Privacy & Cookies Policy

Last updated: 11 November 2026

1. Data controller

The controller responsible for the personal-data processing described in this policy is:

VEDRAX SAS
1384 route de Lavilledieu
82710 Bressols, France
Email: finance@vedrax.com
Telephone: +33 5 63 02 12 16

This policy applies to the public website https://vedrax.com .

Processing carried out for clients under professional-services contracts may be subject to separate agreements and notices.

2. Information collected

Through the contact form, Vedrax may collect:

• Your full name;
• Your professional email address;
• Your company name;
• Your organization type;
• Your service of interest;
• Your estimated project timeline;
• Your message.

Technical systems may also process IP addresses, browser and device characteristics, access timestamps, requested resources and security-related events.

If you accept optional analytics, Google Analytics may process information about your use of the website, subject to its configuration.

The contact form uses hCaptcha to help prevent automated abuse. hCaptcha may process technical and interaction data required for its operation.

Please do not provide patient data, health information, confidential pharmaceutical information or other sensitive personal data through the public form.

3. Purposes and legal bases

Professional enquiries

Data is processed to respond to requests, assess potential projects, prepare proposals and maintain related correspondence.

The legal basis is Vedrax's legitimate interest in managing professional enquiries or, where applicable, taking steps before entering into a contract.

Website operation and security

Necessary technical information is processed to deliver website functionality, maintain infrastructure and detect abuse.

The legal basis is Vedrax's legitimate interest in operating a reliable and secure website or a legal obligation where applicable.

Optional analytics

Google Analytics is intended to measure website usage and improve content, only where the required consent has been obtained.

Submitting a contact form does not constitute consent to receive an unrelated marketing newsletter.

4. Required fields

Fields marked as mandatory are needed to process an enquiry through the form.

If they are not completed, the form cannot be submitted.

You should provide only information relevant to your enquiry.

5. Recipients and processors

Access to personal data is limited to authorized Vedrax personnel and relevant service providers, according to their roles.

Depending on the processing involved, these may include:

• Google Cloud Platform / Google App Engine, for website infrastructure;
• The configured email delivery and mailbox provider, for handling enquiries;
• hCaptcha, for protection against automated submissions;
• Google Analytics, where optional analytics consent has been given.

Vedrax does not sell personal data to data brokers or advertisers.

6. International transfers

Certain service providers may process data or permit access from outside the European Economic Area.

Where transfers occur, Vedrax must assess the applicable legal transfer mechanism, including adequacy decisions or appropriate safeguards such as standard contractual clauses, together with supplementary measures where necessary.

Google Cloud hosting does not, by itself, guarantee that all processing remains within the European Union.

7. Retention

Professional enquiries that do not lead to a client engagement are retained only for a documented period justified by their purpose.

Proposed policy: delete or anonymize non-client enquiries no later than 24 months after the last meaningful exchange, unless a legitimate documented reason or legal obligation requires longer retention.

This period must be implemented in the systems and mailboxes used to handle enquiries before it is presented as an established practice.

Technical security logs are retained according to a documented schedule that remains to be confirmed.

Google Analytics data retention depends on the configuration of the Analytics property.

Where a professional relationship is established, contractual, accounting and other legally relevant records may be subject to different retention obligations.

8. Cookies and analytics preferences

The website may use necessary technical storage for session management, security and language preferences.

Optional Google Analytics is intended to load only after the visitor has accepted analytics.

The current implementation stores the analytics choice locally in the browser under the key vedrax.analyticsConsent.v1.

Visitors must be able to accept, refuse and subsequently modify their analytics preference.

Refusing optional analytics must not prevent access to the website.

Withdrawing consent must stop future optional analytics collection. Information already collected remains subject to applicable retention and deletion requirements.

hCaptcha and other third-party resources must be assessed separately for their own tracking technologies and applicable consent requirements.

9. Security

Vedrax applies technical and organizational measures proportionate to the risks, including appropriate access restrictions, credential protection and secure communications.

No system connected to the internet can guarantee absolute security.

10. Your rights

Subject to applicable conditions, you may exercise your rights of access, rectification, erasure, restriction, objection and data portability where applicable.

Where processing relies on consent, you may withdraw consent at any time without affecting processing lawfully carried out beforehand.

To exercise your rights, contact finance@vedrax.com .

You may also lodge a complaint with the French supervisory authority, the CNIL: https://www.cnil.fr .

11. Changes

This policy may be updated when Vedrax changes its website, processing activities, service providers or applicable procedures.

The current version is published here.