Privacy policy

1. Data controller

Tarek BELHADJ EI, trading under the name KAYZEN, 6 rue Pierre Termier, 69009 Lyon, France, SIREN 493 857 262, is the controller of the processing related to the Site, to prospects and customers, and to the free Kayzen Home service. Contact: contact@kayzen-lyon.fr. A data protection officer will be appointed before the commercial opening of the detection and monitoring modules (EDR, AI control). [À VALIDER]

For data that our professional customers process through the platform (devices and users of their organisation), KAYZEN acts as a processor; this processing is governed by the data processing agreement (DPA).

2. Data collected on the Site

• Contact and demo forms: name, email, company, number of devices, message.
• Trial or family account sign-up: email, name, organisation or household name, country, language, time-stamped acceptances.
• Abuse protection: pseudonymised IP address, kept as a counter for one hour.
• Audience measurement, if enabled: aggregated statistics with no cookie or personal identifier.

3. Data processed by the service

Depending on the modules enabled: technical device identifiers, hardware and software inventory, DNS logs (which can be anonymised), security events, file fingerprints, quarantined files (which remain on the device unless you explicitly agree to send them), and metadata of emails analysed for K-Mail. No file content, email content or keystrokes are collected outside a module that has been explicitly enabled and documented.

For Kayzen Home, only aggregated statistics on blocked browsing are kept; detailed history is not kept beyond what the console displays. [À VALIDER : durée]

4. Purposes and legal bases

• Responding to your requests and preparing a contract: pre-contractual measures (art. 6.1.b GDPR).
• Providing the service and the family account: performance of the contract or the terms of use (art. 6.1.b).
• Securing the Site and the service, preventing abuse: legitimate interest (art. 6.1.f).
• Invoicing business offers and meeting our accounting obligations: legal obligation (art. 6.1.c).
• Measuring audience anonymously: legitimate interest (art. 6.1.f).

5. Retention periods

• Contact requests: 3 years after the last exchange.
• Unconfirmed sign-up: deleted within 8 days.
• Anti-abuse counters linked to the pseudonymized IP: 1 hour; linked to the email address: 24 hours.
• Family account: for the life of the account, then deleted within 30 days of its closure. [À VALIDER]
• DNS logs of professional customers: 30, 90 or 365 days depending on the offer.
• Accounting records: 10 years (legal obligation).

6. Recipients and sub-processors

Data is accessible to authorised KAYZEN staff and to our technical sub-processors, within the limits of their tasks. Their list, role, location and transfer safeguards are published on the Sub-processors page. No data is sold, rented or transferred for commercial purposes.

7. Transfers outside the European Union

Data is accessible to authorized KAYZEN staff and to our technical subprocessors, within the limits of their assignments. Their list, role, location and transfer safeguards are published on the Subprocessors page. During the pilot programme, hosting of accounts and trial workspaces is provided by [À VALIDER: provider and country]. No data is sold, rented or transferred for commercial purposes.

8. Security

Encryption of communications (TLS 1.3), encryption at rest with per-customer keys, customer isolation in the database, strong authentication for administrators and an audit log. Detailed practices are published in the trust centre.

9. Minors

The family account is opened by an adult. Profiles created for children contain only a first name or nickname chosen by the Account Holder and the associated filtering rules. A data protection impact assessment is recommended for this processing. [À VALIDER]

10. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set directives on what happens to your data after your death. Write to contact@kayzen-lyon.fr; proof of identity may be requested where there is reasonable doubt. We reply within one month.

You may lodge a complaint with the CNIL (cnil.fr).

11. Changes

This policy may change, in particular when new modules are launched. The date of the last update appears at the top of the page; Account Holders are informed of important changes by email.