Privacy

1. Data controller

GlobeNews SAS
French simplified joint-stock company with share capital of €500.00
Rennes Trade and Companies Register 994 540 821
Registered office: 2 Allée de Champalaune, 35740 Pacé, France
Contact: [email protected]

2. Data collected and purposes

The website lexanon.fr and Lexanon software collect a limited amount of personal data for the following purposes:

a) Contact form
Data: name, email address, subject (optional) and message.
Purpose: responding to your request.
Legal basis: legitimate interests (GDPR Article 6(1)(f)).
Retention period: 12 months from receipt of the message, then deletion.

b) Licence purchase and payment
Data: email address, licence key, selected plan and machine identifier on activation. Banking data is processed exclusively by Stripe and does not pass through our servers.
Purpose: performing the licence agreement, activating the software and delivering updates.
Legal basis: performance of a contract (GDPR Article 6(1)(b)).
Retention period: licence duration plus 3 years (statutory accounting retention obligations). This data is stored in a Cloudflare D1 database.

c) Technical logs
Data: IP address, connection date and time, pages visited and user agent.
Purpose: security, fraud prevention and anonymous statistics.
Legal basis: legitimate interests (GDPR Article 6(1)(f)).
Retention period: Up to 13 months.

d) Lexanon software (local processing)
Lexanon processes documents exclusively on the user's computer. No document, personal data within processed documents or mapping table is transmitted to GlobeNews SAS or a third party.

3. Cookies and trackers

The lexanon.fr website uses no advertising cookies and and no third-party audience measurement trackers (Google Analytics and equivalent services have been removed).

Traffic on the public website is measured solely through the host's aggregated technical logs (Cloudflare), without individual profiling or linkage to the purchase flow.

Cookies and trackers present:

  • Cloudflare cookies (e.g. __cf_bm): anti-DDoS protection, automatically set by the hosting infrastructure.
  • checkout_ref : a 90-minute technical cookie set during payment to secure the return from Stripe. HttpOnly, Secure.

Cookies strictly necessary for website operation remain exempt from consent under Article 82 of the French Data Protection Act.

No external fonts are loaded: fonts are hosted locally on our servers.

The conversion flow (/offres/, customer area and payment) loads no audience measurement script, in line with Lexanon's commitment to digital sovereignty.

4. Recipients and processors

Personal data may be shared with the following processors, strictly for the purposes described:

  • Cloudflare, Inc. (United States): website and serverless function hosting (Cloudflare Pages). Cloudflare Privacy Policy
  • Stripe, Inc. (United States): payment processing. Stripe acts as an independent controller for payment data. Stripe Privacy Policy
  • Resend, Inc. (United States): transactional emails (contact and licence). Resend Privacy Policy

5. Transfers outside the European Union

Some processors—Cloudflare, Stripe and Resend—are based in the United States. These transfers are governed by:

  • The EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), where the processor is certified;
  • European Commission Standard Contractual Clauses (SCCs), where applicable.

6. Your rights

Under GDPR Articles 15 to 22 and the French Data Protection Act, you have the following rights:

  • Right of access : obtain confirmation that your data is processed and receive a copy.
  • Right to rectification : have inaccurate or incomplete data corrected.
  • Right to erasure : request deletion of your data, subject to legal obligations.
  • Right to restriction : request that processing be restricted in cases provided for by the GDPR.
  • Right to data portability : receive your data in a structured, machine-readable format.
  • Right to object : object to processing based on legitimate interests.

To exercise your rights, contact us at: [email protected]

We undertake to respond within one month of receiving your request. For complex requests, this may be extended by two months, provided you are informed.

7. Complaints to the CNIL

If you believe processing of your personal data breaches the GDPR, you may lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL):

CNIL
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07
www.cnil.fr

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including:

  • TLS encryption (HTTPS) throughout the website
  • Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
  • Rate limiting for forms and APIs
  • 100% local processing of legal documents (no network transfer)

9. Changes

This policy may be updated. Material changes will be announced on this page with a new update date. Please consult it regularly.