Privacy policy

This policy explains what data ASTERALE processes, why, for how long, who has access to it and how to exercise your rights. The gazania.fr website sets no cookies and calls no third-party resources.

Data controller

Controller	ASTERALE, SASU with share capital of €1,000, RCS Créteil 921 855 508
Registered office	4 allée Django Reinhardt, 94110 Arcueil, France
Representative	Mr Sébastien Bailly, president
Data protection contact	contact@gazania.fr, +33 6 28 54 13 74

ASTERALE has not appointed a data protection officer (DPO), as its size does not require it to do so. The president is personally responsible for the compliance of the processing.

ASTÉRALE Gazania is a trade name of ASTERALE: the processing described below is carried out by ASTERALE, whatever the trade name under which the relationship began.

Data collected

Through the gazania.fr website

The gazania.fr website is a static presentation website. It has no forms, no audience measurement tools, no cookies and no third-party resources. No data is collected simply through your browsing, beyond the technical logs generated automatically by the host (see the section « Host's technical logs » below).

Contact is made exclusively by email, on your initiative. The data transmitted is then the data you choose to provide: identity, contact details, context of your request.

Within a business relationship

Once a relationship begins, ASTERALE collects the data needed to carry out its engagement and to meet its legal obligations:

• identification: title, surname, forenames, date and place of birth, nationality, postal, telephone and email contact details, family and marital situation, matrimonial property regime;
• financial and wealth situation: composition and value of assets, income, expenses, debt, shareholdings, business and property assets, tax situation, tax residences;
• financial knowledge and experience: MiFID II suitability questionnaire, investment objectives, investment horizon, risk tolerance, capacity to bear losses;
• AML-CFT compliance and know-your-customer checks: identity document, proof of address, evidence of the source of funds and wealth, any status as a politically exposed person;
• correspondence: letters and emails, meeting notes, documents provided.

ASTERALE does not collect any special category data within the meaning of article 9 of the GDPR (health, political opinions, religious beliefs, biometric data), except where a legal provision requires it within a specific framework and with your explicit consent.

Host's technical logs

OVH, as host, automatically records connection logs (IP address, timestamp, page requested, response code, user agent). These logs meet a legal retention obligation and a legitimate security interest. They are not used for audience measurement or profiling.

Purposes, legal bases and retention periods

Purpose	Legal basis	Retention
Replying to contact requests	Pre-contractual measures (art. 6.1.b GDPR)	3 years from the last contact
Assessment of eligibility and suitability	Pre-contractual measures (art. 6.1.b)	3 years from the last contact
Performance of wealth advisory services	Performance of the contract (art. 6.1.b)	Duration of the relationship, then 10 years (limitation period)
Anti-money laundering and counter-terrorist financing obligations	Legal obligation (art. 6.1.c)	5 years after the end of the relationship (art. L. 561-12 of the French Monetary and Financial Code)
Accounting and tax obligations	Legal obligation (art. 6.1.c)	10 years (art. L. 123-22 of the French Commercial Code)
Traceability of advice and complaints handling	Legal obligation and legitimate interest	5 years after the end of the relationship
Information and marketing to clients	Legitimate interest, art. 6.1.f (clients); consent (prospective clients)	3 years from the last contact
Website security and technical logs	Legal obligation and legitimate interest	According to the host's policy (12 months at most)

When these periods expire, the data is deleted or irreversibly anonymised.

Recipients

Your data is only disclosed to recipients who strictly need it:

• Mr Sébastien Bailly, the only authorised internal person;
• OVH SAS (Roubaix, France), for hosting the website and email;
• financial partners (insurance companies, asset management companies, banks, subscription platforms), only in connection with a subscription you have decided on and with your explicit consent;
• external advisers (notaries, tax lawyers, chartered accountants), only with your explicit consent;
• the drafting and analysis assistance tools used by the firm in the course of its engagements, under a processing agreement compliant with Article 28 GDPR, with no training of models on the data entrusted; no decision is automated;
• supervisory authorities and bodies (AMF, ACPR, TRACFIN, ANACOFI, tax authorities, judicial authorities), on a legally founded request.

ASTERALE does not sell, rent or otherwise commercially transfer personal data and does not use any advertising platform.

Transfers outside the European Union

The gazania.fr website and its associated email are hosted in France by OVH. The operation of the website involves no transfer of data outside the European Union: fonts are served from the website's own server and no third-party resource is called.

Within a business relationship, a transfer outside the European Union could result from subscribing to a product with a partner established outside the Union, or from the location of assets abroad. Such a transfer would then be subject to the appropriate safeguards provided for in articles 44 to 49 of the GDPR (adequacy decision, standard contractual clauses, or explicit consent after information on the risks). You would be informed in advance.

The drafting and analysis assistance tools listed among the recipients may involve a transfer covered by the safeguards of Articles 44 et seq. GDPR.

Your rights

Under articles 15 to 22 of the GDPR, you have the following rights:

• access (art. 15): to obtain confirmation that your data is being processed and a copy of it;
• rectification (art. 16): to have inaccurate or incomplete data corrected;
• erasure (art. 17): to have your data deleted, except where retention is required by a legal obligation (AML-CFT, accounting, traceability of advice);
• restriction (art. 18): to have the processing temporarily suspended;
• portability (art. 20): to receive the data you have provided in a structured, machine-readable format;
• objection (art. 21): to object to processing based on legitimate interest, and in particular to direct marketing, at any time and without giving reasons;
• withdrawal of consent: at any time, without affecting the lawfulness of earlier processing;
• post-mortem instructions (art. 85 of French law no. 78-17 as amended): to decide what happens to your data after your death.

How to exercise these rights

By email to contact@gazania.fr or by post to ASTERALE, 4 allée Django Reinhardt, 94110 Arcueil, France. Proof of identity may be requested if there is reasonable doubt about the identity of the person making the request. The copy is then kept for one year at most and then destroyed.

ASTERALE replies within one month of receiving the request. This period may be extended by two months for complex or numerous requests, with reasons given within the initial month.

Cookies and trackers

The gazania.fr website sets no cookies, trackers, pixels or session identifiers. It uses no audience measurement tool, advertising network or third-party widget.

The fonts (Libre Franklin, Marcellus) are served from the website's own server and not from a third-party service. Your IP address is therefore not disclosed to any external operator when pages are displayed.

No consent banner is therefore required, in accordance with the CNIL guidelines of 17 September 2020.

Data security

ASTERALE implements technical and organisational measures suited to the particularly sensitive nature of the wealth information entrusted to it:

• encryption of exchanges by HTTPS (TLS) across the whole website;
• complex, distinct passwords, stored encrypted;
• two-factor authentication on critical services;
• access to files restricted to Mr Sébastien Bailly and, where applicable, to service providers bound by a confidentiality clause;
• regular, encrypted backups;
• notification of any personal data breach to the CNIL within 72 hours (art. 33 GDPR) and information of the data subjects where the risk is high (art. 34 GDPR).

ASTERALE is also bound by professional secrecy in the course of its regulated activities.

Automated decision-making and profiling

No decision producing legal effects concerning you is based solely on automated processing. Wealth recommendations result from an individual human analysis.

Complaint to the CNIL

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority:

Online	www.cnil.fr/fr/plaintes
By post	CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
By telephone	+33 1 53 73 22 22

Changes to this policy

This policy may be amended to reflect changes in the legal framework, CNIL guidance or ASTERALE's internal practices. The version in force is the one published on this page. In the event of a substantial change affecting your rights, the persons concerned are informed individually.

The French version prevails.