PRIVACY POLICY

Horizon Factory, SAS, 6 rue d'Armaillé, 75017 Paris, France — RCS Paris 103 582 797

Represented by Dac-An Vo, President

For any question about your data: contact@horizonfactory.fr

We only collect what we need, in four cases:

• Contact form and masterclass request: your name, your email, your company and phone number if you give them, the reason, the chosen topic and the message of your request. They are stored on our server and sent to us by email, to reply and prepare a quote (steps taken at your request before a contract).
• Guide download: your email address, the website language, the date of the request and where your visit came from (referring site, campaign, landing page), to give you access to the guide and, where relevant, to follow up about our services (legitimate interest; you can object at any time).
• Event waiting lists and sign-ups (Apéréseaux, Escalapreneurs): your name, your email, your company, the site language and the sign-up date. They are stored on our server and sent to us by email, to let you know when registration opens and to send you the practical details of the event (place, time). Legal basis: your sign-up request. We use them for nothing else. Apéréseaux registration takes place on Luma, whose widget is embedded in the Events page: the information you enter there (name, email, form answers) is collected by Luma, which passes it on to us as the organiser for the same purposes. Luma also processes it for its own service, under its privacy policy (luma.com/privacy-policy).
• Clients: the data needed to deliver and invoice our services (performance of the contract and legal obligations).

We never sell or rent your data, and no automated decision is made from it. We never pass your name, email or phone number to Google or any other ad network.

We measure traffic with two tools:

Umami, which we host ourselves, runs for every visitor. It sets no cookies, does not keep your IP address and cannot identify you: it only produces aggregate statistics (pages viewed, referrer, country, device type).

Only if you accept audience measurement, Umami also records how your visit unfolds (scrolling, clicks, pages viewed) to help us improve the site. Form fields are excluded and these recordings are not linked to any identity.

Google Analytics 4, provided by Google, only loads if you accept it in the cookie banner. It gives us more detailed statistics on how the site is used. If you decline, nothing is sent to Google.

If you reach the site through a personal link, received in a message we sent you (email or LinkedIn), we record that visit and the pages viewed and attach them to your name, so that we can follow up with you. This rests on our legitimate interest in following our business conversations, it runs on a tool we operate ourselves, and nothing is stored on your device without your consent. You can object at any time by writing to us.

Only if you accept audience measurement: that personal link is kept in a cookie so we recognise you on a later visit, and, if you did not come through such a link, we look up the name of the organisation your connection belongs to (never a person's). Your IP address is used for that lookup and is not kept.

Only if you accept advertising in the cookie banner (legal basis: your consent), the Google Ads tag, provided by Google, tells Google that you arrived through one of our ads and whether you then contacted us (contact form sent, meeting booked, click on our phone number or on our email address), without your name, email or phone number. Google may use this information to measure and personalise its ads, as it explains at policies.google.com/technologies/partner-sites. If you decline, nothing is sent to Google Ads.

Only if you accept advertising in the cookie banner (legal basis: your consent), the Meta pixel, provided by Meta Platforms Ireland, tells Meta which pages you view and whether you contacted us (contact form sent, meeting booked, click on our phone number or on our email address), without your name, email or phone number. Meta may use this information to measure and personalise its ads on Facebook and Instagram, as it explains at facebook.com/privacy/policy. Horizon Factory and Meta are joint controllers for collecting and transmitting this data; Meta alone is responsible for how it uses it afterwards. If you decline, nothing is sent to Meta.

The website uses:

• Your cookie choice, saved in your browser's local storage until you change it.
• A technical “guide_access” cookie, valid for 10 minutes, that allows the guide download once you have entered your email.
• A language cookie that remembers the French or English version of the site.
• On the Events page, the Luma registration widget: it sets security cookies from Cloudflare, Luma's provider (“cf_clearance”, kept for 1 year at most, and “__cf_bm”, 30 minutes), used only to block bots. If you register, Luma may set its own cookies, governed by its privacy policy.
• Only if you accept them: Google Analytics cookies (“_ga” and “_ga_*”), kept for 13 months at most.
• Only if you accept advertising: Google Ads cookies (“_gcl_*”), kept for 90 days at most, and those Google sets on its own domains to measure its ads.
• Only if you accept advertising: Meta pixel cookies (“_fbp” and “_fbc”), kept for 90 days at most, and those Meta sets on its own domains to measure its ads.
• Only if you accept YouTube videos in the banner: YouTube (Google) cookies, set only when you play one of our videos.
• Only if you accept audience measurement: where your visit came from (referring site, campaign, landing page), kept in your browser's local storage so it can be attached to your email if you download the guide later.
• Only if you accept audience measurement: a “_jr” cookie, kept for 90 days, which remembers the personal link you arrived through from one of our messages.

The first four are needed for the site to work and do not require your consent. You can accept or decline the others, and change your mind at any time, with the “Manage cookies” link in the footer.

We keep your data:

• Prospects (contact, guide download or event sign-up): 3 years after our last exchange.
• Clients: for the duration of the contract, then 5 years (limitation period).
• Accounting records and invoices: 10 years (legal obligation).

Your data is only accessible to:

• The Horizon Factory team handling your request or project.
• Our host Hostinger, which stores the website and its data on servers located in France.
• Brevo (Sendinblue SAS, France), which emails us the requests sent through the contact form.
• Google, which provides our email (Google Workspace), where these emails arrive, as well as Google Analytics and Google Ads if you accept them.
• Meta (Meta Platforms Ireland), which runs Facebook and Instagram, for the Meta pixel if you accept advertising.
• Luma (Luma Labs, Inc., United States), which handles Apéréseaux registrations. When the Events page is displayed, its widget also sends your IP address and technical details about your browser to Luma and its providers: Cloudflare (security), Adobe Fonts (fonts) and Sentry (error tracking).
• Public authorities, where required by law.

Google, Meta, Luma and Luma's providers may process some data in the United States. These transfers are covered by the EU–US Data Privacy Framework for the companies that have joined it and, failing that, by the European Commission's standard contractual clauses. No other data leaves the European Union.

The website is served over HTTPS only. Access to data is restricted to the people who need it and protected by authentication, and databases are backed up regularly.

Under the GDPR and the French Data Protection Act, you have the right to:

• Access your data and obtain a copy
• Have it corrected or erased
• Object to its processing, including any marketing
• Request restriction of processing or data portability
• Set instructions for what happens to your data after your death

Write to us at contact@horizonfactory.fr: we reply within one month. If you are not satisfied with our answer, you can lodge a complaint with the CNIL (www.cnil.fr).

We update this policy when our processing changes. The date of the last update is shown below.

Last updated: 10 November 2026