Privacy policy
What personal data SiteBienfait handles, on which legal basis, for how long, and how to exercise rights over it.
Last reviewed: 11 November 2026
Data controller
The controller is SiteBienfait, the publisher identified in the legal notice. Questions and requests go to ismael@sitebienfait.fr.
SiteBienfait is established in France. Where the data of a customer’s own website is processed on that customer’s behalf, the customer is the controller and SiteBienfait is the processor; the data processing summary explains that role.
Data that is collected
- Free audit submissions: the website URL, interface language, stated goal, IP address and timestamp.
- Project estimate requests: the contact details and project information entered in the form, such as name, email address, phone number, business and message.
- Account and site data for paying customers: account identity, site addresses, content, change history, approvals and deployment logs.
- Correspondence: the content of emails and messages exchanged about a request or a project.
- Technical data: request logs kept by the hosting provider, including IP address, user agent and timestamp.
Why data is used
- To produce the requested audit and reopen it later.
- To prepare, send and follow up a project estimate.
- To operate the service, the website and the approval-gated change loop.
- To answer support questions and protect the service against abuse.
- To meet accounting, tax and other legal obligations.
Legal bases
The legal bases are the steps taken before a contract at the person’s request and the performance of that contract; the legitimate interest in operating, securing and improving the service; consent where a specific optional use asks for it; and legal obligations for invoices and business records.
Recipients
Personal data is not sold. It reaches the people who need it to deliver the service, and the providers listed on the subprocessors page, starting with the hosting provider.
A provider is added to that page only when it is actually used.
Transfers outside the European Economic Area
The hosting and CDN provider processes data on a global edge network and in the United States. Transfers outside the European Economic Area rely on the standard contractual clauses identified on the subprocessors page.
How long data is kept
Data is kept for the periods in the table below, then deleted or anonymised. A legal obligation can require a longer period, for example for invoices.
| Data | Retention | Why it is kept |
|---|---|---|
| Free audit submissions (URL, locale, goal, IP, timestamp) | 12 months | So a report can be reopened and a support question answered. |
| Project estimate requests | 24 months | To follow up a project and keep a commercial record. |
| Account and site data for paying customers | For the life of the contract, then deleted on request | To operate the site and its change history. |
Rights over personal data
Under the GDPR a person can ask for access, rectification, erasure, restriction, objection and portability, and can withdraw consent. A request is sent to ismael@sitebienfait.fr.
A request is answered within one month, extended where it is complex. If the answer is not satisfactory, a complaint can be lodged with the CNIL, the French data protection authority, at cnil.fr.
These rights are not absolute: a legal obligation or an ongoing contract can limit them.
Security
Access is limited to the people who need it, traffic is encrypted in transit, and provider safeguards are selected with the data in mind.
No system is perfectly secure. A personal data breach is handled and notified as the GDPR requires; the data processing summary explains the notification path for customer data.
Children
The service is aimed at businesses and is not directed at children. Data about a child is not knowingly collected; a report to the contact address gets it removed.
Changes to this policy
This policy is updated when data practices change. The review date at the top of the page shows the last update.