Privacy policy

Data controller

Sycomia SARL, 1 rue de Laglorieuse, 68128 Rosenau, France, RCS Mulhouse 991 594 649.

Data Protection Officer (DPO): dpo@sycomia.com.

The data we process

Contact form

When you write to us through the form, we receive the information you enter:

• first and last name;
• email address;
• organization and phone number, if you provide them;
• subject and content of your message.

This information is sent to us by email, in our Microsoft 365 mailbox. It is not stored in a database on the website.

Booking a call

If you book a call, you are redirected to our Microsoft Bookings page, where you enter your name, your email address and, if you wish, your organization and the topic of the call. This information is used only to organize the call (invitation and Teams video link) and is processed by Microsoft 365, as described below.

Anti-bot protection

The form is protected by ALTCHA: your browser solves a small computation to prove it is not a bot. This system uses no cookies, no third-party service and no personal data. An anonymous technical fingerprint of this computation is kept for 15 minutes on our server to prevent its reuse.

Technical logs

Like any web server, our hosting provider's server records technical logs (IP address, date and time, requested page, browser type). They are used only for the security and proper operation of the website and are kept for a limited period.

Audience measurement (Google Analytics)

If you accept it in the banner shown on your first visit, we use Google Analytics to see which pages are visited. Google Analytics sets cookies and collects browsing data: pages viewed, visit duration, referring site, device and browser type, approximate country and city. Google Analytics does not store your IP address. Without your consent, nothing is loaded. Details are given in our cookie policy.

What we do not do

We use no advertising and no tracking pixels, do not sell any data and do not carry out profiling.

Purposes and legal bases

• Answering your request (quote, appointment, information): pre-contractual measures taken at your request and Sycomia's legitimate interest in answering people who contact it.
• Securing the website (anti-bot protection, technical logs): Sycomia's legitimate interest in protecting its website.
• Measuring website traffic (Google Analytics): your consent, which you can withdraw at any time with the “Manage cookies” link at the bottom of each page.

Recipients

Your data is intended only for the Sycomia team. It passes through the servers of our hosting provider, OVH SAS, and is then received in our Microsoft 365 mailbox (Microsoft Ireland Operations Ltd), where it is stored in France and processed within the European Union, except for limited transfers documented by Microsoft and covered by the safeguards required by the GDPR. Both providers act as processors. Your data is never sold, rented or transferred to third parties.

If you accept audience measurement, browsing data is processed by Google Ireland Limited, as a processor, and may be transferred to Google LLC in the United States. This transfer is covered by the EU-US Data Privacy Framework, under which Google is certified.

Retention periods

• Exchanges related to a contact request: 3 years after our last exchange, unless a contractual relationship follows.
• Anti-bot fingerprints: 15 minutes.
• Audience measurement: cookies 13 months at most, statistics 14 months.
• Technical logs: according to the period applied by the hosting provider, limited to what is necessary for security.

Data entrusted for a project

The data you entrust to us for an analysis (omics, clinical data, etc.) does not pass through this website. Its processing is governed by the quote, our general terms and conditions of sale and, if needed, a non-disclosure agreement (NDA): Sycomia then acts as a processor within the meaning of the GDPR. Data is processed on our own servers, clinical data is hosted in France by a certified health data host (HDS), and all data is deleted within 30 days of the end of the project, or earlier on request. Only the pseudonymized analysis report is kept for 5 years with restricted access, as proof of the work performed.

Security

The website is served exclusively over HTTPS. Access to data is limited to the people who need it, and we apply appropriate technical and organizational measures to prevent any unauthorized loss, disclosure or modification.

Your rights

You have the right to access, rectify and erase your data, to restrict and object to its processing, and to data portability. To exercise these rights, write to us at contact@sycomia.com: we will answer within one month.

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country.

Changes

We may update this policy, in particular if the website changes. The date of the last update is shown at the top of this page.