Legal information
Privacy Policy
Last updated: 20 October 2026
This English version is provided for information purposes only. In the event of any discrepancy, the French version shall prevail.
ShiftUrBrain attaches particular importance to the protection of personal data and to the confidentiality of the information entrusted to it.
This policy explains how personal data collected on shifturbrain.com and in the course of our business relationships is processed. It also sets out our approach to the confidentiality of client projects.
1. Data Controller
For processing relating to its website and to the management of its business relationships, the data controller is:
SHIFTURBRAIN, a single-member limited liability company (entreprise unipersonnelle à responsabilité limitée), represented by its Manager (gérant), Saïd LAOUI.
- Address
- Les Argonautes, 50 avenue Denis Padovani, 13127 Vitrolles, France.
- Contact for personal data matters
- contact@shifturbrain.com
2. Personal Data Concerned
Depending on your interactions with ShiftUrBrain, the data processed may include:
- your surname, first name, job title and company;
- your email address and telephone number;
- the content of your messages and the information you provide about your needs;
- the information required to arrange a meeting;
- the data required to prepare a proposal, perform a service and issue invoices;
- technical data relating to the use and security of the website, in particular the IP address, the date and time of connection and the events recorded in technical logs.
Mandatory fields are indicated at the time of collection. Without this information, we may be unable to respond to your request or to provide the service requested.
We invite you to limit the information you provide to what is strictly necessary and not to send, via the contact form, any sensitive data or confidential documents concerning third parties.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Responding to messages and arranging business exchanges | Legitimate interest in responding to requests and managing business relationships |
| Preparing a proposal and performing a service | Steps taken prior to entering into a contract, or performance of the contract, where the data subject is a party to it; legitimate interest in respect of the contact persons of a client company |
| Business follow-up relating to your professional activity | Legitimate interest, subject to your right to object |
| Ensuring the operation, maintenance and security of the website | Legitimate interest in maintaining an available and secure service |
| Complying with accounting and legal obligations | Legal obligation |
| Using cookies or trackers that require consent | Prior consent |
You may object to direct marketing at any time by writing to contact@shifturbrain.com.
4. Recipients and Service Providers
The data is accessible to Saïd LAOUI and only to those service providers whose involvement is necessary for the purposes set out in this policy, within the limits of their respective assignments.
Hosting and contact form
The website is hosted by Netlify, Inc. The contact form also relies on Netlify’s services.
Information submitted through the form is therefore received and stored by Netlify so that it can be accessed and processed by ShiftUrBrain.
- Website
- www.netlify.com
- Privacy policy
- www.netlify.com/privacy
Depending on the service used, email, appointment-booking or maintenance service providers may also be involved.
Data may be disclosed to the competent authorities where required by law.
ShiftUrBrain does not sell your personal data.
5. Data Location and International Transfers
The use of Netlify and, where applicable, of other service providers may involve the processing of data outside the European Economic Area (EEA), in particular in the United States.
Netlify’s Data Processing Agreement provides for mechanisms governing international transfers, including the EU–US Data Privacy Framework where applicable and, failing that, the Standard Contractual Clauses adopted by the European Commission.
This agreement is available at the following address: Netlify Data Processing Agreement.
For other service providers, any transfer of personal data outside the EEA must be governed by a transfer mechanism provided for by the applicable regulations and, where necessary, by appropriate supplementary measures.
You may obtain information on the applicable safeguards by writing to contact@shifturbrain.com.
6. Retention Periods
Data is retained for a period appropriate to its use.
| Category of data | Retention period |
|---|---|
| Information requests not followed by any business relationship | The period required to handle and follow up the request |
| Prospect data used for business follow-up | A maximum of three years from collection or from the last contact initiated by the prospect |
| Data required to perform services | The term of the contractual relationship, followed by archiving limited to the information required to meet legal obligations and to establish, exercise or defend legal claims |
| Contracts and business correspondence subject to retention requirements | Five years, depending on the nature of the document and the applicable statutory starting point |
| Invoices and accounting records | Ten years from the end of the financial year concerned |
| Technical and security logs | A maximum of three years from the date of recording, where this period is necessary and justified by a documented risk assessment; a shorter period applies in all other cases |
| Data processed on behalf of a client in the course of a project | The period set out in the contractual documents and in accordance with the client’s instructions |
Access to archived data is restricted.
Upon expiry of the applicable periods, data is deleted or anonymised, unless a legal obligation or ongoing proceedings justify its retention.
7. Confidentiality of Projects and Use of Artificial Intelligence
An architecture tailored to each project
Hosting and processing choices are determined according to the nature of the project, its objectives, the sensitivity of the information and the client’s confidentiality requirements.
Depending on these requirements, ShiftUrBrain may offer local hosting and the use of artificial intelligence models run in a controlled environment, without any transmission of project data to the online services of large language model (“LLM”) providers.
Installation on the client’s servers
Where a solution is installed and run entirely on the client’s servers, without any connection to an external processing service, the data remains within the client’s environment.
Such an installation does not, in itself, involve any transfer of data to ShiftUrBrain’s servers or to an LLM provider.
Any access required for deployment, support or maintenance is defined contractually and limited to what is necessary for the intervention.
Use of an external service and anonymisation
Where a project requires data to be sent from the client’s or ShiftUrBrain’s environment to an external service, the service providers, data flows and confidentiality measures are agreed with the client before implementation.
Only the information necessary for the processing is transmitted. Where identifying individuals is not necessary and the processing allows it, the data is anonymised beforehand, after the effectiveness of the method has been verified. Confidential information is removed or protected in accordance with the project’s requirements.
Merely deleting names or replacing them with identifiers does not necessarily amount to anonymisation. Where individuals remain identifiable, in particular in the case of pseudonymisation, the data remains subject to the rules on personal data protection.
Contractual framework for services
Where ShiftUrBrain processes personal data on behalf of a client as a processor, the terms of processing are governed by an agreement complying with Article 28 of the General Data Protection Regulation (GDPR).
This agreement sets out, in particular, the client’s instructions, the authorised persons, the security measures, any sub-processors and the arrangements for returning or deleting the data at the end of the service.
8. Data Security
ShiftUrBrain implements technical and organisational measures appropriate to the nature of the data and to the risks associated with the processing.
These measures are designed to protect data against unauthorised access, disclosure, alteration, loss or destruction.
Access to information is restricted to those persons who need it to perform their duties, in compliance with their confidentiality obligations.
9. Cookies and Other Trackers
Cookies that are strictly necessary for the operation of a service you have requested may be used without prior consent where they meet the conditions for exemption laid down by the applicable regulations.
Other cookies and trackers that are subject to consent, in particular certain advertising or audience measurement tools, require your prior consent.
Where consent is requested, you must be able to give, refuse and withdraw your consent with the same ease.
At present, the shifturbrain.com website does not place any cookies and does not use any trackers: no audience measurement tool, no advertising and no embedded social media content. For this reason, no consent banner is displayed. External services accessed from the website, such as the appointment-booking page or LinkedIn, may use their own cookies in accordance with their respective policies.
10. Your Rights
Under the conditions laid down by the applicable regulations, you have the right to:
- access your data and obtain a copy of it;
- request the rectification of inaccurate information;
- request the erasure of your data or the restriction of its processing;
- object, on grounds relating to your particular situation, to processing based on legitimate interests;
- object at any time to direct marketing;
- request the portability of your data, where this right applies;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
You may exercise your rights:
- By email
- contact@shifturbrain.com
- By post
- SHIFTURBRAIN — Les Argonautes, 50 avenue Denis Padovani, 13127 Vitrolles, France.
Additional information to verify your identity may be requested where there are reasonable doubts, to the extent necessary.
A response will be provided within one month of receipt of the request. This period may be extended by two further months, taking into account the complexity or number of requests. In that case, you will be informed within the first month.
You may also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): www.cnil.fr.
11. External Services and Links
The website may provide links to third-party services, in particular social networks or appointment-booking tools.
Processing carried out by these services for their own purposes is governed by their respective privacy policies.
12. Updates to this Policy
This policy may be amended to reflect changes to the website, the services, the tools used or the applicable regulations.
The date of the latest update is shown at the top of this page.