Last updated: 4 September 2026
This policy describes how ICSS processes personal data collected through its website, forms and communications following a contact request or an expression of interest in a product. It supplements the Legal Notice and the Cookie Policy.
Data controller
The controller responsible for the processing described in this policy is:
Data processed, purposes and legal bases
| Context | Data concerned | Purposes | Legal basis |
|---|---|---|---|
| Contact form | Name, company, email address, optional telephone number, subject, message and up to two optional attachments. | Respond to and follow up the request and retain evidence of communications where necessary. | Pre-contractual steps requested by the individual when the enquiry concerns a project or quotation; ICSS’s legitimate interest in responding to other professional enquiries and managing its communications. |
| Shop and quotation request | Selected products and quantities, first and last name, company, country, postal address, postcode, town or city, region, telephone number, email address, notes and data associated with the request. | Record the expression of interest, verify the requirement, compatibility and availability, contact the requester and prepare a commercial offer. | Pre-contractual steps taken at the prospective buyer’s request. |
| User account | Username, email address, securely stored password, saved contact details and history of associated requests. | Create and secure the account, pre-fill contact details and provide access to the history. | Performance of the requested service and pre-contractual or contractual steps. |
| Quotation, order and delivery | Contact details, technical and commercial correspondence, quotations, orders, delivery address, billing data, bank-transfer status, shipping references and warranty follow-up. | Prepare and perform the contract, arrange payment by bank transfer, delivery, after-sales service and warranty, maintain accounting records and manage possible disputes. | Performance of the contract, compliance with accounting and tax obligations, and ICSS’s legitimate interest in documenting its operations and defending its rights. |
| Operation and security | IP address, date and time, requested pages, browser information, technical logs and the result of anti-spam analysis. | Operate the website, diagnose errors, prevent abusive access and protect forms and systems. | ICSS’s legitimate interest in securing its website and communications. |
ICSS does not use data collected through the website for automated marketing or newsletters. Personal data is not sold or rented to third parties.
Source of the data
Data is generally provided directly by the individual concerned. When an enquiry is made on behalf of a company or end customer, ICSS may also receive a contact person’s details from their employer, customer, colleague or a partner involved in the project. The individual will then be informed no later than the first contact.
Required and optional information
Required fields are identified in each form. Without this information, ICSS cannot receive the request or prepare a quotation. Other fields and attachments are optional. Users should include only the information required in a message or attachment and should not send sensitive personal data without prior agreement.
The shop is a quotation-request facility and not an online payment service. ICSS does not collect payment-card data. If an offer is subsequently accepted, payment is made by bank transfer; information relating to the transfer is then processed by the relevant banks and in ICSS’s accounting records.
Recipients of the data
To the extent required for their respective duties, data may be accessed by or disclosed to:
- authorised persons within ICSS;
- the website host, , and the email or technical-maintenance providers used by ICSS;
- Google for reCAPTCHA anti-spam protection, for loading the Open Sans font and, on the relevant pages, for displaying Google Maps;
- banks, accountants, carriers and other necessary service providers when an offer is accepted;
- the end customer, employer or project partners where the request is made in that context;
- public authorities, courts or advisers where required by law or necessary to defend ICSS’s rights.
Transfers outside the European Economic Area
The website and its principal data are hosted in Finland, within the European Economic Area, on infrastructure supplied by Hetzner Online GmbH. However, the use of Google reCAPTCHA, Google Fonts and Google Maps may result in data being processed outside the European Economic Area. Such processing is subject to the mechanisms and safeguards described in Google’s Privacy Policy . Users may contact ICSS for further information about the applicable safeguards.
Retention periods
| Data | Retention period or criterion |
|---|---|
| Contact or quotation requests not followed by a contract | Up to 3 years after the last relevant contact, unless erasure is requested or there is a particular need to retain evidence. |
| Quotations, orders, contractual correspondence, delivery and warranty | For the duration of the contractual relationship, then up to 5 years to establish or defend legal rights, subject to a different statutory period. |
| Invoices and accounting records | 10 years from the end of the relevant financial year. |
| User account | Until deletion at the user’s request or after 3 years of inactivity, except for data linked to a transaction that must be retained separately. |
| Technical and security logs | Normally up to 12 months, unless an incident justifies longer retention for the time required to resolve it. |
| Backups | Until overwritten in accordance with the backup rotation cycle, with access limited to restoration or security needs. |
Further information about cookies and their duration is provided in the Cookie Policy. Data processed directly by Google is retained in accordance with that provider’s own rules.
Data subject rights
Subject to the conditions laid down by law, individuals may request access to, rectification or erasure of their data, or restriction of its processing. They may object, on grounds relating to their particular situation, to processing based on legitimate interests and exercise the right to data portability where applicable. Where processing is based on consent, consent may be withdrawn at any time without affecting prior processing.
These rights may be exercised by post at the address stated above or by email to . Proof of identity may be requested where there is reasonable doubt as to the requester’s identity. ICSS will respond within the time limits laid down by applicable law.
If, after contacting ICSS, an individual considers that their rights have not been respected, they may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés: www.cnil.fr.
Automated security analysis
Google reCAPTCHA automatically assigns a risk indicator to interactions with forms in order to detect bots. This analysis may cause a submission considered abusive to be rejected, but it does not produce any legal or commercial decision concerning the individual. If difficulties arise, alternative contact details are provided in the Legal Notice.
Security
ICSS implements proportionate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure. These include encrypted communications with the website, access restrictions and software maintenance. As no system can guarantee absolute security, any confirmed incident will be handled in accordance with the applicable requirements.
Changes to this policy
ICSS may update this policy to reflect changes to the website, its processing activities or applicable law. The date shown at the top of the page identifies the current version.