely in order to reply to your request.

2. How do we protect your data?

Technical and organisational security measures are in place to guarantee the security, integrity and confidentiality of your data and to prevent it being distorted, damaged or accessed by unauthorised third parties, taking into account the state of the art and the nature of the processing. No measure being infallible, absolute security cannot however be guaranteed.

3. Who do we share your data with?

Your data may be processed by our technical providers (hosting, audience measurement) acting on our behalf and bound by the same confidentiality. No data is sold or passed to third parties for commercial purposes, and no transfer is made outside the European Union. Your data may be disclosed to administrative or judicial authorities when the law requires it.

4. How long do we keep it?

Data submitted via the contact form is kept for as long as needed to handle your request, then archived or deleted. In any event, the retention period does not exceed what is necessary for the purposes for which the data is processed, in compliance with applicable laws and regulations.

5. Cookies

A cookie is a small file placed on your device when you visit a site. shamalo.com does not use any advertising or marketing-tracking cookies. It only stores, in your browser's localStorage, the display preference shamalo-adn (the visual atmosphere you choose); this information stays on your device and is not transmitted. You can at any time configure your browser to erase or refuse this storage, with no impact on access to the content.

6. What are your rights?

Under articles 15 to 22 of the GDPR, you have a right of access, rectification and erasure of your data, as well as rights of objection, restriction, portability and to define what happens to your data after your death. You may also withdraw your consent at any time.

To exercise these rights, write to mathieu@shamalo.com, attaching proof of identity if needed.

7. Changes to this policy

We reserve the right to amend this policy at any time. You are encouraged to consult it regularly; changes are published on this page. Your use of the site after a change constitutes acceptance of it.

8. Contact

For any question relating to your personal data, contact us by e-mail at mathieu@shamalo.com (subject “Privacy — Data protection”).

9. Commission Nationale de l'Informatique et des Libertés (CNIL)

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL, on its website or by post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Booking an appointment online

This section is the information notice required by article 13 of the GDPR for the online appointment booking offered on the contact page. The data is collected directly from you, at the moment you ask for a meeting.

Data controller

The data controller is Mathieu Milon, sole trader, 80 rue Curial, 75019 Paris, France. For any question or request about your data, write to mathieu@shamalo.com: this address is published and monitored.

Purpose

The data is used to arrange and hold the meeting you asked for yourself: recording the slot you chose, sending you an e-mail confirmation carrying a calendar invitation, sending you a reminder before the date, and letting you cancel or reschedule on your own.

What this processing does not do: no profiling, no prospect scoring, no automated decision-making within the meaning of article 22 of the GDPR, no sale or transfer to third parties, and no third-party audience measurement.

Legal basis: article 6(1)(b)

The legal basis is article 6(1)(b) of the GDPR: steps taken at the request of the data subject prior to entering into a contract. By booking a slot you are yourself asking for a step ahead of a possible working relationship; it is that request, and not any permission you would grant us, that makes the processing lawful.

This is not consent, and the checkbox on the form is not one either: it records that you have been informed of the processing described here. Consent is reserved for what genuinely requires it — cookies, and any subscription to our communications, unticked by default and never a condition of booking.

Data collected

Your name and e-mail address are required: they are the only data needed to hold a meeting. Your phone number and your message are optional. No field is collected “just in case”.

To these are added the data the booking technically needs — the chosen slot, your timezone and the language of the page — together with your IP address, kept to prevent abuse of the public forms.

The free-text message field must not be used for health information or for any other sensitive data within the meaning of article 9 of the GDPR. Information of that kind written there is deleted.

Recipients and processors

Two processors are involved: Hetzner Online GmbH for hosting the server and the database (Germany, European Union) and Hostinger for sending e-mail (European Union), since confirmations carry your name and address. There is no other recipient, no sale or transfer, and no transfer outside the European Union or the European Economic Area.

Retention

Your booking data is kept for 24 months after the appointment date. After that, a weekly automated job pseudonymises it in place: name, phone, message, IP address and browser are erased, and the e-mail address is replaced by a digest that no longer identifies you directly. Only the date, the status of the appointment and the record that this notice was presented to you remain.

Your rights

Under articles 15 to 21 of the GDPR you have a right of access, rectification, erasure, restriction, portability and objection over this data. These requests are made to mathieu@shamalo.com and receive a free reply within one month (article 12(3) of the GDPR).

No identity card, passport or similar paper is requested. Where a serious doubt remains about who is writing, it is resolved by exchanging with the e-mail address already recorded on the booking.

To cancel or reschedule you do not need to write: the “manage my booking” page, whose link is sent to you in the confirmation e-mail, lets you do it directly.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL, on its website www.cnil.fr or by post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Version of this notice: 2026-09.

These provisions are a documented internal position, built from the CNIL's published guidance and the practices already in place on this site; this is not legal advice.