Privacy Policy

01 Who we are

For the purposes of data protection law, the data controller is BvH&Co, a French simplified joint stock company with sole shareholder (société par actions simplifiée unipersonnelle), with its registered office as set out below.

We have not appointed a Data Protection Officer because our processing does not meet the thresholds in Article 37 GDPR. Questions about this policy or about the personal data we hold on you should be sent to hello@bvh-co.com with the subject line "Data request".

02 What we collect

Information you give us

When you fill in the contact form on our website, we ask for your first name, last name, professional email address, company and role, the service area you are interested in, and the content of your message. All fields are required so we can respond properly, and we block submissions from consumer email providers so we can keep the exchange in a professional channel.

Information collected automatically

When you visit the site, our hosting and analytics providers automatically record a limited set of technical information. This includes your IP address, which we anonymise, your device type and browser, the pages you view, the time you spend on each page, and the referring source. We do not combine this information with data that directly identifies you.

Information we do not collect

We do not ask for special category data such as health, political views, religion, or biometric information. We do not run advertising cookies or behavioural retargeting. We do not sell or rent your data to anyone.

03 Why we use your data and on what legal basis

• To respond to your enquiry and assess a possible engagement. Legal basis. Pre-contractual measures taken at your request under Article 6(1)(b) GDPR.
• To maintain a record of business correspondence. Legal basis. Our legitimate interest in running our advisory practice under Article 6(1)(f) GDPR.
• To measure how the website is used and improve it. Legal basis. Your consent under Article 6(1)(a) GDPR, given through the cookie banner.
• To comply with our legal and accounting obligations. Legal basis. Legal obligation under Article 6(1)(c) GDPR.

04 Cookies and similar technologies

A cookie is a small text file placed on your device when you visit a website. Some cookies are strictly necessary for the site to function. Others measure how the site is used, and these are only set after you give consent.

Strictly necessary

These are always active and do not require consent. They make the site work, including remembering your cookie preference so we do not ask you again on every page.

Analytics (Google Analytics 4)

We use Google Analytics 4 with IP anonymisation to understand how visitors find and use the site. Analytics cookies are only set after you click "Accept" in the cookie banner. If you click "Reject" or ignore the banner, no analytics cookies are set and Google Consent Mode signals a denied state to Google.

Changing your choice

You can change your cookie preference at any time by clicking the "Cookie preferences" link in the footer, or by clearing your browser data for this site. You can also disable cookies in your browser settings.

05 How long we keep your data

• Contact form submissions. Three years from the date of last contact, after which the record is archived or deleted. Records linked to a signed engagement are kept for the duration of the engagement plus ten years to meet French commercial and accounting retention rules.
• Email correspondence. Three years from the date of last contact unless tied to a live engagement.
• Analytics data. Fourteen months in Google Analytics 4, which is the shortest retention period Google offers.
• Server and security logs. Up to twelve months.

06 Who we share your data with

We only share personal data with a small number of vetted service providers who help us operate the website and run the firm. They act as processors on our instructions and are bound by written data protection terms.

• Netlify, Inc. Hosts the website and receives contact form submissions on our behalf. Based in the United States.
• Google Ireland Limited and Google LLC. Provide Google Analytics 4 and Google Fonts. Based in Ireland and the United States.
• Google LLC (Gmail). Delivers the notification emails we receive when you submit the contact form.
• Our accountant and professional advisers. Only where strictly necessary to meet legal and accounting obligations.

We may also disclose your data where required by law, by a court order, or to protect our legal rights. We do not sell personal data.

07 International transfers

Some of our providers are based outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, combined with supplementary measures where appropriate, so that your data continues to benefit from a level of protection equivalent to that guaranteed by EU law.

08 Your rights

Under GDPR you have the following rights in respect of your personal data.

• Right of access. Ask for a copy of the personal data we hold on you.
• Right to rectification. Ask us to correct inaccurate or incomplete data.
• Right to erasure. Ask us to delete your data where one of the grounds in Article 17 GDPR applies.
• Right to restriction. Ask us to pause processing while a dispute is resolved.
• Right to portability. Receive your data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.
• Right to object. Object to processing based on legitimate interests, including any form of profiling.
• Right to withdraw consent. Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right to give instructions about what happens to your data after death. As provided under French law.

To exercise any of these rights, write to us at hello@bvh-co.com. We will respond within one month of receipt, and may ask for reasonable proof of identity before acting on the request.

If you believe our processing infringes your rights, you can lodge a complaint with the French data protection authority, the CNIL, at www.cnil.fr or any other supervisory authority in the EU member state where you live or work.

09 Security

We apply appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. The website is served over HTTPS with a Let's Encrypt certificate. Access to contact form submissions is limited to the founders and to the small set of providers listed above. We review our security measures periodically and will notify you and, where required, the CNIL within seventy-two hours if a personal data breach is likely to result in a risk to your rights and freedoms.

10 Children

The website is aimed at business audiences and is not directed at children. We do not knowingly collect personal data from anyone under the age of fifteen. If you believe a child has provided us with personal data, please contact us and we will delete the record.

11 Changes to this policy

We may update this policy from time to time to reflect changes in our practice or in the law. The effective date at the top of the page always shows the current version. Where changes are significant we will bring them to your attention, for example through a notice on the site or a message to active contacts.

12 Contact

Any question about this policy, about the personal data we hold on you, or about how we process it can be sent to hello@bvh-co.com.