Privacy policy

Who is responsible for your data

Flot is a brand of SharpSkill SAS, a société par actions simplifiée (simplified joint-stock company) with share capital of 500 €, registered under RCS Nanterre 992 632 497, with its head office at 1 allée du Puits, 92130 Issy-les-Moulineaux, France. SharpSkill SAS is the controller of the processing described on this page, within the meaning of the General Data Protection Regulation (GDPR).

This policy covers visitors to this site and people who send us a request through it.

For any question about your data, write to us at [email protected], through the Contact page or by post to SharpSkill SAS, 1 allée du Puits, 92130 Issy-les-Moulineaux, France.

Contact page

The data we collect

Depending on the form you fill in, we collect what you enter, and the form automatically adds a few details about your visit. Required fields are marked with an asterisk: without them, we cannot handle your request.

• Your name.
• Your email address, your phone number, or both.
• Your company name.
• Your website address, or the link to your app on the App Store or Google Play.
• Your message, the task or project you describe and how often it happens, or when you would prefer us to call you back.
• The cost calculation for a task runs in your browser: we only receive its result if you add it to a form and send it.
• Added automatically: the date it was sent and the page of the site you sent the form from.
• Added automatically: where your visit came from, meaning the site you came from if it is another site, and the campaign parameters of the link you followed (for example, the name of an ad or an email campaign).
• When you send a request, the IP address of your connection (the technical address of your internet access), to limit repeated submissions: see “Protection against abusive submissions”.

Why we use your data

Your data is used only for the purposes below. We do not sell it, rent it or pass it to anyone for advertising.

• Replying to you: calling you back, answering your message, looking at your website or your app’s reviews, preparing a proposal. These are steps you ask us to take before a possible contract (Article 6(1)(b) GDPR); if you write to us on behalf of your company, they rest on our legitimate interest in replying to it (Article 6(1)(f) GDPR).
• Following up: getting back to you about your request and keeping a record of what we discussed. This rests on our legitimate interest in growing our business, within what you can reasonably expect after contacting us.
• Knowing how you found us, from the page, the referring site and the campaign parameters, to measure what works in our marketing: legitimate interest.
• Protecting the site and its forms against abusive submissions and attacks: legitimate interest in keeping the site secure.
• Measuring site traffic, without cookies: legitimate interest in improving the site.

Who can access your data

At the agency, only the two co-founders, Benjamin Le Perf and Anthony Fillion-Maillet, can access your requests. To run the site, we use technical providers that process your data on our behalf, on our instructions and under a contract (processors, within the meaning of the GDPR):

• OVH SAS (France) hosts our server and its database.
• Cloudflare, Inc. (United States) routes and protects traffic between your browser and our server: it processes your IP address and carries the content of your exchanges with the site. It also provides our audience measurement.
• Resend (Plus Five Five, Inc., United States), our email delivery service, sends us each complete request.
• Our email provider stores the emails through which your requests reach us.

Where your data is stored

Your requests are saved in a database on our server, hosted in France by OVH SAS. We back it up every night, on the same server. Traffic between your browser and the site is encrypted.

Each request is also sent to us by email: it is therefore kept in our mailbox, under the same rules, and in Resend’s sending log.

Transfers outside the European Union

Cloudflare and Resend are American companies, so your data may be processed in the United States.

These transfers are safeguarded in two ways. First, these companies participate in the EU-U.S. Data Privacy Framework, which the European Commission recognised on 10 July 2023 as providing an adequate level of protection. Second, their contracts include the European Commission’s standard contractual clauses: a model contract that commits them to protect your data as European law requires. You can ask us for a copy of these clauses.

Official list of certified companiesThe 10 July 2023 decision, explained by the CNIL (in French)Cloudflare data processing agreementResend data processing agreement

Protection against abusive submissions

To limit repeated submissions from the same connection, our server keeps in memory the IP address each request comes from, with the time it was sent. For an IPv6 address, it keeps only the first part. This information is never written to disk or copied into our backups, and it is deleted after 24 hours.

How long we keep your data

If you do not become a client, your requests and the exchanges that follow are kept for no more than three years after your last contact with us, then deleted. This is the maximum period recommended by the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority) for prospect data, meaning data about people who are not clients.

If you become a client, the data needed for our contract is kept for its whole duration, then archived for as long as the law requires, for example ten years for accounting records.

The IP address kept to limit repeated submissions is deleted after 24 hours. Resend deletes each email from its sending log after 30 days.

Each backup is deleted after 30 days, so data deleted from our database also disappears from our backups within that time.

Audience measurement

To see which pages are viewed, we use Cloudflare Web Analytics. This service sets no cookies, stores nothing in your browser and does not follow you from site to site: it only gives us overall statistics, such as page views, countries of connection or device types.

Cookies

This site sets no cookies that require your consent: no advertising cookies, no audience measurement cookies and no trackers that follow you from site to site. That is why no banner asks you for it.

When a connection needs to be checked, Cloudflare may set security cookies: they are used only to run that check and to remember that it succeeded, so you can keep browsing the site without repeating it. As they are essential to access the site in that case, they do not require your consent.

Your rights

You have the following rights over your data:

• Access: find out what data we hold about you and get a copy.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted, except data the law requires us to keep.
• Objection: object, on grounds relating to your situation, to our use of your data based on our legitimate interest. If you no longer want us to contact you, just tell us, with no need to give a reason.
• Restriction: have the use of your data suspended, for example while we check data you dispute.
• Portability: when we use your data with a view to a contract with you, receive the data you gave us in a structured, commonly used format, or have it sent to another organisation.
• Instructions after death: tell us what should happen to your data after your death (Article 85 of the loi Informatique et Libertés, the French Data Protection Act).

Exercising your rights

Write to us at [email protected], through the Contact page or by post to SharpSkill SAS, 1 allée du Puits, 92130 Issy-les-Moulineaux, France. We reply within one month of receiving your request. If your request is complex, this period may be extended by two months: we will tell you so within the first month, with the reason.

We only ask for proof of identity if we have reasonable doubt about who sent the request, and we delete it as soon as we have replied.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL.

Contact pageLodge a complaint with the CNIL (in French)

Updates to this privacy policy

We update this page when the way we handle your data changes, for example if we take on a new provider. The date of the last update is shown at the top of the page.