Personal data
What the site measures of its audience, what it does not collect, and how to exercise your rights.
Audience measurement
The site uses Vercel Speed Insights, the performance measurement tool of its hosting provider. It records page loading and display stability indicators (LCP, CLS, INP, FCP, TTFB), aggregated by route.
No cookie is written, no persistent identifier is set on the device, no profile is built. The data sent is limited to one metric, the route of the page and the country.
No consent banner is displayed: the measurement neither reads nor writes information on the visitor's device, and consent is not required on that basis.
The pre-production site is served by another hosting provider, which does not expose this tool: no audience measurement is collected there.
Data controller and legal basis
Data controller: Wavestone. Contact details: Wavestone's contact form (new tab).
Purpose: to track page loading time and display stability, in order to fix the pages that load most slowly.
Processor: Vercel, host of the site and operator of the measurement.
Legal basis: the publisher's legitimate interest in measuring and improving the site's performance (Article 6(1)(f) GDPR).
Retention period: the measurements can be viewed over a rolling 7-day window, the period of Vercel's Hobby plan. Vercel does not publish a retention period specific to this tool. Transfers outside the European Union: Vercel Inc. is a US company certified under the EU-US Data Privacy Framework, which governs this transfer.
Data subject rights
The rights of access, rectification, erasure, objection and restriction are exercised with the data controller, at the contact details above.
A complaint may be sent to the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL).
Pre-production guests
A pre-production version of the site, closed to the public, is accessible only to guests identified by their email address, recorded by the access control of its hosting provider. That list does not concern visitors to the public site.
Retention period: an address is removed from the list as soon as access is no longer needed. Sign-in logs are kept by Cloudflare, Inc., a US company certified under the Data Privacy Framework, for the period set by its Zero Trust plan.