Privacy policy

The data controller is KOLOSALTech, a French SASU registered with the Trade and Companies Register of Rennes under number 106 103 047 (RCS Rennes 106 103 047), with its registered office at 3 Rue de Robien, 35000 Rennes, France, for the personal data collected on this site as part of the commercial relationship and quote requests.

Contact for any question regarding personal data: contact@kolosaltech.com. No Data Protection Officer is currently appointed; this address is the contact point for rights requests and data-protection questions.

Via the contact form: name, organization, country, email, phone, type of need and message. Data collected solely to respond to your request.

Callback requests collect a name, phone number, optional company, preferred time and optional message. Equipment-list requests collect a name, email, optional company, message and the transmitted file.

With each submitted form, the site attaches the origin category of the visit (direct access, search engine, social network, other website or campaign), the source and campaign names when the link you followed carries them, and the first page you viewed. This information is used to know which channels bring requests. The address of the page you came from is never transmitted, and nothing is written to your device for this purpose.

The hosting provider also processes technical data strictly required to deliver and secure requests (IP address, date, URL, browser and error logs). Fields marked with an asterisk are required to respond; without them, the request cannot be sent. Other fields are optional.

The sales assistant remains a local demonstration: no entered text, AI API call or conversation storage is involved.

Response to your commercial requests, qualification of the need, issuing of quotes, order tracking and post-delivery support.

Legal bases for processing (art. 6 GDPR):

• Pre-contractual measures and performance of the contract (art. 6.1.b): handling quote requests, orders and support.
• Legitimate interest (art. 6.1.f): commercial relationship, measured B2B prospecting and site security.
• Legal obligation (art. 6.1.c): retention of accounting and invoicing records.
• Consent (art. 6.1.a): newsletter subscription and audience measurement subject to the cookie banner.

• Prospects and requests without a contract: 3 years after the last active contact.
• Spam and unconfirmed newsletter subscriptions: 30 days.
• Customer relationship: for the contract term, then commercial-relationship data limited to 3 years; records strictly required by law or for evidence are archived separately for the applicable statutory period, including 10 years for accounting records.
• Resend delivery logs: 30 days according to the service used.
• Aggregated audience counters, without personal data: 25 months.
• Calendly appointment data and commercial WhatsApp exchanges: operational deletion no later than 12 months after the last exchange, unless a documented legal obligation or dispute applies.

A monthly authenticated Supabase purge, capped at 1,000 rows per run, removes expired prospects, spam and unconfirmed subscriptions. Customer rows marked “Gagné” are excluded to prevent deletion of a record subject to statutory retention.

The site does not retain equipment-list files permanently. They are checked in memory and attached to an internal email. The professional mailbox copy must be deleted once the quote is qualified and no later than 90 days, unless a documented obligation applies.

Under the GDPR: rights of access, rectification, erasure, restriction, objection and portability, and withdrawal of consent at any time. No site processing makes a solely automated decision with legal effect. To exercise these rights:

contact@kolosaltech.com

KOLOSALTech responds within the applicable period, normally one month, after proportionate identity verification where necessary.

This site uses a limited number of cookies/trackers, in accordance with the CNIL guidelines:

• Functional cookies (no consent required):
  • kolosal-quote-cart (localStorage): multi-product quote cart, stored until deleted by the user or the browser
  • kt-exit-intent-dismissed, kt-exit-intent-shown, kt-project-brief-v1, kt-theme, kt-display-mode-v1: display preferences and journey memory, without identifier or personal data. kt-display-mode-v1 also exists as a cookie: it is set as soon as the preference is known, and the server stops sending decorative visuals from the next page onwards
• Aggregated audience measurement (no consent required): the site counts page views, the category of origin of visits (direct access, search engine, social network, other site, campaign) and the name of the form steps reached (form started, sent or failed), nothing else. These daily counters are kept on our servers, without cookies, identifiers or IP addresses; the address of the page you came from is not transmitted. Nothing is read from or written to your device, which is why this measurement does not depend on the banner. Aggregates are kept for 25 months.
• Subject to your consent:
  • Audience measurement (Vercel Analytics and Speed Insights): minimized and aggregated technical data, without form values or advertising profiling, enabled only after acceptance.
  • Conversion events sent to Vercel Analytics (clicks on WhatsApp, phone or email, product pages viewed, assistant, form steps): event name, language, placement and generic catalog identifiers only; no name, email, phone, message or filename is sent. Without your consent, only the name of the form steps is counted, in the aggregated measurement described above.
  • Performance measurement (Sentry): page load and navigation timings, without cookies, enabled only after acceptance.
• No third-party advertising tracking cookies (Google Ads, Facebook Pixel, etc.)

Functional local storage includes the quote cart and form drafts, which are stored only after consent and automatically deleted after two hours. The banner choice is stored inkt-consent-v1.

You can change your choice at any time with the button below, or block cookies in your browser settings.

Manage my cookie preferences

Delete my form drafts

Services actually used by or accessible from this site:

• Supabase, Inc.: request database, project hosted in Paris (EU).
• Vercel Inc.: web hosting, CDN and consented audience measurement.
• Functional Software, Inc. (Sentry): technical error reports, relayed through its European endpoint. No cookies, no form values, no session recording; page addresses are sent without their query parameters. Performance measurement from your browser is enabled only after your acceptance; measurement of our own servers is part of running them and does not concern you.
• Resend, Inc.: transactional email delivery.
• Hostinger: DNS and recipient professional mailbox.
• Stripe Payments Europe Ltd.: payments only when a payment flow is initiated.
• Calendly LLC: appointment booking only after an explicit click.
• WhatsApp / Meta: external messaging only after the visitor voluntarily opens the link.
• Google LLC (YouTube Data API, Google Drive API): publishing KOLOSALTech's videos on its own YouTube channel and exchanging production files with the publisher's Drive; no site visitor or YouTube user data goes through it (see the dedicated section below).

The official terms for Supabase, Vercel Pro, Resend, Hostinger, Stripe and Calendly incorporate a data processing agreement (DPA). WhatsApp remains an external service whose legal role depends on the account and actual use. KOLOSALTech remains responsible for periodic review of its accounts, subprocessors and contractual safeguards.

Enquiries received through the site forms are consulted from an internal console hosted on the site itself:

• Named accounts. Each person has their own username. Two levels exist: read only, and full management reserved for the company director.
• Automated assistant. A technical read access may be opened to an automated assistant. It receives the date, country, the organisation field retained for compatibility, type of need, status and enquiry source. This field accepts free text, so do not enter a person's name there. No name, email address, phone number or message content is passed to it. It cannot write anything, and it cannot send any message.
• Access logging. Logins, page views and status changes are recorded for six months, with the account name and a fingerprint of the IP address, never the address itself. That log holds no enquiry data.
• Export. A CSV export is reserved for the company director. The file name carries its destruction date.

The console session uses a strictly technical cookie, set only after a team member signs in. It is never placed on a site visitor.

KOLOSALTech uses YouTube API Services (YouTube Data API v3) and the Google Drive API for one purpose only: publishing the videos it produces on its own YouTube channel, and exchanging production files (clips, voice-over, images) with the publisher's own Google Drive. These accesses are granted by KOLOSALTech's single Google account, owner of the channel, and concern no other account.

YouTube data used. Only the content KOLOSALTech sends itself: video file, title, description, thumbnail, visibility status (private or public) and the video identifier returned by YouTube. These elements serve exclusively to upload, update and track its own videos.

What is not done. No YouTube user data (viewers, subscribers, comments, watch history, any third party's account data) is collected, accessed, stored, analysed or shared. No data is passed to third parties, sold or used for advertising. This usage sets no YouTube-related cookie or tracker on this site.

Storage and security. Google access tokens are kept encrypted on KOLOSALTech's servers (European Union), are never written to a log or a code repository, and are reachable only by the publishing service. Produced video files are stored in a private space until publication, then kept as the publisher's archive.

By using YouTube API Services, KOLOSALTech is bound by the YouTube Terms of Service and the Google Privacy Policy.

Revocation. The access granted to KOLOSALTech can be withdrawn at any time from the permissions page of the Google account concerned: security.google.com/settings/security/permissions. Questions about this usage can be sent to contact@kolosaltech.com.

Some data may transit outside the European Economic Area, including the United States. Provider DPAs describe the applicable transfer mechanisms, including Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework. Links to those documents and the technical review are recorded in the delivery documentation.

Technical measures implemented:

• HTTPS (TLS 1.3) across the entire site
• Rate limiting on API endpoints (anti-spam, anti-abuse)
• HTTP security headers (X-Frame-Options, CSP, etc.)
• Anti-bot honeypot on all forms
• No user password stored on the site side (delegated auth)
• Encryption of secrets via Vercel Secrets

If you believe your rights are not being respected, you can lodge a complaint with the CNIL.