Capsulecom Group
Data processing
register.
Record of processing activities maintained under GDPR Article 30.
Processing register maintained by Capsulecom Group under GDPR Article 30. Last updated: July 2026.
Data controller: Capsulecom Group, 250 rue Maryam Mirzakhani, 34000 Montpellier. contact@capsulecomgroup.com
| Processing | Purpose | Legal basis | Data categories | Recipients / processors | Retention | Transfer outside EU |
|---|---|---|---|---|---|---|
| 1. Contact enquiries /contact/ and /en-contact/ forms |
Respond to BPO, training and Nova XR requests; route to the right team | Legitimate interest / pre-contractual measures (Art. 6(1)(b) and (f) GDPR) | Identity, email, phone, company, need type, message, anti-spam metadata (IP, timestamp) | Capsulecom commercial teams; OVH (hosting, email); Cloudflare Turnstile (anti-bot) | 3 years after last exchange | Turnstile: possible (Cloudflare SCCs). Hosting: France (EU) |
| 2. Recruitment /nous-rejoindre/ application form |
Recruitment, profile review, HR contact | Pre-contractual measures (Art. 6(1)(b) GDPR) | Identity, contact details, role applied for, CV, optional cover letter, anti-spam metadata | Capsulecom HR teams; OVH (email, temporary attachment storage) | 2 years after last contact | No (France hosting). Turnstile: possible (SCCs) |
| 3. GA4 audience measurement Public website |
Traffic statistics and site improvement | Consent (Art. 6(1)(a) GDPR) | Pages viewed, traffic source, device/browser, anonymised cookie ID, anonymised IP | Google Ireland Ltd / Google LLC (GA4) | 14 months max. (analytics cookies) | Yes, United States (SCCs + Data Privacy Framework where applicable). Enabled only after consent. |
4. Language preferencecc_lang cookie |
Display the site in French or English according to user journey | Legitimate interest (Art. 6(1)(f) GDPR) | Language code (fr/en) | None (first-party cookie) | 12 months | No |
| 5. Analytics cookie choice localStorage capsulecom_cookie_consent |
Remember acceptance or refusal of audience measurement cookies | Consent / legitimate interest (Art. 6(1)(a) and (f) GDPR) | Value “accepted” or “rejected” | None (browser local storage) | Until changed or cleared by the user | No |
| 6. Security and anti-spam Logs, Turnstile, rate limiting |
Protect the site, detect abuse, log incidents (login, form submission) | Legitimate interest (Art. 6(1)(f) GDPR) | IP address, user-agent, timestamp, country (if Cloudflare), security/mail events | OVH (server logs); Cloudflare Turnstile; internal capsulecom-mail.log (web access blocked) |
12 months maximum | Turnstile: possible (SCCs). Hosting logs: France (EU) |
| 7. Nova Academy complaints /reclamations/ page |
Handle complaints related to training services | Legal obligation / contract performance (Art. 6(1)(b) and (c) GDPR) | Identity, contact details, complaint content, related correspondence | Nova Academy quality teams; OVH (email) | File duration + 3 years | No (France) |
| 8. Disability accessibility /accessibilite-handicap/ page |
Handle reasonable adjustment requests for people with disabilities | Legal obligation / contract performance (Art. 6(1)(b) and (c) GDPR) | Identity, contact details, description of adjustment needs | Nova Academy pedagogical teams; partners (AGEFIPH/Cap Emploi) if required; OVH | 3 years after file closure | No (France) |
Common security measures
- HTTPS/TLS encryption, restricted admin access (geo-block, rate limit, optional IP allowlist)
- OVH hosting in France, backups, internal access segregation
- Anti-spam (honeypot, minimum delay, Turnstile), log files not web-accessible
- GA4 with IP anonymisation and deferred loading after consent
See also our Privacy policy.