Data controller
SAS STOCK CO2, 3 Boulevard de Sébastopol, 75001 Paris, France
Email: contact@stock-co2.fr
This site is available in French and English; this policy applies to both versions.
The data we collect, and why
We only collect what each use requires. The table below lists each category of person concerned, the corresponding data, why we process it and its legal basis.
| Who | Data | Why | Legal basis |
|---|---|---|---|
| Contact form visitor | Name, email, phone, company, sector, company size, message | Reply to your request, suggest a suitable project | Consent (form checkbox) |
| Company sending us a request (contact, demo, quote, questionnaire) — only if you accepted advertising campaign measurement | Advertising source of the click that brought you here: Google Ads click identifier (gclid, gbraid, wbraid), campaign utm parameters, arrival date | Know which campaign brought your request; tell Google Ads that a click led to a signed agreement (click identifier, date and amount, no name or email) | Consent (banner) |
| Project holder (“Be contacted” request from the eligibility simulator on /forestiers, /agricoles and /proposer-projet; “Submit a project” form) | Name, email, phone, organisation, municipality and département, optional message, simulator answers (project type, area, situation of the plot or farm, planned practices) and calculated result | Contact you and study your project with you; send you your project summary (a single email, with its PDF, without any newsletter subscription); notify our team of your request | Consent (form checkbox) |
| Eligibility simulations completed up to the result, with or without a contact request | No personal data: only totals per day, simulator, project type, method(s), result, area band, département and language. No name, contact details, IP address, cookie or identifier; never linked to a contact request | Measure the real interest in our simulators | Legitimate interest (anonymous statistics) |
| Newsletter subscriber | Send you our updates | Consent (unticked checkbox) | |
| Client (main contact, space collaborators) | Name, work email, job title, phone, login credentials (hashed password) | Manage your account and client area | Performance of the contract |
| Client employee taking a quiz | Email, company, quiz answers, score, duration | Run your employer's awareness campaign | Consent |
| Client employee voting | Email, vote choice (encrypted, unreadable even by us) | Run the vote, prevent the same person voting twice | Consent |
| Tree sponsor | First name, email, company if applicable | Issue your sponsorship certificate | Consent |
| Any site visitor — only after consent | Visit identifier (cookie), IP address turned into a fingerprint, pages viewed, referrer | Measure audience, identify high-interest visitors | Consent — details in our cookie policy |
| Any site visitor — anonymous audience measurement, without cookies | Page viewed (without parameters), domain of the referring site, utm_source, device type. The IP address and browser are only used to compute a short-lived digest linking the pages of one visit: it changes every day, is erased every day, and is never kept with the statistics | Produce anonymous, aggregated traffic statistics (visits, page views, referrers) for Stock CO2 only, never combined with any other processing | Legitimate interest; audience-measurement tracker exempt from consent (Article 82 of the French Data Protection Act, CNIL deliberation 2020-091) — you can object: Do not count me |
We do not fingerprint your device (screen resolution, installed fonts, graphics rendering combined to recognise you without a cookie): this technique has been removed from the site.
Retention period
| Data category | Duration |
|---|---|
| Prospects, contact-form messages and eligibility simulations with no follow-up | Reviewed for deletion after 12 months with no exchange |
| Newsletter subscribers | Until unsubscription |
| Client area accounts (main contact, collaborators) | Duration of the contractual relationship |
| Invoices and accounting records | 10 years after the end of the financial year (legal obligation) |
| Contracts and proof of signature | 5 years after the end of the contract |
| Awareness quiz answers | Duration of the campaign, then deletion within 24 months |
| Vote ballots | Until the campaign closes, plus 12 months as a safeguard against a second vote |
| Sponsorships | 3 years |
| Audience measurement (visit identifier, converted IP, pages viewed) | 13 months maximum (CNIL-recommended ceiling) |
| Anonymous audience measurement (aggregated statistics, no cookies) | 25 months at most; the visit digest is erased every day; the "Do not count me" refusal cookie lasts 13 months |
| Advertising source of the click (gclid, utm) | 90 days in your browser, erased if you refuse advertising campaign measurement; then kept with your request, for as long as the request |
| Completed eligibility simulations (anonymous totals, no contact details) | 25 months at most |
| Client area activity log | 13 months |
Who receives your data
Your data is first processed by the Stock CO2 team. Some technical service providers have access to it so we can run the site and our services. Here is the full list.
| Provider | What it receives | Role | Hosting |
|---|---|---|---|
| Vercel | All site traffic; stored documents and photos | Site and file hosting | US company, processing runs in Europe (Paris region) |
| MongoDB Atlas | All database data (accounts, contacts, responses, documents) | Database | Cluster region being confirmed |
| Resend | Name, email, phone, message from forms, eligibility simulator summaries; internal alerts on identified visitors | Sending our emails (confirmations, notifications, alerts) | United States |
| Google (Analytics, via Google Tag Manager) | IP address, browser type, pages viewed, analytics identifier — only after consent | Audience measurement | United States |
| Google Drive | Photos and documents from project folders (read-only service account) | Syncing project files | United States |
| Upstash | IP address turned into a fingerprint | Preventing bulk form submissions from the same address | Region being confirmed |
| Wispra | IP address, browser type, pages viewed — only after consent | Measuring the site's presence in generative AI answers | France |
| Third-party map tiles (e.g. CARTO, Esri) | IP address and browser type, only on pages with a map | Displaying project maps | International |
We do not use any online payment method today: no bank data is collected on the site. This policy will be updated before any new provider goes live, in particular an e-signature or payment tool.
We never call Google Fonts when your pages render: fonts are bundled into the site at build time, so your IP address is not sent to Google for this purpose.
Transfers outside the European Union
Several providers above are based in the United States. Where a provider is certified under the Data Privacy Framework (DPF, the EU–US arrangement recognised by the European Commission), the transfer relies on that certification. Otherwise, it relies on the European Commission's standard contractual clauses. Each provider's actual certification status is being verified.
Security
Each account only sees its own data: one client cannot see another client's data. Passwords are stored hashed, never in plain text. A vote choice is encrypted: no one, including Stock CO2, can read it in the interface or in an export — this is not, strictly speaking, an anonymous vote, since the database technically allows tracing who voted. Documents (contracts, invoices, reports) are transmitted over an encrypted connection (HTTPS) and are never cached for another client's use. Access to our database is restricted to our team.
Your rights
You have the right to access, rectify, delete, restrict, port and object to the processing of your personal data. To exercise it, write to contact@stock-co2.fr or by post to STOCK CO2, 3 Boulevard de Sébastopol, 75001 Paris, stating your request and the email address concerned. We reply within one month, extended to two months for complex requests (a piece of data can sit in several of our tools, which requires a manual search).
For cookies and audience measurement, you can withdraw your consent at any time via the "Manage cookies" link at the bottom of each page.
The anonymous audience measurement, which places no cookie and requires no consent, can be refused at any time in one click: Do not count me. This link places a cookie that remembers your refusal for 13 months; no page you view from this browser is counted any more.
Complaint
If our response does not satisfy you, you can lodge a complaint with the CNIL: https://www.cnil.fr/en/complaints