At Kardox Media, protecting your data is not an option: it is a constraint we impose on ourselves from the design stage. We sell nothing, we track no one, and your data does not leave Europe. This document states which data we hold, why, for how long, and what you are entitled to demand from us.
Data controller
The data controller is Kardox Media — Campus Numérique 47, 156 avenue Jean Jaurès, 47000 Agen, France.
For any question about your data: contact@kardoxmedia.com.
This policy covers the processing carried out to provide our services and to run the client area client.kardoxmedia.com. It does not cover the processing you yourself carry out on the sites you host: that case is described further below.
What we do not do
It is quicker to start there.
- We neither sell nor rent your data, to anyone, in any form.
- We carry out no profiling and take no automated decision producing legal effects concerning you.
- We collect no sensitive data within the meaning of Article 9 of the GDPR.
- We set no advertising tracker and measure no audience with any third-party tool.
- We load no font, no script, no image from any third-party domain: displaying a page of the client area sends requests only to our own servers.
- We send no unsolicited commercial email.
Data we collect
We collect only what is necessary to provide the service.
| Category | What it covers | Origin |
|---|---|---|
| Account | Name, email address, postal address, interface language, display preference. | You, at the time of ordering. |
| Billing | Order history, invoices, payment method used, payment status. | You and the payment provider. |
| Support | The content of the tickets and messages you send us, attachments included. | You. |
| Technical logs | Connection IP addresses, dates, actions performed in the client area, server logs. | Recorded automatically. |
Card numbers never reach us: they are entered directly with our payment provider, on a page that belongs to it. We keep neither the number, nor the expiry date, nor the security code.
Purposes and legal bases
Every processing operation rests on an identified legal basis.
| What we do | Why it is lawful |
|---|---|
| Provide and administer the hosting | Performance of the contract |
| Issue invoices, collect payments | Performance of the contract and legal obligation |
| Answer your support requests | Performance of the contract |
| Inform you of an incident, maintenance, or a change to the service | Performance of the contract |
| Keep the infrastructure secure and prevent abuse | Legitimate interest |
| Establish evidence in the event of an incident or dispute | Legitimate interest |
| Retain accounting records | Legal obligation |
| Respond to a request from a duly authorized authority | Legal obligation |
Where a processing operation rests on our legitimate interest, we have verified that it does not disproportionately affect your rights, and you may object to it.
Where your data lives
The servers that host your sites, your databases, and your mail are located in Europe, within the European Union, spread across several countries of the continent. Backups remain on that same European infrastructure.
Your data does not leave the European Union. We organize no transfer to any third country.
Where a provider belongs to an international group, the service is supplied to us by an entity established in the Union and the processing takes place there; where applicable, the safeguards provided for in Chapter V of the GDPR — an adequacy decision or the European Commission's standard contractual clauses — govern the whole.
Processors
We rely on a deliberately small number of providers. Each receives only the data strictly necessary for its task, and acts only on our instructions.
| Task | Data transmitted | Framework |
|---|---|---|
| Collection of online payments | Payment and billing data. Card numbers are entered with the provider and never reach us. | Processing agreement compliant with Article 28 of the GDPR. Authorized provider, subject to European payment services regulation. |
| Delivery of transactional emails | Your email address and the content of the message addressed to you. | Processing agreement compliant with Article 28 of the GDPR. No advertising use, no building of files. |
| Supply and physical operation of the servers | No transmission on our part: the provider handles the physical hosting, power, network, and physical security of the facilities, located in the European Union. | Processing agreement compliant with Article 28 of the GDPR. |
None of these providers is authorized to use your data on its own account, nor to pass it to a third party. The identity of the processors currently engaged is provided on simple request to contact@kardoxmedia.com.
Who accesses your data
Within Kardox Media, access is restricted to the people who need it for their task: infrastructure operations, support, billing. Administrative access is individually assigned and logged.
Outside, your data is disclosed only to the processors above and, where applicable, to a duly authorized authority requesting it in the forms provided by law. Such a request is examined before being acted upon; we comply only to the strict extent the law requires.
The messages we send
All our emails concern your service.
| Message | When it goes out | Can you opt out |
|---|---|---|
| Confirmation and activation | At the order, after payment | No: it carries the go-live information |
| Invoice and renewal notice | Before each renewal | No: contractual and accounting obligation |
| Incident, maintenance, security | When the situation requires it | No: your service's continuity depends on it |
| Reply to a ticket | When you write to us | Not applicable: it is your request |
| Change to the terms | Thirty days before it takes effect | No: the law requires us to inform you |
There is no commercial newsletter at Kardox Media: there is therefore nothing for you to unsubscribe from.
Retention periods
We keep nothing "just in case".
| Data | Period | Starting point |
|---|---|---|
| Account and contact details | Duration of the contractual relationship, then three years | Last contact |
| Invoices and accounting records | Ten years, in accordance with the French Commercial Code | Close of the financial year |
| Technical and connection logs | Twelve months | Recording |
| Support tickets | Three years | Closure of the ticket |
| Hosted content | Retention period provided in the contract, then deletion | Termination |
| Technical cookies | Duration of the session or of the remembered choice | Setting |
When these periods expire, the data is deleted or irreversibly anonymised. Anonymisation, where chosen, is final: the data can no longer be linked to a person.
Security
Access to the client area is encrypted in transit (TLS). Passwords are stored as digests computed by a modern derivation function, never in the clear: we are technically unable to tell you your password, and that is by design.
Administrative access is individually assigned, restricted to the people who need it, and logged. The infrastructure is kept up to date and supervised; backups are kept on infrastructure separate from production.
In the event of a data breach
Should a breach likely to create a risk to your rights occur, we would notify the supervisory authority within seventy-two hours and inform you directly where the risk is high. That notice would state what happened, which data is affected, and what you need to do.
Your visitors' data
For the data you host — that of your site's visitors, your customers, your members, your correspondents — the roles are reversed.
- You are the data controller: you decide what is collected, why, and for how long.
- Kardox Media is your processor within the meaning of Article 28 of the GDPR: we process that data on your instructions and solely to perform the hosting.
We access that data only to operate and secure the service, or at your request in the course of support. We use it for no purpose of our own. It is your responsibility to inform your own visitors and, where required, to collect their consent.
Cookies
The client area uses technical cookies only: authentication session, interface language, display theme.
These cookies are necessary for the service to function and do not require your consent. No advertising cookie, no tracker, no third-party audience measurement is set. No consent banner is shown to you, for the simple reason that there is nothing to consent to.
Your rights
You have the following rights at all times.
| Right | What it allows you to do |
|---|---|
| Access | Know whether we process data about you, and obtain a copy. |
| Rectification | Have inaccurate data corrected or incomplete data completed. |
| Erasure | Obtain the deletion of your data, within the limits of our legal obligations. |
| Restriction | Have a processing operation frozen while a verification or dispute is pending. |
| Objection | Object to a processing operation based on our legitimate interest. |
| Portability | Receive the data you provided to us in a structured, machine-readable format. |
| Post-mortem directives | Decide what happens to your data after your death. |
How to exercise them
Write to contact@kardoxmedia.com, or open a ticket from your client area. We reply within one month; that period may be extended by two months for a complex request, in which case you are informed, with the reason.
Proof of identity may be requested where there is reasonable doubt about the identity of the requester — never as a matter of course, only when the request clearly does not come from the account concerned.
Some erasure requests cannot be fulfilled immediately: a legal obligation, notably an accounting one, requires us to keep the record concerned until its period expires. In that case we tell you which record and until when.
Complaints
If you consider that the processing of your data does not comply with the rules, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris — cnil.fr.
We invite you, however, to write to us first: most situations are resolved in a single exchange, and faster.
Changes
This policy may evolve with the service or the regulations. Any substantial change is notified to you by email before it takes effect, and the applicable version remains available at this address.