Privacy · Data transparency
Privacy without audience tracking.
This policy explains the personal information that may be processed when visiting Alain Stevens’ websites, making contact or engaging in professional relations. It distinguishes the absence of audience analytics from the ordinary technical operation of a website.
This website does not seek to compile statistics about its visitors.
Correspondence data, contractual information and any technical logs are processed for other purposes, described below. Individuals wishing to order services are directed to pacta.com.
The data controller
This document applies to websites operated by Alain STEVENS and, unless otherwise stated, to his presentation and contact pages intended for professional users.
The controller of the processing operations he determines is Alain STEVENS, sole proprietor, SIREN 398 162 206. Contact: contact@pacta.com — +33 (0)6 12 55 19 80.
Registered office: 67 rue Saint-Jacques, 75005 Paris, France. Mailing address: 28 bis rue Antoine Goussiez, 51100 Reims, France [street number to be confirmed]. The Paris address is reserved for administrative authorities.
This policy covers the processing carried out by the publisher to administer the website, respond to enquiries and manage professional customers. Processing specific to an application or a professional client may be subject to a separate notice or agreement.
No website traffic analytics
The website does not use an audience measurement tool. The publisher does not deploy website statistics solutions to count visitors, analyse browsing journeys or measure traffic.
The publisher does not intentionally place audience measurement cookies for this purpose. Visits to the pages are not associated by the publisher with statistical or behavioural visitor profiles.
The absence of audience analytics does not exclude the technical data generated to deliver pages, secure the hosting environment, diagnose incidents or operate a feature expressly requested by the user.
Email correspondence and enquiries
When someone writes to contact@pacta.com or contacts the publisher by telephone, the information processed may include contact details, professional identity, company, subject of the enquiry, messages and any attachments voluntarily sent.
These details are used to review the enquiry, reply to it, prepare a quotation if needed and follow up the correspondence. Depending on the circumstances, the legal basis is the pre-contractual steps requested by the data subject or the publisher’s legitimate interest in responding to professional contacts.
Ancillary websites are not intended for individuals ordering services for personal use. Such individuals are invited to visit pacta.com. This referral does not prevent the limited processing of a message received to answer or redirect it.
The contact pages of the websites concerned may display contact details without a form; in that case, no contact fields are collected directly on the page.
Quotations, invoicing and business relationships
When a business relationship exists, identification and contact details of client representatives, order references, quotations, invoicing information, payments, correspondence and documents necessary for service provision may be retained.
The purposes are preparing and fulfilling orders, customer relations, accounting operations, payment management, administrative follow-up and, where necessary, the defence of the publisher’s rights.
Depending on the processing, the legal basis is performance of a contract or pre-contractual steps, a legal obligation (particularly accounting and taxation), or the legitimate interest in managing a professional relationship. Complete bank card details must not be sent unsolicited by email.
Purposes and legal bases
Legal bases are not interchangeable: the applicable basis depends on the data processed and the objective pursued.
| Processing activity | Purpose | Main legal basis |
|---|---|---|
| Message or quotation request | Response and professional follow-up | Legitimate interest or pre-contractual steps |
| Order and service provision | Administration and performance of the service | Contract, or legitimate interest for representatives’ contact details |
| Invoice and accounting records | Accounting and tax obligations | Legal obligation |
| Infrastructure logs | Operation and security | Legitimate interest, or obligations of the relevant provider |
| Optional feature requiring consent | Purpose specified when the choice is offered | Consent, if this feature is offered |
Cookies and local storage
No audience analytics tool is used on this website. Therefore, no cookie consent banner is needed for that absent analytics purpose alone.
However, where such features exist, technical functions may use a session cookie, authentication mechanism or local storage necessary to provide a service requested by the user (for example, remembering a language choice or maintaining a login). Strictly necessary trackers may be exempt from consent, but their use must be described transparently.
The publisher must verify the components actually integrated into each website: embedded videos, externally hosted fonts, third-party forms, widgets, help services or payment systems may introduce their own trackers. If non-essential trackers are added, users must be informed and, where required by law, give consent before they are used.
Accounts, portals and digital services
Simply reading the presentation pages does not require opening an account. If a website allows registration, provides an identifier, offers an application, creates a professional area or accepts requests for automated processing, additional data may be required for that function.
Such data may include identifiers, login information, preferences, access rights, a history of technical actions or data entered by the user. These processing operations must be described in supplementary service-specific information stating their purposes, recipients, retention periods and security arrangements.
Nothing in this policy should be interpreted as authorising unlimited collection or systematic retention of all searches performed through an OSINT tool.
OSINT tools and users’ responsibilities
Software, scripts and services offered to professionals may allow them to handle data, links, files or information from open sources. Providing a tool does not mean that the publisher personally conducts a named-person investigation on behalf of its user.
Professional clients determine the purposes and legal basis of their own investigations and verify that they may lawfully use the data concerned. This allocation of roles does not release the publisher from obligations relating to the processing operations he actually performs.
When the publisher processes personal data on behalf of a client as a processor, an agreement compliant with Article 28 GDPR must govern the service concerned. Where each party acts as a separate or joint controller, their respective roles must be assessed in light of their actual practices.
Artificial intelligence and technical providers
Some services may include artificial intelligence systems, APIs, hosting, messaging tools or technical services provided by separate companies. These solutions are not automatically used simply because someone visits this website.
If a feature transfers personal data to a third-party provider, the corresponding information must be given before use and specify the categories of data, the provider’s role, any international transfers, the retention period and the applicable safeguards.
Users must not submit another person’s data to an interface or AI assistant without first checking that such disclosure is lawful and necessary for their work.
Recipients and data processors
Data required for the operations described may be accessible to Alain Stevens and, insofar as necessary for their work, to technical providers handling hosting, email, backups, accounting, invoicing or maintenance.
Website hosting may in particular be provided by Infomaniak, subject to confirmation for the website concerned. The providers actually used must be identified where necessary in the legal notice, a technical appendix or service-specific information.
Disclosure to a public authority may take place where required by an applicable legal obligation. This policy does not provide for the sale of visitors’ or customers’ contact databases to data brokers.
Location and transfers outside the European Economic Area
Visiting a website, sending an email or using an application may involve infrastructure located in different countries. Whether a transfer outside the European Economic Area takes place depends on the actual providers and their configurations.
Where personal data is transferred outside the European Economic Area, the transfer must rely on a mechanism permitted by the GDPR, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where necessary.
Before publication, the publisher must confirm whether the website’s email, hosting, payment or AI services involve such transfers and complete this information where necessary.
Retention periods
Data is kept only for as long as necessary for the stated purposes, subject to legal obligations and the proportionate retention of documents required to defend rights.
| Data | Retention principle |
|---|---|
| Message with no subsequent commercial relationship | For as long as needed to reply and follow up; for prospective customers, the reference maximum is three years after their last contact where such data is kept for marketing purposes |
| Customer relationship / order | For the duration of the relationship, then limited archiving where justified by obligations or legitimate needs |
| Invoices and supporting accounting records | Generally ten years from the close of the relevant financial year |
| Security and access logs | In accordance with applicable law — the exact period must be confirmed with the hosting provider and the actual configuration |
| Application data, accounts and histories | To be defined in the information specific to each service |
Backups, archives and items needed for legal proceedings may be subject to separate rules, solely within the limits permitted and justified.
Your personal data rights
Under the conditions set out in the GDPR, individuals have rights of access, rectification, erasure, restriction and objection and, where the relevant conditions are met, data portability. Consent, where given, may be withdrawn at any time without affecting the lawfulness of earlier processing.
To exercise these rights or ask a question, write to contact@pacta.com, explaining your request. Proof of identity will be requested only where reasonable doubt makes this necessary.
The publisher generally responds within one month, which may be extended by two months if the complexity or number of requests requires it, with notice given during the first month. Anyone who believes their rights are not being respected may lodge a complaint with the CNIL (French data protection authority).
Confidentiality and security measures
The publisher endeavours to apply technical and organisational measures proportionate to the processing carried out: restricted access, account protection, updates, access-permission controls and backups where necessary.
No transmission over the Internet can be guaranteed to be free from all risks. Correspondents are asked not to send passwords, API keys, identity documents or sensitive named-person case files through ordinary email unless specifically requested via an appropriate secure channel.
In the event of a security incident involving personal data, applicable obligations to document the incident, notify the supervisory authority and, where the conditions are met, inform affected individuals will be assessed in accordance with the GDPR.
Links to external services
Links may direct users to pacta.com, suppliers, documentary resources or independent professionals. Following such a link takes the user away from the website concerned, whereupon the practices of the destination website apply.
These links must be distinguished from external components that load automatically within a page. Where a video, widget, map or other third-party element is embedded in a website, its behaviour must be checked to ensure appropriate information is provided and consent obtained where required.
Changes to this policy
This policy may be updated to reflect changes in regulation, organisation or website features. Material changes to personal data processing will be communicated appropriately.
Date on which this template was drafted: 17 October 2026. The website name, URL and technical configuration must be checked for every publication. For questions, the contact address remains contact@pacta.com.