Privacy policy

1. What data we collect

Data you provide

• Contact form — name, email address, subject of your enquiry, message content.
• Direct email — sender address and any information you choose to include in your message.
• Pre-contractual and contractual stage — organisation details, point of contact, and the information needed to prepare a quote and issue invoices.

Data collected automatically

• Technical logs — IP address, browser type, page requested, date and time. Collected by our hosting and website protection providers to keep the site running and secure.
• Audience measurement — browsing statistics, collected only if you consent through the cookie banner (see section 8).

We do not collect special categories of data (Article 9 GDPR) and we ask you not to enter any in the contact form. If you need to send us sensitive information as part of an audit, this is done through a dedicated channel set out in the contract.

2. Why we process your data and on what legal basis

We do not use your data for automated marketing or profiling. No automated decision-making within the meaning of Article 22 of the GDPR takes place.

3. Who has access to your data

Your data is never sold, rented or traded to third parties for commercial purposes. It is processed by Marina Bruno, the only person in the organisation with access to it.

To run the website and the mailbox we rely on a number of technical providers, acting as processors under Article 28 of the GDPR, on the basis of contracts binding them to our instructions:

Transfers outside the European Union. Some of these providers are based in the United States. Transfers rely on the standard contractual clauses adopted by the European Commission (Art. 46 GDPR) and, where applicable, on the providers' certification under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023). You may ask us for a copy of the safeguards applied.

Data may also be shared with our accountant and, on a reasoned request, with the competent authorities where the law requires it.

4. How long we keep your data

At the end of these periods, data is securely deleted or irreversibly anonymised.

5. How we protect your data

Security is our profession and we apply to ourselves the measures we recommend to clients, in line with Article 32 of the GDPR:

• Website accessible over HTTPS only (encryption in transit).
• Full-disk encryption on the workstation used for engagements.
• Multi-factor authentication on business accounts and a dedicated password manager.
• Isolated, dedicated working environments for each audit engagement, destroyed afterwards.
• Data minimisation: we collect only what the stated purpose requires.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and inform you directly where the risk is high (Articles 33 and 34 GDPR).

6. Your rights

Under Articles 15 to 22 of the GDPR you have the right to:

• Access — find out what data we hold about you and obtain a copy.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data, within the limits of our legal retention obligations.
• Restriction — request that processing be temporarily suspended.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interest.
• Withdrawal of consent — at any time, for processing based on consent, without affecting the lawfulness of earlier processing.

To exercise these rights, write to marinabruno@enyasecurity.com. We reply within one month of receiving the request. We may ask for an element confirming your identity where there is reasonable doubt about who is making the request.

Complaints. If you believe the processing of your data does not comply with the regulation, you may lodge a complaint with the French supervisory authority, competent because Enya Security is established in France (CNIL), or with the supervisory authority of the country where you habitually reside.

7. Data processed during an audit engagement

When we carry out an audit, the data we access belongs to the client, who remains the controller: in that context Enya Security acts as a processor, on the basis of a dedicated agreement (DPA) and rules of engagement signed before any work begins.

Our services are non-intrusive, declarative and diagnostic in nature: we carry out no penetration testing and no active exploitation of vulnerabilities. Technical data collected is deleted within 30 days of report delivery and the client receives a certificate of deletion.

8. Cookies and measurement tools

No non-essential cookie is placed before you give your consent. The banner is managed by Tarteaucitron and you can change your choices at any time.

Manage your cookie preferences — you can accept or refuse, either as a whole or tool by tool, and change your mind whenever you like. Refusing does not restrict access to any of the website's content.

You can also configure your browser to block cookies. Some statistical functions will then be unavailable, but the website will continue to work normally.

9. Minors, external links and changes

Minors. This website is aimed at professionals and organisations. It is not intended for minors and we do not knowingly collect data from people under 16. If you believe this has happened, write to us and we will delete the data.

External links. This website may link to third-party sites. Enya Security does not control those sites and is not responsible for their personal data practices.

Changes. This policy may be updated to reflect changes in our services or in the applicable regulation. The version in force is always the one published on this page, with the last update date shown at the top. Where changes are substantial, we will inform the people concerned whenever we hold their contact details.