Privacy policy

This policy explains the personal-data processing carried out through the AxiSecurity website and services. It applies to visitors, prospects, users and representatives of customer organisations.

1. Data controller

The data controller is AW CROISSANCE. For any question or to exercise your rights, use the dedicated contact form and state “Personal data” as the subject.

2. Data concerned

Depending on the journey, AxiSecurity may process identification and contact information, organisation and SIRET information, declared assets, testing authorisations, language preferences, support exchanges, diagnostic results and technical elements required to secure the service. For a free scan, the email address and telephone number are encrypted before storage; the IP address is retained as an HMAC fingerprint rather than in clear text.

3. Purposes and legal bases

• responding to an information or quote request and carrying out requested pre-contractual steps;
• creating and administering a user workspace, providing the subscribed service and support;
• securing the service, preventing abuse and documenting testing authorisations, on the basis of legitimate interests and applicable obligations;
• managing non-essential consents where required;
• meeting applicable legal, accounting, tax or evidential obligations.

4. Recipients and processors

Data is available only to authorised publisher personnel, the customer organisation within its permissions, and strictly necessary technical providers (hosting, transactional messaging, operations). It is not sold to third parties. Access is limited on a need-to-know basis.

5. Retention periods

Contact details submitted for a free scan are automatically purged no later than 90 days after collection, unless a legal obligation or separate contractual relationship applies. Information requests are retained for no more than 1095 days after the last useful exchange. Account, billing and proof data then follow periods imposed by legal obligations and applicable limitation rules.

6. Security

AxiSecurity applies proportionate organisational and technical measures: role- and organisation-based access control, isolated scan execution, temporary report links, logging of sensitive actions, encryption of public contact details and limited technical-artifact retention. No measure can remove all risk; users must also protect their credentials and limit access to their workspace.

7. Your rights

Subject to regulatory conditions, you have rights of access, rectification, erasure, restriction, objection, portability and post-mortem instructions. You may lodge a complaint with the relevant supervisory authority, including the CNIL in France. To protect data, reasonable proof of identity or authority may be requested.

8. Transfers and updates

Any transfer outside the European Economic Area is governed by safeguards required by applicable law. This policy may change to reflect legal, technical or organisational developments; the date above identifies the applicable version.