Privacy Policy

Data controller

Lunnar LLC’s commitment

Protecting your personal data is a priority for Lunnar LLC. This Privacy Policy explains clearly, precisely and completely how your data is collected, processed, stored and protected, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and amended French Law No. 78-17 of January 6, 1978.

Article 1: Scope

1.1 Who this policy covers

This Privacy Policy applies to any individual or legal entity (the “User” or the “Client”) who interacts with Lunnar LLC through the lunnar.fr website, contact forms, appointment booking tools, email or phone conversations, or as part of a contractual relationship.

1.2 Processing covered

This policy covers all processing of personal data carried out by Lunnar LLC as data controller, in particular in connection with managing prospects, performing its services (Process Map and Plan, custom tool development, website creation and redesign), hosting its clients’ tools and websites, client relations, and administrative and accounting management.

1.3 Updates

Lunnar LLC reserves the right to change this policy at any time to reflect regulatory changes or its internal practices. The version in force is the one available on the Site on the date it is consulted. In the event of a material change, the Users concerned will be informed by email.

Article 2: Data collected

2.1 Data collected directly

Lunnar LLC collects only the data strictly necessary for its purposes, in line with the data minimization principle (Art. 5(1)(c) GDPR). The following data may be collected directly from the User:

2.2 Data collected automatically

When you browse the Site, the servers record technical data: IP address, browser type and version, operating system, pages requested, and date and time of connection. These logs are used solely to keep the Site running and secure, and to meet legal retention obligations.

The Site currently uses no audience measurement tool (neither Google Analytics nor any equivalent) and no advertising pixel. Before you make any choice in the cookie banner, the only cookie placed is the one that remembers your display language.

2.3 Sensitive data

Lunnar LLC does not collect or process any data considered sensitive within the meaning of Article 9 of the GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, etc.). If such data were sent to us by mistake, it would be deleted immediately.

2.4 Data about minors

Lunnar LLC’s services are intended exclusively for businesses (B2B). No data about minors is intentionally collected. If any such data were identified, it would be deleted immediately.

2.5 Prospecting data you did not provide

If you are a professional we contacted without you having given us your contact details, those details come from publicly accessible business sources: the website of the company concerned, legal notices published in the BODACC (the French official bulletin of civil and commercial announcements), INSEE’s SIRENE business register, the French government’s business directory, and business listings published on online mapping services. This information may be supplemented by a business data enrichment provider established in France.

The data concerned is strictly professional: company name, business address, SIRET number, contact phone number and email address, industry, website, and where applicable the name of the company’s director as it appears in those public sources. It is processed on the basis of Lunnar LLC’s legitimate interest (Art. 6(1)(f) GDPR) in making its services known to businesses that may be interested in them.

In accordance with Article 14 of the GDPR, this information is provided to you no later than the first contact. You can object to this processing at any time, without giving a reason: by replying STOP to a text message, by saying so during a call, or by writing to hello@lunnar.fr. Your request is applied without delay and your data is then deleted from our prospecting files.

If the phone call is made by an automated voice system, you are informed at the start of the call. No audio recording is kept: only a written transcript of the conversation is kept with your record, for the period stated in Article 4.

Article 3: Purposes and legal bases of processing

3.1 Summary table

All processing carried out by Lunnar LLC is based on one of the legal bases set out in Article 6 of the GDPR:

3.2 About legitimate interest

When Lunnar LLC relies on legitimate interest as a legal basis, it makes sure that this interest is balanced against the fundamental rights and freedoms of the data subjects. Anyone may object to processing based on this ground by sending a request to hello@lunnar.fr.

3.3 Withdrawing consent

When processing is based on consent, consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal. Consent is withdrawn either through the unsubscribe link included in every marketing communication or by a simple written request to hello@lunnar.fr.

Article 4: Retention periods

4.1 General principle

In line with the storage limitation principle (Art. 5(1)(e) GDPR), personal data is kept for no longer than is necessary for the purposes for which it is processed. After that period, the data is either securely deleted or anonymized.

4.2 Intermediate archiving

Some data may be kept in intermediate archives beyond the active periods stated, within the limits of the applicable statutes of limitations (5 years for the general limitation period, 10 years for business records), for evidentiary purposes only. Access to these archives is strictly restricted.

Article 5: Recipients and data transfers

5.1 Internal recipients

Personal data is accessible only to Lunnar LLC’s authorized staff, partners and subcontractors, strictly within the limits of their duties and on a need-to-know basis. All of them are bound by a confidentiality obligation.

5.2 Technical processors

Lunnar LLC uses technical service providers acting as processors within the meaning of Article 28 of the GDPR. These providers process data solely on Lunnar LLC’s instructions and for the defined purposes. They are selected for the sufficient guarantees they offer regarding the protection of personal data. Data processing agreements compliant with Article 28 of the GDPR are always put in place.

5.3 Transfers outside the European Union

Because Lunnar LLC’s registered office is located in the United States, and because it may use US processors, some data may be transferred to countries outside the European Union that are not covered by an adequacy decision of the European Commission.

These transfers are subject to appropriate safeguards in accordance with Chapter V of the GDPR, in particular the Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914).

The platform and the database, for their part, are hosted in the European Union, on Google Cloud infrastructure in the Belgium region.

5.4 No sale of data

Lunnar LLC formally undertakes not to sell, rent, assign or transfer to third parties, whether for payment or free of charge, the personal data of its users and clients, except for transfers to its processors under the conditions described above or where required by law.

Article 6: Data security

6.1 Technical and organizational measures

In accordance with Article 32 of the GDPR, Lunnar LLC implements all appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: encryption of data in transit (HTTPS/TLS), strict control of access to data (strong authentication, access rights limited to those who need them), regular backups, careful selection of processors offering equivalent security guarantees, and training staff in good IT security practices.

6.2 Data breaches

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the data subjects, Lunnar LLC undertakes to notify the CNIL within seventy-two (72) hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. If the breach is likely to result in a high risk to the data subjects, they will also be informed as soon as possible.

6.3 Clients’ responsibility for their own tools and websites

For custom tool, website creation and hosting services, the Client acts as data controller for all data collected through its tool or website. It is the Client’s responsibility to put in place the appropriate legal notices, privacy policies and consents on its own tool or website, and to ensure that its processing complies with the GDPR.

Article 7: Rights of data subjects

7.1 Table of rights

Under Articles 15 to 22 of the GDPR, every data subject has the following rights:

7.2 How to exercise your rights

These rights can be exercised electronically at hello@lunnar.fr, or by mail to the registered office address. The request must state the requester’s last name, first name and contact details, and the precise subject of the request. Lunnar LLC reserves the right to verify the requester’s identity before responding, to prevent any unauthorized disclosure.

7.3 Response time

Lunnar LLC undertakes to respond to any request within one (1) month of receipt. This period may be extended by two (2) additional months for numerous or complex requests, in which case the User will be informed of the extension within one month.

7.4 Complaints to the CNIL

If the response is unsatisfactory, or if no response is received within the time limits, every data subject has the right to file a complaint with the competent supervisory authority:

Article 8: Cookies and trackers

8.1 Definition

A cookie is a small text file placed on the User’s device (computer, tablet, smartphone) while browsing the Site. Cookies make it possible to recognize a device, remember browsing information and collect statistical data.

8.2 Strictly necessary cookies

These cookies are essential for the Site to work technically. They collect no information that could be used for commercial purposes and cannot be turned off. No prior consent is required to place them, in accordance with the CNIL recommendation of September 17, 2020.

8.3 Analytics cookies

These cookies measure the Site’s audience (pages visited, time spent, traffic source) in order to improve the User experience. They are placed only after the User has given explicit consent through the cookie management banner. They are kept for no more than thirteen (13) months.

At present, no cookie in this category is placed on the Site, as no audience measurement tool is installed on it. The banner still lets you state your choice in advance: it will be respected if such a tool is ever added, and this policy would be updated accordingly.

8.4 Third-party cookies

The Site may include third-party services (appointment booking tool, embedded videos, social media buttons) that may place their own cookies. Lunnar LLC has no control over these third-party cookies. The User is invited to review those third parties’ privacy policies.

8.5 Managing preferences

The User can change their cookie preferences at any time through: the consent manager available on the Cookie Settings page, or their browser settings. Turning off some cookies may affect the browsing experience on the Site.

Article 9: Measuring how the diagnostic page is read

9.1 Processing concerned

When a prospect views their personalized diagnostic page (a link sent by text message, in the format lunnar.fr/diagnostic/[code]), Lunnar LLC measures how the page is read: how far the prospect scrolls, active reading time (only while the page is visible and with recent interaction, excluding any time spent in an inactive tab), the average order value the prospect may have corrected, and clicks on the page’s buttons.

9.2 Purpose and legal basis

The sole purpose of this measurement is to tailor the Lunnar team’s commercial follow-up with the prospect (prioritizing and personalizing the follow-up call). It is based on Lunnar LLC’s legitimate interest (Art. 6(1)(f) GDPR) in optimizing its business relationship with professionals already in contact with it. No fully automated decision is made on this basis alone: follow-up is always carried out by a human being.

9.3 No cookies and no third parties

This processing places no cookie or tracker on the prospect’s device: the measurement is performed server-side, linked to the unique, unguessable access code of their diagnostic page. No data from this measurement is passed to any third party or to any processor other than those already listed in Article 5.2 for the technical hosting of the platform.

9.4 Retention period

This reading data is kept for the same period as the diagnostic page it relates to, then deleted automatically along with it (daily purge). It is never kept beyond the lifetime of the diagnostic.

Article 10: Processors and hosting

10.1 Processor obligations

In accordance with Article 28 of the GDPR, every processor Lunnar LLC uses must provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures. A data processing agreement setting out the subject matter, duration, nature and purpose of the processing is always put in place.

10.2 Hosting of client tools and websites

When providing hosting services, Lunnar LLC acts as a technical processor on behalf of the Client, who is the data controller. Lunnar LLC processes the data of users of the Client’s tool or website solely for the technical purpose of keeping the hosted tool or website running and secure, without accessing its content for its own purposes.

10.3 Audits and records

Lunnar LLC keeps a record of processing activities in accordance with Article 30 of the GDPR. This record, updated regularly, lists all processing carried out, its purposes, legal bases, retention periods and recipients. It is made available to the CNIL on request.

Article 11: Governing law and jurisdiction

11.1 Governing law

This Privacy Policy is governed by French law and by applicable European law on personal data protection, in particular the GDPR and the French “Informatique et Libertés” law. Although Lunnar LLC is a US entity, it undertakes to fully comply with the European legal framework in all its relationships with persons established in the European Union.

11.2 Competent supervisory authority

The supervisory authority competent for any complaint about the processing of personal data by Lunnar LLC is the Commission Nationale de l’Informatique et des Libertés (CNIL), available at www.cnil.fr.

Article 12: Contact

For any question about this Privacy Policy, to exercise your rights, or to report a problem relating to the protection of your data, you can contact Lunnar LLC at: