Privacy policy
Last updated: 15 April 2026
Atelier NovAlp (hereinafter “we”, “our”, “us”) attaches particular importance to the protection of your personal data. This privacy policy describes the information we collect, why we collect it, how we use it, who we share it with, and the rights you have under the General Data Protection Regulation (EU) 2016/679 (hereinafter “GDPR”) and amended French law no. 78-17 of 6 January 1978 known as the “Informatique et Libertés” law.
1 · Data controller
The controller of the personal data collected via the website atelier-novalp.com is:
- Atelier NovAlp, SARL with variable capital
- 198 Avenue du Grand Port, 73100 Aix-les-Bains, France
- RCS Chambéry 981 252 257
- Managing partners: Baptiste Guiliani and Lucas Sicot
- Email: contact@atelier-novalp.com
- Telephone: 06 82 32 16 67
Given the size of Atelier NovAlp and the nature of its processing, appointing a data protection officer (DPO) is not mandatory. For any question about the protection of your data, you can nevertheless contact the managing partners directly at contact@atelier-novalp.com.
2 · Data collected and purposes
We only collect the data strictly necessary for the purposes explicitly communicated to you. Details of the processing are presented in the following table.
| Purpose | Data collected | Legal basis | Retention |
|---|---|---|---|
| Responding to your contact or quote request | Surname, first name, email address, telephone, project address, description of your needs | Pre-contractual measures (art. 6.1.b GDPR) | 3 years from the last contact if no contract is concluded |
| Performance of a project management or general contracting contract | Identity, full contact details, project information, financial data (IBAN, quotes, invoices), administrative documents | Performance of a contract (art. 6.1.b GDPR) and legal obligations (art. 6.1.c GDPR) | 10 years after the end of the commission (10-year structural guarantee / accounting obligations), then archiving in line with legal obligations |
| Management of business relationships and prospecting | Name, email, telephone, history of exchanges | Legitimate interest (art. 6.1.f GDPR) or consent for electronic prospecting (art. L. 34-5 CPCE) | 3 years after the last active contact |
| Website audience measurement (anonymised) | Truncated IP address, pages visited, country, browser, operating system, visit source | Legitimate interest (art. 6.1.f GDPR) — anonymised data, CNIL exemption (deliberation 2020-091) | 13 months maximum |
| Placing non-essential cookies | Advanced audience measurement, personalisation or advertising cookies | Consent (art. 6.1.a GDPR and art. 82 LIL) | 6 to 13 months depending on the purpose |
| Compliance with legal and accounting obligations | Billing data, supporting documents, accounting records | Legal obligation (art. 6.1.c GDPR) | 10 years (French Commercial Code) |
Mandatory or optional nature of the data
In the contact form, fields marked with an asterisk are mandatory. If they are missing, you cannot submit the request. Unmarked fields are optional and can help us better understand your needs.
3 · Data recipients
Your data is processed exclusively by authorised persons within Atelier NovAlp (managing partners and staff in charge of projects). It may also be passed on, strictly to the extent necessary, to the following processors and service providers:
- Cloudflare, Inc. — website hosting and content delivery (CDN). Data Processing Agreement (DPA) concluded with Atelier NovAlp.
- Business email provider — for receiving and handling requests via contact@atelier-novalp.com.
- Chartered accountant and statutory auditor where applicable, in connection with our accounting and tax obligations.
- Insurers and brokerage firms (Calipso Assurances, Leader Underwriting, MIC Insurance Company) in connection with managing the professional liability and 10-year structural liability (décennale) policies.
- Government bodies and public authorities where required by law (tax authorities, URSSAF, courts, etc.).
We do not sell, rent or transfer your data to third parties for commercial purposes.
4 · Data transfers outside the European Union
The website atelier-novalp.com is hosted by Cloudflare, Inc., a US company. Some technical data (IP addresses, request logs) may pass through servers located outside the European Union.
These transfers are governed by the European Commission's standard contractual clauses (decision 2021/914/EU) incorporated into Cloudflare's Data Processing Addendum, and by Cloudflare's participation in the EU-US Data Privacy Framework (certification visible on dataprivacyframework.gov). Additional technical measures (TLS 1.3 encryption, pseudonymisation of IP addresses) are applied to ensure an adequate level of protection.
5 · Data security
Atelier NovAlp implements appropriate technical and organisational measures to protect your data against any unauthorised access, alteration, disclosure or destruction. These measures include in particular:
- Systematic encryption of communications between your browser and the website (SSL/TLS 1.3 certificate provided by Cloudflare)
- Web application firewall (WAF) and anti-DDoS protection via Cloudflare
- Strong authentication for administrative access
- Storage of sensitive documents on secure media with encrypted backups
- Ongoing training of the managing partners in data protection best practice
- Regular audits of security measures
6 · Your GDPR rights
In accordance with articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- Right of access — obtain confirmation that your data is being processed and receive a copy of it.
- Right to rectification — have any inaccurate or incomplete data corrected.
- Right to erasure (“right to be forgotten”) — have your data deleted when the legal conditions are met.
- Right to restriction of processing — request that processing be temporarily suspended in certain cases.
- Right to data portability — receive your data in a structured, commonly used format.
- Right to object — object to processing on legitimate grounds, and unconditionally for commercial prospecting.
- Right to withdraw consent — withdraw your consent at any time where processing is based on it.
- Right to set instructions for after your death concerning the retention, erasure and communication of your data after your death (art. 85 of the Informatique et Libertés law).
- Right not to be subject to an automated decision producing legal effects concerning you.
To exercise these rights, write to us at contact@atelier-novalp.com or by post to the registered office address (198 Avenue du Grand Port, 73100 Aix-les-Bains). We may ask you for proof of identity in case of reasonable doubt. We will respond to your request within a maximum of one month, which may be extended by a further two months if the complexity or number of requests justifies it.
7 · Right to lodge a complaint with the CNIL
If, after contacting us, you believe that your rights regarding personal data are not being respected, you can lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):
- 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
- Telephone: 01 53 73 22 22
- www.cnil.fr/fr/plaintes
8 · Changes to this policy
This privacy policy may be amended at any time to reflect legal, case-law or technical developments. The date of the last update is shown at the top of this page. We invite you to consult it regularly. In the event of a substantial change, we will inform you by any appropriate means.