CERF Payment Solutions (CERF SAS), registered with the Paris Trade and Companies Registry (RCS Paris) under SIREN number 913 596 649, with registered offices at 219 Boulevard Pereire, 75017 Paris, France, acts as data controller in respect of all personal data collected through this website.

For all data protection enquiries, please contact us at: info@thecerf.com

This Privacy Policy describes how CERF Payment Solutions collects, uses, stores, and discloses personal data obtained through the website thecerf.com and through any related business communications. It applies to all visitors, prospects, and clients who interact with the Company through this website.

This Policy is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, "GDPR") and applicable French data protection legislation.

The Company collects only the personal data necessary to respond to inquiries and provide its Services. Data is collected through the following means:

The Company does not collect or process sensitive personal data as defined under Article 9 of the GDPR, including data relating to racial or ethnic origin, health, biometric data, or financial account information.

All personal data processed by the Company is done so on the basis of one or more of the following legal grounds under Article 6 of the GDPR:

• Legitimate interests (Article 6(1)(f)): to respond to business inquiries, manage prospect and client relationships, and improve the performance of this website;
• Pre-contractual measures (Article 6(1)(b)): to assess eligibility and prepare proposals prior to entering into a service agreement;
• Performance of a contract (Article 6(1)(b)): to provide Services to Clients under an executed service agreement;
• Consent (Article 6(1)(a)): for the placement of non-essential cookies and associated analytics or advertising tracking, where consent is obtained through the cookie consent mechanism on this website;
• Legal obligation (Article 6(1)(c)): where processing is required to comply with applicable French or EU law.

Personal data collected by the Company is used exclusively for the following purposes:

• To respond to inquiries submitted through the website;
• To assess the eligibility of Prospects for payment consulting services;
• To manage ongoing client relationships and deliver contracted Services;
• To analyse website traffic and user behaviour for the purpose of improving website performance and user experience;
• To comply with applicable legal and regulatory obligations.

Personal data will not be used for any purpose incompatible with those listed above without prior notification and, where required, consent.

The Company engages the following third-party service providers who may process personal data on its behalf. All such providers are bound by appropriate data processing agreements and are required to process data only on documented instructions from the Company:

The Company does not sell, rent, or otherwise disclose personal data to third parties for commercial or marketing purposes.

The Company is established in France and processes data within the European Union. Where data is transferred to third-party processors located outside the European Economic Area (EEA), including to Google LLC in the United States, such transfers are made in accordance with Chapter V of the GDPR, on the basis of Standard Contractual Clauses adopted by the European Commission, or such other transfer mechanism as may be applicable.

The Company retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Prospect inquiry data: retained for up to 24 months following the last substantive contact, after which data is securely deleted or anonymised;
• Client data: retained for the duration of the contractual relationship and for a period of 5 years thereafter, in accordance with applicable French commercial law;
• Website analytics data: retained in accordance with the applicable Google Analytics data retention settings, not exceeding 26 months;
• Communication records: retained for up to 3 years following the date of the communication.

This website uses cookies and similar tracking technologies to collect technical data and to support analytics and advertising functions. Cookies are small text files placed on your device by the website server.

The following categories of cookies are used:

• Strictly necessary cookies: essential to the operation of the website and do not require consent;
• Analytics cookies: used to measure website traffic and user interaction (Google Analytics 4); consent is required prior to activation;
• Advertising cookies: used for remarketing purposes (Google Ads); consent is required prior to activation.

You may withdraw consent for non-essential cookies at any time by adjusting your browser settings or, where applicable, through the cookie preference centre on this website. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Under the GDPR, individuals whose personal data is processed by the Company have the following rights:

• Right of access (Article 15): to obtain confirmation of whether personal data is being processed and to receive a copy of that data;
• Right to rectification (Article 16): to request correction of inaccurate or incomplete personal data;
• Right to erasure (Article 17): to request deletion of personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable legal retention obligations;
• Right to restriction (Article 18): to request that the processing of personal data be restricted in certain circumstances;
• Right to data portability (Article 20): to receive personal data in a structured, commonly used, and machine-readable format, where processing is based on consent or contract;
• Right to object (Article 21): to object to processing based on legitimate interests, including profiling;
• Right not to be subject to automated decision-making (Article 22): the Company does not engage in automated individual decision-making or profiling that produces legal or similarly significant effects.

Requests to exercise any of the above rights should be submitted in writing to info@thecerf.com. The Company will respond within one month of receipt of a valid request, in accordance with Article 12 of the GDPR.

If you consider that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. In France, the supervisory authority is:

The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures are reviewed and updated periodically in accordance with current best practices. Notwithstanding these measures, no transmission of data over the internet can be guaranteed to be entirely secure, and the Company cannot warrant the absolute security of data transmitted to this website.

The Company reserves the right to update this Privacy Policy at any time to reflect changes in its data processing activities or applicable legal requirements. The date of the most recent revision is indicated at the top of this document. Material changes will be communicated through appropriate means where required by law.