Privacy policy
Last updated: 21 September 2026
Data controller
KAIRUN OFFICE SAS 29 rue Tronchet, 75008 Paris, France [email protected]
Data collected and purposes
| Contact form | Name, company, business email address, subject, display language and message. Used to handle your enquiry and follow it through. |
|---|---|
| Anti-bot verification | Your IP address, passed to the verification provider when you submit the form. Used to block automated submissions. |
| Security logs | Timestamp, IP address, country, browser, requested address and security rules triggered. Kept by the delivery provider to maintain the availability and security of the site. |
| Job applications | Contact details and professional information you provide in your message, and in the exchanges that follow. Used to consider your application. |
This site runs no analytics whatsoever: no visitor statistics are produced, neither by KAIRUN OFFICE nor by any provider.
The site offers no file upload. A CV or any other document can only reach us by email, at your own initiative. The information required to handle your enquiry is identified in the form; without it we may be unable to reply.
Legal bases
| Contact form | Legitimate interest in responding to enquiries, or pre-contractual measures where the enquiry concerns an engagement. |
|---|---|
| Anti-bot verification | Legitimate interest in protecting the form from abuse. |
| Security logs | Legitimate interest in keeping the site secure. |
| Job applications | Pre-contractual measures. Legitimate interest or consent where a profile is kept on file for future opportunities. |
Retention periods
| Messages and contact enquiries | 12 months after the last exchange. |
|---|---|
| Applications kept on file for future opportunities | Up to 24 months after the last contact, subject to your being informed and to your rights. |
| Security logs | 31 days, the retention period applied by the delivery provider. KAIRUN OFFICE keeps no copy of them. |
| Delivery history of form messages | Kept by the email delivery provider under its own policy. It records the delivery status only, never the content of the message. |
| Anti-bot verification data | Not retained. Your IP address is passed on only at the moment of verification and is not recorded. |
Data may be kept longer where a legal obligation or the handling of a dispute requires it, within the applicable limits.
Recipients and hosting
Your data is accessible only to authorised staff of KAIRUN OFFICE and to the technical providers required to operate the site.
| Scaleway | Scaleway SAS, France. Hosts the site files and delivers messages from the contact form. Processing in France, Paris region. |
|---|---|
| Cloudflare | Cloudflare, Inc., United States. Handles site delivery, encryption of communications, the application firewall, rate limiting, anti-bot verification and contact form processing. Global network, with processing in Europe for European visitors. |
| Google Ireland Limited. Provides the business mail service that receives and stores messages from the form and the exchanges that follow. European Union, with possible access from the United States. | |
| GitHub | GitHub, Inc., United States. Hosts the site's editorial content and the authentication of its administration interface. Processes no visitor data. |
The contact form is processed by a program hosted at Cloudflare, which checks the request and forwards it immediately by email. That program retains no data: not the message, not the email address, not the IP address. Your IP address is never included in the message forwarded to us.
Your data is neither sold nor used for commercial prospecting outside the applicable rules.
Transfers outside the European Union
The site files are hosted and the form messages delivered in France. Two providers, however, are entities established outside the European Economic Area.
- Cloudflare, Inc., United States, for site delivery and form processing. European visitors are served from European points of presence, but access from the United States by the provider's staff cannot be ruled out.
- Google LLC, United States, which may access data processed by Google Ireland Limited in the course of providing the mail service.
These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the adequacy decision available to companies certified under the EU–US Data Privacy Framework, together with the technical measures implemented by those providers. The applicable commitments are set out in the data processing agreements concluded with each of them.
Cookies and local storage
The site sets no cookies for analytics, advertising or individual tracking. Your browser keeps three technical items locally, none of which is ever sent to us.
| Theme preference | Restores the light or dark appearance you chose. Kept until you clear it. |
|---|---|
| Reading position and last article viewed | Returns you to the right place on the page after a language change or after coming back from a publication. Cleared when you close the tab. |
| Anti-bot verification item | Set when you submit the form, to tell a human submission from an automated one. Lifetime set by the provider, from a few minutes to a few hours. |
These items are strictly necessary to the operation of the site or to the security of the form. On that basis they do not require your prior consent.
Security
KAIRUN OFFICE implements appropriate technical and organisational measures to protect your data against unauthorised access, loss and disclosure.
- Encrypted communications, with automatic redirection to the secure protocol and a strict transport security policy.
- A fully static site, with no database and no server-side processing beyond the contact form, which reduces the attack surface accordingly.
- An application firewall and rate limiting in front of the form.
- Server-side revalidation of every form field, placing no trust in the browser.
- A message sending key restricted by policy to the single action of sending an email, and renewed every year.
- Two-factor authentication on all administration accounts.
- Authentication of messages sent on behalf of the domain through SPF, DKIM and DMARC, and cryptographic signing of name server responses.
Access to data is limited to authorised people and providers, to the extent necessary for their tasks.
Your rights
Under the GDPR you have, depending on your situation, the rights of access, rectification, erasure, restriction, objection and portability. Where processing relies on your consent, you may withdraw it at any time.
To exercise your rights, write to [email protected]. You will receive a reply within one month of your request being received. You may also lodge a complaint with the CNIL, the French data protection authority, at CNIL(new tab).
Updates
KAIRUN OFFICE may update this policy to reflect changes in its activities, in the processing it carries out, or in the applicable regulations.