Legal information

Privacy policy

Last updated: May 2026

This policy describes how I process your personal data when you use the nomacast.fr website or contact me with a quote request. I am committed to complying with the General Data Protection Regulation (GDPR) and the French Data Protection Act of 6 January 1978 as amended.

Participant in a live event broadcast by Nomacast?

This policy only covers the marketing site nomacast.fr. For live events broadcast via the Nomacast platform (chat, polls, quizzes, analytics), please refer to the live event platform privacy policy, which details Nomacast's role as processor and the role of your event organiser as data controller.

Data controller

Nomacast

Publication director: Jérôme Bouquillon

Email: [email protected]

Phone: +33 6 60 54 17 32

Full details on the legal notice page.

Data collected

I only collect data strictly necessary to handle your request. The following data may be collected via the quote calculator or contact form:

Email (required): to send you the proposal.
Phone (required): to discuss the technical details before quoting.
Name, first name, company (optional): to personalise the response.
Event details: date, location, duration, technical options, broadcast platforms, free message.
Partner code (optional): if you arrive via a partner agency.
IP address and origin: collected automatically by the form for security purposes (Cloudflare Turnstile anti-bot check, repeated submission limits). Retained for 60 seconds after submission.

No sensitive data (origin, opinions, health, etc.) is collected. No data is requested if you simply browse the site without submitting a form.

Processing purposes

Your data is used solely for:

Replying to your quote or information request.
Preparing a commercial proposal tailored to your event.
Managing the commercial relationship (exchanges, planning, invoicing).
Keeping a record of pre-contractual exchanges in case of dispute or to comply with a legal obligation (accounting).

No automated marketing or advertising profiling is carried out from this data.

Legal basis

Processing of your data is based on:

Performance of pre-contractual measures taken at your request (GDPR Article 6.1.b), for data submitted via the quote calculator.
My legitimate interest (GDPR Article 6.1.f) in keeping a record of the commercial relationship and responding to your subsequent requests.
Your consent (GDPR Article 6.1.a) for analytics cookies that are not strictly necessary.
Compliance with legal obligations (GDPR Article 6.1.c), including retention of accounting records.

Retention period

Quote requests with no follow-up: 3 years from last contact.
Client data (signed quotes, invoices): 10 years, in line with accounting obligations.
Analytics cookies: 13 months maximum.
Technical logs (Cloudflare servers): less than 24 hours for access logs, retained solely for security and anomaly detection purposes.
Anti-flood data (Cloudflare Workers KV): 60 seconds maximum after form submission, then automatic deletion.

Data recipients

Your data is accessible only by me, as the sole operator of Nomacast. No data is sold, transferred or rented to third parties for commercial purposes.

Some technical providers may, however, process your data on my behalf, as processors within the meaning of the GDPR:

Cloudflare Ireland Ltd. (Dublin, Ireland, GDPR subsidiary of Cloudflare, Inc.): website hosting (Cloudflare Pages, global edge with execution on the European datacenter closest to the visitor), video file storage (Cloudflare R2, European region), DNS management, form anti-bot protection (Turnstile), server-side form processing (Pages Functions) and temporary anti-spam storage (Workers KV). Compliance framed by the Cloudflare Data Processing Addendum and the Standard Contractual Clauses adopted by the European Commission for residual flows with the parent company Cloudflare, Inc. (United States).

Resend Inc. (United States): sending emails triggered by the contact form, from the technical address [email protected] to my professional inbox. Resend relies on Amazon SES (Ireland region, eu-west-1) for actual delivery. Transfers outside the EU are framed by the Standard Contractual Clauses.

Google Ireland Ltd.: Google Workspace for professional email ([email protected] and [email protected]), Google Tag Manager and Google Analytics 4 for audience measurement, Google Ads for advertising campaign performance measurement. Data may be transferred outside the EU under Google's Standard Contractual Clauses and Data Processing Addendum.

LWS (Ligne Web Services): domain name registrar for nomacast.fr only. No personal visitor or prospect data is processed by LWS.

Cookies and trackers

The site uses the following tools, triggered via Google Tag Manager:

Strictly necessary cookies: site operation, consent choice memorisation, contact form anti-bot protection (Cloudflare Turnstile, which may set a technical session identifier). No opt-in required.
Google Analytics 4: anonymised audience measurement, triggered only after your consent.
Google Ads: advertising campaign performance measurement, triggered only after your consent.

You can refuse or withdraw your consent to non-strictly-necessary cookies at any time via the dedicated banner, or by deleting cookies through your browser settings.

Transfers outside the European Union

Video files and technical site data are stored on Cloudflare's infrastructure in European regions (R2 EU), with Pages Functions processing performed on the European edge closest to the visitor. Emails from the form transit through Resend's servers (United States) and then Amazon SES in Ireland before reaching my Google Workspace inbox. Audience measurement data (Google Analytics, Google Ads) may transit through Google's servers and be transferred outside the EU. These residual transfers (Resend, Google) are framed by the Standard Contractual Clauses adopted by the European Commission and by the relevant processors' compliance policies (Google Data Processing Addendum, Cloudflare Data Processing Addendum, Resend Data Processing Addendum).

Security

The site is served over HTTPS (TLS encryption) via Cloudflare. Data submitted through the form is transmitted in encrypted form. The form is protected by several security mechanisms: Cloudflare Turnstile anti-bot check, invisible honeypot field, request origin verification, IP-based submission rate limiting, anti-spam filtering, and protection against mail header injection. Access to my Google Workspace professional inbox is protected by a strong password and two-factor authentication.

Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:

Right of access: obtain a copy of the data I hold about you.
Right to rectification: have inaccurate or incomplete data corrected.
Right to erasure ("right to be forgotten"): request the deletion of your data, subject to legal retention obligations.
Right to restriction of processing.
Right to object to processing based on legitimate interest.
Right to portability of your data in a structured format.
Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, write to me at [email protected] (Data Protection Officer) specifying the subject of your request. A response will be provided within one month, in accordance with Article 12 of the GDPR. Proof of identity may be requested in case of reasonable doubt.

For events broadcast via the Nomacast interactive platform, organisers also have an early erasure feature available for their own data or that of a participant on simple request, without waiting for the end of the retention period.

Data Protection Officer (DPO)

In accordance with Article 37 of the GDPR, Nomacast has appointed a Data Protection Officer (DPO), reachable for:

any question relating to the processing of your personal data;
the exercise of your rights (access, rectification, erasure, portability, objection);
any reporting of a security incident or data breach;
requests from competent authorities (CNIL, judicial authority).

DPO contact: [email protected]

Maximum response time: 30 days in accordance with Article 12 of the GDPR.

Lodging a complaint with the CNIL

If, after contacting me, you consider that your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL).

3 place de Fontenoy, TSA 80715

75334 Paris Cedex 07, France

www.cnil.fr/en/plaints

Changes

This policy may evolve to adapt to legal, technical or organisational developments. The date of the last update is shown at the top of the page. I encourage you to review it regularly.