Privacy and Cookies Policy

Last updated: October 6, 2025

1. Introduction

Welcome to the AFC REPRESENTATION FISCALE website (hereinafter referred to as "the Site"), accessible at https://representant-fiscal.com. This document combines our Privacy Policy and Cookies Policy, in compliance with the General Data Protection Regulation (GDPR) and the French Data Protection Act of January 6, 1978.

Data Controller:
AFC REPRESENTATION FISCALE
5 bis avenue du Cep, 78300 POISSY, France
Email: contact@representant-fiscal.com
Website: https://representant-fiscal.com
Data Protection Officer: dpo@representant-fiscal.com

This document was revised and brought into compliance by Nebul'IA in October 2025 to ensure optimal protection of your data and a secure user experience.

2. Personal Data Collected

We collect data based on your use of the Site:

Data Type	Source	Purpose
Country, city, browser, OS	Google Analytics, Google Search Console	Anonymous audience statistics
Name, email, phone, message	Contact form	Response to your requests, audit management
Cookie preferences	Consent module (Complianz)	Personalization of your experience

Legal Basis:

Consent (cookies, contact form)
Performance of a contract (audits, quotes)

3. Cookies and Similar Technologies

3.1. Definitions

Cookies: Files stored on your device to facilitate navigation.
Scripts: Code executed for interactivity (e.g., preference management).
Invisible tags: Traffic tracking tools (e.g., Google Tag Manager).

3.2. Types of Cookies Used

Category	Examples	Consent Required?	Purpose
Functional	WordPress, Complianz, WPML	No	Maintaining session, saving preferences, language selection
Statistics	Google Analytics, Burst Statistics	Yes	Site improvement (traffic, pages visited)
Marketing	Google Fonts, Google Tag Manager	Yes	Targeted advertising (without intrusive profiling)

Note: Google Ads cookies are currently under audit to clarify their purpose. Until then, they are disabled by default.

3.3. Consent Management

On your first visit, a banner allows you to accept or refuse cookies (except functional cookies, which are mandatory).

Withdraw consent: Via the banner or your browser settings.
Retention period:
- Functional cookies: 13 months (CNIL recommendation).
- Consent: 11 months (renewal required).

3.4. Specific Cookie Uses

WPML: WPML uses cookies to identify the current language of the visitor, the last visited language, and the language of logged-in users. While using the plugin, WPML shares data about the site via Installer. No personal user data is shared.
Complianz Privacy Suite for WordPress: This website uses the Privacy Suite for WordPress by Complianz to collect consent records. For this functionality, your IP address is anonymized and stored in our database. For more information, please see the Complianz Privacy Statement.
Burst Statistics: This website uses Burst Statistics, a privacy-friendly statistics tool, to analyze visitor behavior. For this feature, we collect anonymous data, stored locally without sharing it with third parties. For more information, please read the Burst Privacy Statement.

4. Purposes of Processing

Purpose	Legal Basis
Response to requests (form)	Performance of a contract
Statistics (Google Analytics)	Consent
Advertising (Google Ads)	Consent (pending audit)

5. Your Rights

You can exercise the following rights:

Access to your data.
Rectification or deletion of your data.
Objection to processing (e.g., marketing).
Portability (retrieval of your data).
Lodge a complaint with the CNIL: www.cnil.fr

Contact: dpo@representant-fiscal.com

6. Security and Subprocessors

Hosting: Our site and its data are hosted by OVHcloud, a European provider based in France.
- Data Location: Servers are located in French (Gravelines, Strasbourg, Roubaix) and European data centers, ensuring compliance with the General Data Protection Regulation (GDPR).
  - Main Data Center: Gravelines (France).
  - Certifications: ISO 27001, ISO 27017, ISO 27018, HDS (Health Data Hosting for sensitive data).
  - GDPR Compliance: OVHcloud is certified by the CNIL and complies with the European Commission's standard contractual clauses for data transfers.
- Physical and Logical Security:
  - Physical Protection: 24/7 secured access, biometrics, video surveillance, and authorized personnel.
  - Network Protection: Firewall, intrusion detection (IDS/IPS), data encryption in transit (TLS 1.2+) and at rest (AES-256).
  - Redundancy: Automatic daily backups, with geographically distributed replication to ensure availability.
  - OVHcloud Privacy Policy: View here.
- Nebul'IA Commitments:
  - We have signed a Data Processing Agreement (DPA) with OVHcloud, in accordance with Article 28 of the GDPR, to strictly govern the use of our data.
  - Data collected via the Site (forms, audits, logs) does not leave the European Union.
  - In the event of additional subprocessing by OVHcloud, it is subject to our prior authorization and equivalent guarantees.
- Log Retention Period: Technical logs (IP addresses, timestamps) are kept for 13 months (in accordance with CNIL recommendations), then automatically deleted.
- Contact in Case of Incident: OVHcloud alerts us within 24 hours in the event of a data breach. We commit to notifying you within 72 hours if your personal data is affected (Art. 33 GDPR).
Subprocessors:
- Google (Analytics, Fonts, Tag Manager) – Google Privacy Policy
- Complianz – Complianz Policy
Security Measures: Encryption, restricted access, regular audits.