Privacy policy

The data controller is SusInnoS, a deeptech project in maturation built on research from the G-SCOP laboratory and led by Christian Wandji Wouapi, Grenoble INP-UGA.

Contact: christian.wandji-wouapi@grenoble-inp.fr, +33 (0)7 87 25 42 79. Contact address: Grenoble INP-UGA, 46 avenue Félix Viallet, 38031 Grenoble Cedex 1, France.

• Contact form: first and last name, company, email address, optional phone number, topic of interest, callback preference and optional message.
• Security: technical information strictly required to limit automated submissions and protect the service. IP and email addresses are converted into irreversible fingerprints for rate limiting.
• Preferences: the language selected to display the French or English version of the site.
• Private administration: the authorised administrator’s account ID is used only to secure access to enquiries and news publishing.

Please do not include sensitive personal data in the free-text message field.

• Replying to your enquiry, arranging a demonstration or calling you back: steps taken at your request before a possible contract and SusInnoS’s legitimate interest in answering professional enquiries.
• Securing the site, preventing abuse and keeping evidence of your request: SusInnoS’s legitimate interest in protecting the service and its users.
• Meeting applicable legal obligations and responding to competent authorities: legal obligation where applicable.

Fields marked with an asterisk are required to handle your enquiry. Without them, SusInnoS cannot reply. No automated decision with legal effect is made, and your contact details are neither sold nor used for automated marketing.

Data is available only to authorised SusInnoS team members and the technical providers needed to operate the service:

• OpenAI Ireland Ltd / ChatGPT Sites, for hosting, maintenance and site data storage;
• Cloudflare, as an infrastructure, delivery and security provider used by the hosting platform;
• Resend (Plus Five Five, Inc.), solely to notify the team of a new enquiry. The notification includes identity, company, reply address, area of interest and callback preference, but not the free-text message.

Data is not shared with commercial partners.

Site data is hosted through ChatGPT Sites. For users in the European Economic Area, processing is governed by OpenAI Ireland Ltd acting as processor. Where data is transferred outside the EEA, OpenAI states that it relies on an adequacy decision or the European Commission’s Standard Contractual Clauses. See the ChatGPT Sites Data Processing Addendum.

Resend states that notification data is stored in the United States and that transfers are governed by its GDPR DPA and the EU-US Data Privacy Framework. SusInnoS therefore does not claim that all data is stored exclusively within the European Union.

• Contact enquiries and related follow-up: no more than three years after the latest exchange or update, unless a legal obligation or ongoing dispute requires otherwise. The site automatically removes records that have been inactive beyond this period.
• Anti-abuse rate-limit records: a short security window, then deletion.
• Language preference: twelve months, renewed when you choose a language.
• Hosting logs: for the periods required by the hosting platform for security, diagnostics and legal obligations.

You may request access, rectification, erasure or restriction of your data, or object to processing based on legitimate interests. You may also request portability where its legal conditions apply.

To exercise your rights, email christian.wandji-wouapi@grenoble-inp.fr. Proof of identity may be requested only where there is reasonable doubt about your identity. SusInnoS will answer within the time limits set by the GDPR.

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the CNIL or your local supervisory authority.

SusInnoS applies measures proportionate to the risks, including restricted administrator access, encrypted communications, input validation, submission rate limiting, no execution of form-supplied HTML and deletion of expired records. This policy will be updated if purposes, providers or the legal framework change.