Last Updated: May 13, 2026
This privacy policy is intended to explain to you, in accordance with the General Data Protection Regulation (GDPR), why the company BOURBON TECH (hereinafter "CAPSTON AI") processes your personal data, how it is processed, what rights you have over your data, and how to exercise them.
We may amend this policy at any time and invite you to review it regularly.
CAPSTON AI processes the personal data of:
We collect the following data:
Data collected during your navigation on the site is optional. Data collected during the implementation or application of the contractual relationship is necessary to perform the ordered services.
CAPSTON AI collects your personal data to fulfil the purposes described above. Each of these purposes is based on a legal basis authorising CAPSTON AI to process data.
| Purposes | Legal Basis |
|---|---|
| Management of contact requests on the website | CAPSTON AI's legitimate interests include responding quickly and efficiently to your questions, requests, and concerns. |
| Commercial communication by email | Your consent for all email and SMS prospecting. |
| Preparation of commercial proposals, Management of the chosen package, Management of the commercial relationship | The performance of contractual relations with CAPSTON AI. |
| Creation and management of user accounts on the CAPSTON AI platform | The performance of contractual relations with CAPSTON AI. |
| Management of customer accounts, accounting, and tax obligations | Compliance with a legal obligation to which CAPSTON AI is subject (Articles L123-12 and L123-22 of the French Commercial Code). |
| Establishment of financial statistics concerning customers | The legitimate interests of CAPSTON AI. These financial statistics help us identify consumption trends and adjust our offerings to meet our customers' needs. |
| Conduct of satisfaction surveys | Your consent regarding satisfaction surveys. |
| Management of complaints and after-sales service | The performance of contractual relations with CAPSTON AI. |
| Management of people's opinions on products, services or content | The legitimate interests of CAPSTON AI. Analysing feedback allows us to improve our products and services to ensure customer satisfaction. |
| Management of data breaches (leakage or loss of information involving personal data) | Compliance with a legal obligation incumbent upon CAPSTON AI under the GDPR, namely the identification of individuals likely to be affected by a data breach to inform them of the breach, as required by the GDPR. |
| Management of the relationship with our suppliers | CAPSTON AI's legitimate interests include managing its supplier base, streamlining supplier relationships, and ensuring the proper functioning of its operations. |
| Management of GDPR rights | Compliance with a legal obligation incumbent upon CAPSTON AI, namely verifying the identity of the person exercising a right recognised by the GDPR (access, rectification, opposition, etc.), exchanging with them to confirm the conditions for exercising the right, and responding to their request. |
| Management of cookies and other trackers | CAPSTON AI's legitimate interests in processing personal data related to cookies are strictly necessary for the proper functioning of the website. Your prior consent, regarding the deposit of other cookies and trackers placed during your navigation on our website (audience measurement, chat). To learn more, click on the icon to reopen our cookie management solution. |
In general, we do not process any of your data for purposes incompatible with those for which it was collected, unless you have given your prior consent.
We collect and process:
Within the limits of their respective attributions and based on the need-to-know principle, the following may have access to your personal data:
We undertake to sign with each of our subcontractors clauses compliant with Article 28 of the GDPR, specifying their obligations regarding the security and confidentiality of your data.
Where applicable, your data may also be sent to the following recipients:
We use certain subcontractors under terms that result in data transfers outside the European Union, particularly to the United States (e.g., the Google Analytics audience measurement solution).
If your data were to be transferred outside the EU, particularly through our subcontractors, we ensure they process your data in strict compliance with applicable personal data protection regulations.
In cases where they are located in a country not subject to an adequacy decision by the European Commission, which recognises a level of protection equivalent to that provided by the European Union, the data transfer will be governed by the European Commission's Standard Contractual Clauses (SCCs).
We also ensure the implementation of additional measures required by European DPAs (Data Protection Authorities) to govern data transfers to a State that does not provide an adequate level of protection, specifically for transfers to the United States.
For your information, three types of cumulative additional measures can be implemented:
We keep your personal data for the period strictly necessary to achieve the purposes referred to in point 1 herein, plus the statutory limitation periods.
| Purpose | Retention Period |
|---|---|
| Contract Management | Duration of the contractual relationship. |
| Customer Account Accounting | Ten (10) years. |
| Establishment of financial statistics concerning customers | Duration necessary for achieving the objective of the statistics or until the exercise of the right to object. |
| Management of complaints and after-sales service | Duration of the contractual relationship. |
| Conduct of commercial prospecting actions (B2B/B2C) | Until consent is withdrawn or 3 years from the last active contact for prospects/leads. |
| Management of contact requests (General Support) | 1 year from the processing of the request (distinct from commercial prospecting). |
| Management of data breaches | Data related to a personal data breach notification is kept for ten (10) years from the closing of the file. |
| Management of GDPR rights | Processed data is retained during the review of your request and then archived for five (5) years in accordance with current limitation periods. Identity documents will be retained for one (1) year. In case of objection to commercial prospecting, the data will be kept for a minimum period of three (3) years solely to ensure the effectiveness of your right to object. |
| Management of cookies and other trackers | Cookies: 13 months maximum lifespan on the user's device. Collected Data: Retained for a maximum of 25 months. |
In application and within the limits of their conditions of application, you have the following rights:
| Right | Description |
|---|---|
| Right of access to your data | You can obtain from CAPSTON AI confirmation that your data is or is not being processed and, when it is, access to all data and information held by CAPSTON AI. |
| Right to rectification of your data | You can obtain from CAPSTON AI, as soon as possible, the rectification of inaccurate or erroneous data concerning you. You can also request that your data be completed, if necessary. |
| Right to erasure of your data | Except for legal exceptions, you can ask CAPSTON AI to erase your data, for example, if you believe that the processing of your data is no longer necessary for the purposes for which it was collected. |
| Right to data portability | You can retrieve part of your data in an open, machine-readable format or ask CAPSTON AI to transmit it to another organisation. Only data that you have actively and consciously provided to CAPSTON AI (e.g., data you entered in an online form) or data generated during the use of a service, processed automatically based on consent or contract, is concerned by this right. |
| Right to object | You can object to your data being used for a specific purpose, provided you state the reasons relating to your particular situation. However, in the case of commercial prospecting, you can object without cause and at any time. |
| Right to restriction of processing of your data | In cases where you dispute the accuracy of the data used by the data controller or you object to your data being processed, the data controller may proceed with a verification or examination of your request for a specific period. During this period, you may request that they no longer use your data; however, they must retain it. |
| Right not to be subject to automated decision-making | You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. |
| Right to withdraw consent | When the processing of your personal data is based on your consent (e.g., sending our electronic commercial offers), you have the option to withdraw your consent at any time. |
| Right to give post-mortem directives | In accordance with French law, you can define directives for the retention, deletion, and disclosure of your data after your death. These directives define how you wish your rights over your data to be exercised after your death. |
For more information on your rights, you can consult the CNIL website: cnil.fr/fr/mes-demarches/les-droits-pour-maitriser-vos-donnees-personnelles.
To exercise any of your rights, send your request either by email to gdpr@capston.ai or by mail to:
BOURBON TECH
Attn: GDPR Referent
Ravine des Cabris
55 Chemin Fernand Collardeau
97432 SAINT-PIERRE
Indicate the purpose of the request in the subject line (exercise of the right of access, objection, etc.) and attach any element that justifies your identity to your email or letter. Finally, remember to specify the address to which the response should be sent (email or postal mail).
If we do not receive a response, we will respond via the same channel you used to contact us. CAPSTON AI will send you its response within a maximum of one (1) month from the date of receipt of your request. This period may, however, be extended by two (2) months due to the complexity and number of requests.
If, after contacting CAPSTON AI, you believe that your data protection rights are not respected, you can complain to the CNIL, directly on the CNIL website or by post at: CNIL - 3 Place de Fontenoy - TSA 80715-75334 PARIS CEDEX 07.
