Personal data
This page describes the processing of personal data carried out by JOY Talents through this site and in the course of its consulting work. Last updated: October 2026.
1. Who is responsible for your data
JOY TALENTS, a French simplified joint-stock company (SAS) with a share capital of €1,000, registered with the Paris Trade and Companies Register under number 105 899 470, with its registered office at 16 rue de Savoie, 75006 Paris, France.
JOY Talents acts as data controller for the data collected on this site and for managing its commercial relationships. When we work on a client's HRIS and access their employees' data, JOY Talents acts as a processor within the meaning of Article 28 GDPR, within the frame set by the service agreement.
We have not appointed a data protection officer: neither our size nor the nature of the processing requires one. Any question about this page can be sent through the contact form.
2. What we collect
Through the contact form
You provide: full name, job title (optional), company, company size, work e-mail address, phone number and country dialling code (optional), the subject of your request and the content of your message. Fields marked with an asterisk are needed to handle the request; the others are yours to fill or leave.
Please do not include in your message any special category data within the meaning of Article 9 GDPR (health, opinions, trade union membership) or any data about your employees. An HRIS project can be framed without them.
Through browsing
This site sets no cookies: no advertising, no social network. No browsing profile is built, so no consent banner is needed.
We measure traffic with Vercel Web Analytics, a cookieless solution. Nothing is written to your device: the service derives a short-lived technical marker from your IP address and browser, valid for a day, whose only job is to avoid counting the same visit twice. All we get out of it is aggregate figures: pages viewed, country, device type, and the site you arrived from. No cross-site tracking, nothing sold on, no IP address kept.
We also count a few actions, without ever recording what you type: opening the contact form, sending a request along with the subject and headcount band picked from the lists, and clicks through to our LinkedIn pages. That tells us which pages actually earn their place.
You can refuse this measurement right here; the choice stays in your browser and is sent nowhere:
Our host keeps technical logs (IP address, timestamp, page requested, user agent) needed to run and secure the service. JOY Talents neither uses nor cross-references those logs.
In the course of business
Business contact details, exchanges relating to a proposal or an engagement, contractual documents and accounting records.
3. Why we process it, and on what basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering a request sent through the form | Pre-contractual steps taken at your request, Article 6.1.b | 3 years from the last contact |
| Commercial follow-up on a project under consideration | Legitimate interest in developing our business, Article 6.1.f | 3 years from the last contact |
| Delivering a consulting or implementation engagement | Performance of the contract, Article 6.1.b | Term of the contract, then 5 years |
| Invoicing and accounting obligations | Legal obligation, Article 6.1.c | 10 years, Article L.123-22 of the French Commercial Code |
| Site security and prevention of automated submissions | Legitimate interest in protecting the service, Article 6.1.f | Host's technical logs, limited period |
| Measuring traffic to the site | Legitimate interest in knowing what is read, Article 6.1.f | Aggregate statistics, no individual record |
Commercial follow-up rests on our legitimate interest, balanced against your rights: we approach professionals only, at their work address, about their own field, and any objection is honoured at once.
4. Who has access
Within JOY Talents, only the people handling your request have access: the partners and, where relevant, the consultant assigned to your project. We neither sell nor rent any data, and we pass none of it to partners for commercial purposes.
We rely on the following processors, each bound by an agreement compliant with Article 28 GDPR:
- Vercel Inc. (United States): hosting the site, running the function that receives the form, and cookieless traffic measurement. The function is configured to run on the Paris infrastructure, and no form data is stored there.
- Resend: delivery of the notification e-mail. Sending is configured on the service's European infrastructure, in Ireland.
- Cloudflare: anti-robot verification on the form. The service sets no advertising tracker and builds no profile.
- Google Workspace: the business mailbox where we receive and keep our exchanges.
- Squarespace Domains: domain name management.
- Amazon Web Services (AWS), for our products: hosting of JOY Talents Training Sessions and Cockpit Paie, together with the data our clients entrust to them. Environments are located in France (AWS Paris region). For these products, JOY Talents acts as the client's processor and AWS as a sub-processor, within the frame set by the subscription agreement.
Some of these providers are established in the United States or belong to a US group. Any transfer is covered by the European Commission's standard contractual clauses and, where applicable, by the provider's Data Privacy Framework certification. We choose European regions whenever the service offers them, as we did for e-mail delivery and for hosting our products.
5. How we protect it
- The site is served over HTTPS only, with strict security headers (HSTS, protection against framing by third parties, limited referrer policy).
- No database on the site: the form is relayed by e-mail and writes nowhere. There is nothing on the server to steal.
- Access keys to third-party services live in the host's environment variables, never in the pages or in published code.
- Mailbox access protected by two-factor authentication.
- Encrypted workstations, passwords held in a dedicated vault.
6. Your rights, and how to exercise them
Under the General Data Protection Regulation and the French Data Protection Act, you have the following rights:
- Access: confirmation that we process data about you, and a copy of it.
- Rectification: correction of inaccurate or incomplete information.
- Erasure: deletion of your data, subject to our accounting obligations and the defence of our rights.
- Restriction: freezing a processing operation while it is checked.
- Objection: objecting to commercial follow-up, at any time and without giving a reason.
- Portability: receiving in a readable format the data you gave us, to take it elsewhere.
- Post-mortem instructions: setting what happens to your data after your death.
To exercise any of these, write to us through the contact form, choosing the subject "Something else". We answer within one month, extended to three if the request is complex, in which case we tell you. We may ask for something confirming your identity, but only where reasonable doubt exists.
If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
7. Work carried out at our clients
When we configure an HRIS or migrate data into it, the employees' data remains the client's responsibility. We act only on their documented instructions, we use that data for no purpose of our own, and we return or delete it at the end of the engagement. Our consultants are bound by a written confidentiality undertaking.
For testing phases we consistently recommend anonymised or pseudonymised datasets rather than copies of production data.
8. Changes to this page
We update this page when our processing changes: a new provider, a new purpose, a different retention period. The date of the last update appears at the top. The legal notice completes this information.