Privacy
Privacy Policy
This site does not try to follow you: no cookies during normal browsing, no advertising pixels, no profiling tools, no forms. I only receive your email address and your message if you decide to write to me.
Audience measurement is performed with Cloudflare Web Analytics: no cookies, no fingerprinting, no cross-site tracking, and it can be turned off at any time from the comfort panel (under “Privacy”).
Cloudflare, which hosts the site, also gives me overall statistics in its dashboard: number of requests, data volume, countries, and a number of “unique visitors”. That number is calculated from distinct IP addresses: it does not count people and it includes bots. These statistics rely on no cookie and no script.
Data controller
Within the meaning of Article 4.7 of the General Data Protection Regulation (Regulation EU 2016/679, hereafter “GDPR”) and the French Data Protection Act (loi n° 78-17 of 6 January 1978 as amended), the data controller for personal data collected on the site florianbeaufils.com is:
The nature of my activities does not require me to appoint a Data Protection Officer. I am your direct point of contact. Details of the publisher appear in the legal notice.
General principles
Personal data processing on this site is based on the following principles, in accordance with Article 5 of the GDPR:
- Lawfulness, fairness and transparency: processing activities are based on a clear legal ground, documented in this policy.
- Purpose limitation: data is used only for the purposes explicitly described below.
- Data minimisation: only necessary data is collected.
- Accuracy: inaccurate data may be rectified upon request.
- Storage limitation: data is retained for a period proportionate to its purpose.
- Integrity and confidentiality: data is protected by appropriate technical and organisational measures.
Data collected and processing activities
The site carries out four personal data processing activities, described below.
Processing no. 1: contact by email
Purpose: to answer the messages you send me, such as a professional enquiry, a job or collaboration proposal, or feedback on the site.
Legal basis: my legitimate interest in receiving and handling the professional messages addressed to me (Article 6.1.f GDPR).
Data collected:
- Sender's email address
- First and last name (if included in the message or signature)
- Content of the message sent
- Technical metadata (date, subject, originating server)
Collection method: exclusively via mailto:
links on the site. The site has no contact form. The visitor uses their own
email client to send the message.
Retention period: I keep your messages for no more than 3 years after your last contact, a period inspired by the CNIL's reference framework on commercial management.
Recipients: I am the only person who reads these messages. They are received and stored by Gmail: see the “Service providers, recipients and transfers” section.
Processing no. 2: accessibility and display preferences
Purpose: to remember your personal preferences (text size, spacing, high contrast, light or dark theme, etc.) so they can be restored on your next visits to the site.
Legal basis: my legitimate interest in providing a site that is accessible and consistent from one visit to the next (Article 6.1.f GDPR). See the “Cookies and local storage” section for why no consent is required.
Data stored: only your personalisation choices (for example: text size = “Large”, high contrast = enabled). No identifying data is linked to these preferences.
Collection method: local storage in your browser via the
localStorage API. The data never leaves your device and is not
transmitted to any server, including mine.
Retention period: until you delete it (reset button in the comfort panel, or your browser settings).
Recipients: none. The data remains exclusively on your device.
Processing no. 3: audience measurement (Cloudflare Web Analytics)
Purpose: to measure overall traffic on the site (most-visited pages, countries, technical performance) in order to guide its updates and detect possible performance issues.
Legal basis: my legitimate interest in understanding overall site usage (Article 6.1.f GDPR). See the “Cookies and local storage” section for why no consent is required.
Data collected:
- URL of the page visited and referrer URL
- Country, derived server-side
- Device type, browser and operating system
- Technical performance indicators (Core Web Vitals)
What is not collected: no cookie is set, no IP address appears in the reports, no fingerprint is computed and no cross-site profile is built.
Collection method: a lightweight script (beacon.min.js)
is loaded from static.cloudflareinsights.com, unless you have turned
measurement off. It sends Cloudflare a short signal on each page load.
Opt-out: you can turn measurement off at any time from the comfort panel (under “Privacy”, “Audience measurement” setting). The script is then no longer loaded on the next reload. Your choice is stored in your browser.
Retention period: Cloudflare states that it keeps detailed data for 7 days, then reduces it to about 10% of its volume for long-term storage. I can view it over the previous 6 months.
Recipients: Cloudflare, which acts as a processor. I am the only person who views these reports, in its dashboard.
Processing no. 4: technical logs and traffic statistics
Purposes: to deliver pages, to protect the site against attacks and bots, to know its overall traffic and to check that it works properly.
Legal basis: my legitimate interest in keeping the site secure and following its overall use (Article 6.1.f GDPR). This processing neither stores nor reads any information on your device: it relies on the data your browser sends to obtain the page. It therefore requires no consent.
Data concerned: IP address, date and time, page requested, browser (User-Agent), country inferred from the IP address.
What I see: totals, except in security event logs, which may show the IP address of a blocked request. Cloudflare documents no setting to turn these statistics off.
Retention period: Cloudflare publishes no single retention period for these logs. Its documentation states that detailed traffic and security data remain available to me for about 31 days. Beyond that, Cloudflare sets its periods according to the criteria in its privacy policy, with no public figure.
Recipients: Cloudflare, which acts as a processor for these logs. Cloudflare also uses its network traffic data to provide, maintain and improve its services, under its own responsibility.
Providing your data
No provision of data is required by law or by contract. Writing to me is your choice: without an email address, I simply cannot reply. The IP address is technically necessary to display the pages.
Automated decisions
No decision producing legal effects or significantly affecting you is made solely by automated means, and I do no profiling. Cloudflare's security filters may automatically block a request judged malicious. No processing on this site relies on your consent.
What this site does not use
The site does not use the following:
- No advertising, tracking or audience measurement cookies.
- No behavioural analytics tool (no Google Analytics, Matomo, Plausible, Hotjar, or equivalent). The site's audience measurement is processing no. 3, with no cookies and easy to turn off; the host's statistics are described in processing no. 4.
- No advertising tracking pixels (Meta Pixel, LinkedIn Insight Tag, etc.).
- No social media integrations via widgets or share buttons (links to LinkedIn are plain HTML links, without any third-party script).
- No web fonts loaded from an external service (no Google Fonts, no Adobe Fonts).
- No collection forms (newsletter, contact, registration).
- No advertising.
- No profiling: no user identifier, and I do not reconstruct any individual journey.
Service providers, recipients and transfers
Two companies are involved: Cloudflare hosts the site and measures its audience, Google provides the mailbox. Their roles differ, and each is described below.
Cloudflare, Inc.: hosting, delivery, DNS and audience measurement
Google Ireland Limited: email (Gmail)
Your message arrives in a Gmail inbox. Google provides this consumer service under its own terms and acts as a data controller, not as my processor.
Transfers outside the European Union
These transfers rely on the Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795), in force on the date of this policy. Cloudflare, Inc. and Google LLC are certified under it. This decision is the subject of an appeal before the Court of Justice of the European Union (case C-703/25 P).
Should it cease to apply, Cloudflare's agreement provides for the Commission's standard contractual clauses, available in its Data Processing Addendum, linked above. Google states that it also relies on these clauses: see its transfer frameworks.
Cookies and local storage
The site sets no cookies during normal browsing. If Cloudflare's
security systems present a challenge to a connection judged suspicious, they may
set a technical cookie named cf_clearance, limited to that check and
strictly necessary for security.
Local storage (localStorage)
The site uses the browser's localStorage API to remember your
accessibility and display preferences. This data stays exclusively on your device,
is not transmitted to any server, and cannot be used for cross-site tracking.
The storage keys used are as follows:
theme-preference: chosen theme ('light' or 'dark')-
comfort-preferences: a JSON object containing all comfort panel settings (text size, spacing, line height, high contrast, alignment, saturation, cursor, audience measurement, etc.)
You can delete this data at any time via the reset button in the comfort panel, or via your browser settings (clear site storage).
Why there is no consent banner
Your preferences fall under “user interface personalisation trackers”, which the
CNIL exempts from consent (deliberation no. 2020-091 of 17 September 2020). Audience
measurement falls under the exemption the same deliberation provides for audience
measurement trackers: with no cookies, it only produces anonymous statistics for
this site, allows no cross-site tracking and can be turned off at any time. The
cf_clearance cookie, if set, is strictly necessary for security.
Technical logs neither store nor read anything on your device. No consent banner
is therefore required on this site.
Your rights
In accordance with Articles 15 to 22 of the GDPR and Articles 48 to 56 of the French Data Protection Act, you have the following rights over any personal data I hold about you:
- Right of access (Article 15 GDPR): to obtain confirmation that data about you is being processed, and to receive a copy.
- Right to rectification (Article 16 GDPR): to obtain correction of inaccurate or incomplete data.
- Right to erasure (Article 17 GDPR, “right to be forgotten”): to obtain deletion of data in the cases provided for by the regulation.
- Right to restriction of processing (Article 18 GDPR): to obtain a temporary freeze on the use of your data in certain cases.
- Right to object (Article 21 GDPR): to object, on grounds relating to your particular situation, to processing based on legitimate interest.
- Right to give post-mortem instructions (Article 85 of the French Data Protection Act): to define what happens to your data after your death.
How to exercise your rights
To exercise any of these rights, simply send a request by email to florian.beaufils.contact@gmail.com specifying:
- The right you wish to exercise
- The email address from which you may have contacted me
- Proof of identity, only where there is reasonable doubt about your identity
I commit to responding to your request within a maximum of one month from receipt, in accordance with Article 12.3 of the GDPR. This deadline may be extended by two months for complex requests, in which case you will be notified.
Your rights over technical logs
I cannot link an IP address to a person, and I have no access to Cloudflare's raw logs. If you exercise a right over this data, I will tell you what I can do, asking if needed for your IP address and the date of your visit. You may also contact Cloudflare: dpo@cloudflare.com. For audience measurement, the comfort panel setting is enough to object to it.
Right to lodge a complaint
If you believe that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL):
- By post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07, France
- Online: cnil.fr/fr/plaintes
Security measures
The following technical and organisational measures protect personal data, in accordance with Article 32 of the GDPR:
- Encrypted communications: the entire site is served over HTTPS, with certificates issued and renewed automatically by Cloudflare. Checked on 31 October 2026: TLS 1.2 and 1.3 accepted, TLS 1.0 and 1.1 refused.
- Two-step verification enabled on the Google account that receives messages.
- No personal database: as the site is static, no personal data is stored in a database.
- Restricted access: I am the only person with access to the mailbox.
- Regular updates of operating systems and software used to access data.
Data of minors
This site is intended for a professional audience and is not designed for minors. None of its processing relies on consent.
Sensitive data
The site collects no sensitive data within the meaning of Article 9 of the GDPR, namely: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person's sex life or sexual orientation.
Visitors are advised not to voluntarily transmit such data in their messages.
Policy updates
This privacy policy may change to reflect legal, technical or functional changes to the site. The date of the last update appears at the top of this page.
If I wished to use your data for a new purpose, I would inform you beforehand.
Applicable law
French law and the GDPR apply. You keep the remedies provided by the GDPR, including before the courts of your habitual residence in the European Union.
Contact
For any question relating to this policy or to your personal data:
Data controller
Florian Beaufils
florian.beaufils.contact@gmail.com