Cephalgo SAS (“Cephalgo”, “we”, “us”) respects your privacy. This policy explains how we collect, use and protect your personal data when you visit cephalgo.com or contact us about our work.
Recordings and other data from study participants and speech dataset contributors are covered by their consent, each study’s own agreements and our GDPR documents (DPIA and ROPA, and a DPA when we process data for a sponsor). They are held under pseudonymized IDs and hosted in the EU or US; see Vendor qualification. The Cephalgo EEG app is covered by its own EEG app privacy policy.
1. Who we are
Data controller: Cephalgo SAS, 8 rue des Veaux, 67000 Strasbourg, France. SIRET 904 447 323 00018
Contact: contact@cephalgo.com
2. What data we collect
- Document requests: your name, your email address (needed to send the document) and the document you asked for, when you email us for a poster, a white paper, the EEG test report, or vendor qualification and entity documents.
- Emails you send us: your name, email address and the content of your message.
- Call bookings: when you book a call through Google Calendar appointment booking, the name and email address you enter and the meeting time you choose.
- Business communications: notes from our calls and our later emails with you, when you engage with us as a prospective or actual client.
- Technical data: IP address, browser type, device information, pages visited, referring URL and time of visit.
- Cookies: see section 7.
You do not have to give us personal data. Without an email address we cannot send a document you request, and without a name and email address you cannot book a call.
3. Why we use your data, and the legal basis
- Sending you a document you requested (legitimate interest in answering your request).
- Following up with you about the document and related work, by email (legitimate interest in discussing our work with professionals who contacted us; you can object at any time, and every follow-up email lets you opt out).
- Responding to inquiries and holding the calls you book (legitimate interest).
- Providing our services and managing client relationships (performance of a contract).
- Advertising measurement (consent, given or withdrawn through the cookie banner or “Cookie preferences” in the footer).
- Keeping invoices and accounting records and meeting other legal obligations (legal obligation).
- Keeping the website secure and working, and improving our website and services (legitimate interest).
4. How long we keep your data
- Document requests, emails you send us, call bookings and records of business communications with prospective clients: 3 years from the last contact with you.
- Client records: the duration of the contract plus 5 years. Invoices and accounting records: 10 years, as French law requires.
- Records of your cookie choices: 12 months.
- Technical and server logs: 12 months.
5. Who we share your data with
We do not sell your data. We share it with these processors acting on our behalf:
- Webflow (website hosting).
- Google Workspace (email and calendar).
- Google Calendar appointment booking (call booking).
These processors are bound by data processing agreements (Article 28 GDPR) and process data only on our instructions.
Some services receive your IP address when a page loads and process it under their own terms: Google Fonts (font delivery), and jsDelivr and Amazon CloudFront (delivery of site scripts).
Google Ads (advertising measurement) runs only after you consent. We decide to place it on our site; Google then processes the data it collects as an independent controller, under Google’s privacy policy.
6. International transfers
Some of the services named in section 5, including Webflow, Google, jsDelivr and Amazon CloudFront, may process data outside the European Economic Area, in particular in the United States. Where this happens, the transfer relies on an adequacy decision, such as the EU-US Data Privacy Framework for participating companies, or on the European Commission’s standard contractual clauses. You can ask us for a copy of these safeguards at contact@cephalgo.com.
7. Cookies
Strictly necessary cookies keep the site working and remember your cookie choice. Advertising cookies, used for Google Ads conversion measurement, are set only after you accept them in the cookie banner or in “Cookie preferences” in the footer, where you can change your choice at any time. Your choice is stored on your device by tarteaucitron.js, in a cookie and in your browser’s local storage.
8. Your rights
Under the GDPR and French data protection law, you have the right to access, rectify and erase your data, to restrict its processing, to object to processing based on legitimate interest (including follow-up emails), to data portability, to withdraw consent at any time without affecting earlier processing, and to give instructions on what happens to your data after your death. We do not make decisions about you based solely on automated processing, including profiling. You can also lodge a complaint with the CNIL (cnil.fr).
For privacy questions or to exercise these rights, email contact@cephalgo.com. We reply within one month. For complex requests this can be extended by two more months, and we will tell you if so.
9. Security
We protect your data with technical and organizational measures, including encrypted transmission (HTTPS) and access controls. Our controls are independently audited under SOC 2 Type II; see Vendor qualification.
10. Changes to this policy
We may update this policy. The date at the top shows the latest version.