Privacy Policy

PRIVACY POLICY

Pivotal Skills AI Website

Last updated: February 15, 2026

---

1. INTRODUCTION

This Privacy Policy describes how Pivotal Skills AI (hereinafter "we", "our", or "the Company") collects, uses, and protects your personal data when you visit our website and use our contact form.

We are committed to protecting your privacy and complying with applicable data protection laws, including:

  • The General Data Protection Regulation (GDPR - Regulation EU 2016/679)
  • The French Data Protection Act (Loi Informatique et Libertés) of January 6, 1978, as amended
  • Any other applicable data protection legislation

---

2. DATA CONTROLLER

The data controller responsible for your personal data is:

PIVOTAL SKILLS AI

Registration number: 999 828 510

Registered office: 4 rue Marconi, 57070 Metz, France

Email: contact@pivotalskills.ai

---

3. SCOPE OF THIS POLICY

This Privacy Policy applies to:

  • Information collected through the Pivotal Skills AI website
  • Information submitted through our contact form
  • Technical data collected automatically during your visit

This policy does not apply to third-party websites that may be linked from our Website. We are not responsible for the privacy practices of such third-party websites.

---

4. PERSONAL DATA WE COLLECT

4.1 Information You Provide Directly

When you use our contact form, we collect:

  • **Name**: to address you appropriately in our response
  • **Email address**: to respond to your inquiry
  • **Message content**: the subject and content of your inquiry
  • **Any other information** you voluntarily include in your message (e.g., phone number, company name)

4.2 Information Collected Automatically

When you visit our Website, we may automatically collect:

  • **Browser information**: browser type, version, and language settings
  • **Device information**: device type, operating system
  • **Connection data**: IP address, date and time of visit
  • **Usage data**: pages visited, time spent on pages, links clicked
  • **Referral source**: the website or source that referred you to our Website

4.3 Cookies and Tracking Technologies

We may use cookies and similar tracking technologies to collect information about your browsing activities. For more information, see Section 7.

---

5. HOW WE USE YOUR PERSONAL DATA

5.1 Purposes and Legal Bases

We process your personal data for the following purposes:

| Purpose | Legal Basis | Data Used |

|---------|-------------|-----------|

| Responding to your inquiries | Legitimate interest / Your request | Name, email, message content |

| Communication regarding your request | Legitimate interest | Name, email, contact details |

| Maintaining records of correspondence | Legitimate interest / Legal obligation | All contact form data |

| Website operation and improvement | Legitimate interest | Technical data, usage data |

| Security and fraud prevention | Legitimate interest / Legal obligation | IP address, connection data |

| Analytics and statistics (anonymized) | Legitimate interest | Anonymized usage data |

| Compliance with legal obligations | Legal obligation | As required by law |

5.2 No Marketing Communications

We do **not** use your contact form data for marketing purposes unless you have explicitly consented to receive marketing communications from us.

5.3 No Data Selling

We **never** sell, rent, or trade your personal data to third parties for their marketing purposes.

---

6. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

| Type of Data | Retention Period |

|--------------|------------------|

| Contact form submissions | 3 years from last contact (for correspondence records) |

| Email correspondence | 3 years from last interaction |

| Technical logs (IP addresses, etc.) | 12 months maximum |

| Anonymized analytics data | Indefinitely (cannot identify individuals) |

| Legal obligation data | As required by law (typically 5-10 years for accounting/legal purposes) |

After the retention period expires, your personal data will be permanently deleted or anonymized.

---

7. COOKIES AND TRACKING TECHNOLOGIES

7.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help the website remember information about your visit.

7.2 Types of Cookies We Use

Strictly Necessary Cookies:

  • Session cookies for website functionality
  • Security cookies to protect against unauthorized access

Analytics Cookies:

  • Usage statistics (anonymized)
  • Website performance monitoring
  • Visitor analytics (e.g., pages visited, time on site)

We do NOT use:

  • Advertising cookies
  • Third-party tracking cookies for marketing
  • Social media cookies
  • Profiling cookies for targeted advertising

7.3 Managing Cookies

You can control and manage cookies through your browser settings:

  • **Chrome**: Settings > Privacy and security > Cookies and other site data
  • **Firefox**: Settings > Privacy & Security > Cookies and Site Data
  • **Safari**: Preferences > Privacy > Cookies and website data
  • **Edge**: Settings > Cookies and site permissions > Cookies and site data

**Please note:** Blocking strictly necessary cookies may affect the functionality of the Website.

7.4 Cookie Consent

When you first visit our Website, we will ask for your consent to use non-essential cookies. You can change your cookie preferences at any time through the cookie settings on our Website or through your browser settings.

---

8. WHO WE SHARE YOUR DATA WITH

8.1 Internal Access

Your personal data is accessible only to authorized personnel of Pivotal Skills AI who need access to respond to your inquiries or perform necessary functions.

8.2 Third-Party Service Providers

We may share your data with carefully selected third-party service providers who assist us with:

  • **Website hosting**: to host and maintain the Website
  • **Email services**: to send and receive email communications
  • **Analytics services**: to analyze website usage (anonymized data)

All third-party service providers are:

  • Carefully selected and vetted
  • Contractually obligated to protect your data
  • Required to comply with GDPR and applicable data protection laws
  • Only permitted to process your data for the specific purposes we authorize

8.3 Legal Authorities

We may disclose your personal data if required by law or in response to valid requests by public authorities (e.g., court orders, legal proceedings).

8.4 No Other Sharing

We do not share, sell, rent, or trade your personal data with any other third parties for their own purposes.

---

9. INTERNATIONAL DATA TRANSFERS

9.1 Data Location

Your personal data is primarily processed and stored within the European Union.

9.2 Transfers Outside the EU

If we transfer your data outside the European Economic Area (EEA), we ensure that:

  • Appropriate safeguards are in place (e.g., EU Standard Contractual Clauses)
  • The recipient country provides an adequate level of data protection (e.g., adequacy decision by the European Commission)
  • Your data receives protection equivalent to that required under GDPR

---

10. DATA SECURITY

10.1 Security Measures

We implement appropriate technical and organizational measures to protect your personal data against:

  • Unauthorized access
  • Accidental loss
  • Destruction or damage
  • Unauthorized disclosure or alteration

These measures include:

  • Encryption of data in transit (HTTPS/TLS)
  • Secure server infrastructure
  • Access controls and authentication
  • Regular security assessments and updates
  • Staff training on data protection

10.2 Your Responsibility

While we take reasonable precautions to protect your data, please note that:

  • No method of transmission over the internet is 100% secure
  • You are responsible for maintaining the confidentiality of any login credentials
  • You should not share sensitive personal information through unsecured channels

---

11. YOUR RIGHTS UNDER GDPR

Under the General Data Protection Regulation (GDPR) and French data protection laws, you have the following rights:

11.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data and obtain information about how it is processed.

11.2 Right to Rectification (Article 16 GDPR)

You have the right to request correction of inaccurate or incomplete personal data concerning you.

11.3 Right to Erasure ("Right to Be Forgotten") (Article 17 GDPR)

You have the right to request deletion of your personal data in certain circumstances, such as:

  • The data is no longer necessary for the purposes for which it was collected
  • You withdraw consent (where processing is based on consent)
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed
  • Erasure is required to comply with a legal obligation

11.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request restriction of processing in certain circumstances, such as:

  • You contest the accuracy of your personal data
  • The processing is unlawful but you oppose erasure
  • We no longer need the data, but you need it for legal claims
  • You have objected to processing, pending verification of our legitimate grounds

11.5 Right to Data Portability (Article 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

This right applies when:

  • Processing is based on consent or contract
  • Processing is carried out by automated means

11.6 Right to Object (Article 21 GDPR)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

11.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

French Supervisory Authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)

3 Place de Fontenoy - TSA 80715

75334 PARIS CEDEX 07, France

Website: www.cnil.fr

Phone: +33 1 53 73 22 22

11.9 How to Exercise Your Rights

To exercise any of your rights, please contact us:

**By email:** contact@pivotalskills.ai

**By mail:** Pivotal Skills AI, 4 rue Marconi, 57070 Metz, France

We will respond to your request within **one month** of receipt. In complex cases, this period may be extended by two additional months, in which case we will inform you.

We may require proof of identity to verify your request and protect your personal data.

---

12. DATA PROTECTION PRINCIPLES

In accordance with Article 5 of the GDPR, we commit to processing your personal data in accordance with the following principles:

12.1 Lawfulness, Fairness, and Transparency

We process personal data lawfully, fairly, and in a transparent manner.

12.2 Purpose Limitation

We collect personal data for specified, explicit, and legitimate purposes and do not process it in a manner incompatible with those purposes.

12.3 Data Minimization

We collect only personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

12.4 Accuracy

We take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.

12.5 Storage Limitation

We retain personal data only for as long as necessary for the purposes for which it was collected.

12.6 Integrity and Confidentiality

We process personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

12.7 Accountability

We are responsible for and able to demonstrate compliance with these principles.

---

13. CHILDREN'S PRIVACY

Our Website is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at contact@pivotalskills.ai so we can delete such information.

---

14. AUTOMATED DECISION-MAKING AND PROFILING

We do **not** engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you.

---

15. DATA BREACH NOTIFICATION

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority (CNIL) within 72 hours of becoming aware of the breach
  • Notify affected individuals without undue delay
  • Take appropriate measures to mitigate the risks

---

16. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

  • Changes in our data processing practices
  • Changes in applicable laws and regulations
  • New features or services on the Website

16.1 Notice of Changes

We will notify you of any material changes by:

  • Posting the updated Privacy Policy on the Website
  • Updating the "Last updated" date at the top of this policy
  • If appropriate, sending you an email notification

16.2 Review

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

---

17. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

PIVOTAL SKILLS AI

4 rue Marconi

57070 Metz, France

Email: contact@pivotalskills.ai

---

18. DEFINITIONS

For the purposes of this Privacy Policy:

  • **Personal Data**: Any information relating to an identified or identifiable natural person
  • **Processing**: Any operation performed on personal data, such as collection, recording, storage, use, disclosure, or deletion
  • **Data Controller**: The entity that determines the purposes and means of processing personal data (Pivotal Skills AI)
  • **Data Subject**: The individual to whom personal data relates (you)
  • **GDPR**: General Data Protection Regulation (EU) 2016/679
  • **Consent**: A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data

---

19. SPECIFIC GDPR COMPLIANCE INFORMATION

19.1 Legal Basis for Processing

As detailed in Section 5.1, we process your personal data based on the following legal bases under Article 6 of the GDPR:

  • **Legitimate interests** (Article 6(1)(f)): for responding to inquiries, website operation, and security
  • **Legal obligation** (Article 6(1)(c)): for compliance with legal requirements
  • **Consent** (Article 6(1)(a)): where explicitly obtained for specific purposes

19.2 Data Protection Officer (DPO)

For inquiries specifically related to data protection, you may contact us at contact@pivotalskills.ai with "DPO" or "Data Protection" in the subject line.

19.3 Records of Processing Activities

In compliance with Article 30 of the GDPR, we maintain records of our processing activities. You may request access to relevant information by contacting us.

---

20. NO-SALE COMMITMENT

Pivotal Skills AI commits that we will NEVER:

  • Sell your personal data to third parties
  • Rent your personal data to third parties
  • Trade your personal data for monetary or other consideration
  • Share your data for third-party marketing purposes without your explicit consent

Your personal data is used solely for the purposes stated in this Privacy Policy.

---

Last updated: February 15, 2026

---

GDPR ARTICLE REFERENCES

This Privacy Policy is designed to comply with the following GDPR requirements:

  • **Article 5**: Principles relating to processing of personal data
  • **Article 6**: Lawfulness of processing
  • **Article 12**: Transparent information, communication and modalities
  • **Article 13**: Information to be provided where personal data are collected from the data subject
  • **Articles 15-22**: Data subject rights
  • **Article 25**: Data protection by design and by default
  • **Article 30**: Records of processing activities
  • **Article 32**: Security of processing
  • **Article 33-34**: Data breach notification