This notice explains what personal data LIFeLiDAR SAS processes, why it does so, how long the data is retained, and the rights available under the GDPR. It applies to visitors to lifelidar.com, people who correspond with the company, and contacts involved in commercial, contractual, or research work.
Identity of the controller
The data controller is LIFeLiDAR SAS, a société par actions simplifiée registered in France, with its registered office at:
LIFeLiDAR SAS1 Place Sophie Laffitte
06560 Valbonne
Sophia Antipolis, France
Data-protection enquiries: info@lifelidar.com. The company has not appointed a Data Protection Officer because it considers that the criteria in Article 37 GDPR do not apply. Requests are handled through the contact above.
Scope
This notice covers personal data received through the public website at lifelidar.com, contact and contract correspondence (email, telephone), commercial registers and tender procedures, and research collaboration records. Independent third parties, such as funding agencies, peer-review platforms, and journal publishers, process data under their own notices and are outside this scope.
The notice does not cover bio-optical measurements taken in the field. Survey outputs (chlorophyll, CDOM, sediment, hydrocarbon signatures) are environmental measurements and do not constitute personal data within the meaning of Article 4(1) GDPR.
Categories of personal data we process
The company may process the following categories of personal data:
- Identification and contact
- Name, organisation, role, professional email address, telephone, postal address.
- Correspondence content
- Body of emails, messages submitted through the contact form, attachments.
- Contractual data
- Counterparty identifiers, purchase orders, invoices, banking details for payment, signatory information on contracts.
- Technical website data
- IP address, user-agent string, referrer, pages requested, timestamps. Held in raw server logs.
- Newsletter subscriptions
- Email address, optional name, submission timestamp, source page, and the version of the consent wording accepted on the form. Email addresses are not verified, and no delivery or open events are collected.
The company does not intend to process special-category data within the meaning of Article 9 GDPR, and does not carry out automated decision-making within the meaning of Article 22 GDPR.
Purposes and lawful basis
Each processing activity rests on one of the lawful bases set out in Article 6(1) GDPR:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing requested information | Pre-contractual measure at the data subject's request, Art. 6(1)(b) |
| Performing contracts (sales, services, collaboration agreements) | Performance of a contract, Art. 6(1)(b) |
| Issuing invoices and meeting accounting obligations | Compliance with a legal obligation, Art. 6(1)(c) |
| Maintaining server logs for security and integrity | Legitimate interest, Art. 6(1)(f) |
| Recording subscriptions for future newsletter editions | Consent, Art. 6(1)(a) |
| Defending or pursuing legal claims | Legitimate interest, Art. 6(1)(f) |
Where processing relies on consent, the data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Newsletter subscriptions are recorded when the form is submitted with the consent checkbox selected. No confirmation email is sent. Newsletter delivery has not started. To withdraw your subscription, email info@lifelidar.com.
Recipients and processors
Website enquiries and newsletter subscriptions are stored in the company's internal Pipelines application and can be viewed by all authorised team members with an account. Categories of external recipients are limited and bound by data-processing agreements where required:
- Infrastructure providers, managed hosting and domain services located within the European Economic Area.
- Accounting and audit, chartered accountant and statutory auditor, subject to professional secrecy.
- Banking partners, for the purpose of payment processing.
- Public authorities, where disclosure is required by law, court order, or regulatory request.
Personal data is not sold, rented, or otherwise made available for direct-marketing purposes outside the company.
International transfers
Personal data is primarily processed within the European Economic Area. Where a processor operates infrastructure outside the EEA, transfers are governed by an adequacy decision of the European Commission or, in its absence, by the Standard Contractual Clauses adopted under Article 46(2)(c) GDPR, together with any supplementary measures required by the case law of the Court of Justice of the European Union.
A copy of the safeguards in place for any specific transfer may be requested from info@lifelidar.com.
Retention
Personal data is retained only for the period required by the purpose for which it was collected, by applicable legal obligations, or by the statute of limitations. Indicative periods:
| Category | Period |
|---|---|
| Enquiry and prospect correspondence | 3 years from last contact |
| Contractual and commercial records | 10 years (French Commercial Code, Art. L. 123-22) |
| Accounting records and supporting documents | 10 years |
| Server access logs | 12 months |
| Newsletter subscription | Until withdrawal of consent, then 3 years from withdrawal for proof of consent |
After the operational retention period, data may be placed in a restricted archive for the applicable limitation period, then deleted or anonymised.
Your rights
Under Articles 15 to 22 GDPR, individuals may have the following rights in relation to personal data held about them:
- Access, to obtain confirmation of processing and a copy of the data (Art. 15).
- Rectification, to correct inaccurate or incomplete data (Art. 16).
- Erasure, to obtain deletion of the data in the cases listed in Article 17.
- Restriction, to limit processing in the cases listed in Article 18.
- Portability, to receive data provided in a structured, commonly used, machine-readable format and to transmit it to another controller, where Article 20 applies.
- Objection, to object, on grounds relating to the particular situation, to processing based on legitimate interest (Art. 21).
- Withdrawal of consent, to withdraw consent at any time without effect on prior lawfulness (Art. 7).
- Post-mortem directives, to issue directives regarding the use of personal data after death, pursuant to French Loi Informatique et Libertés Art. 85.
To exercise any of these rights, write to info@lifelidar.com or to the postal address shown above. Identification may be required where reasonable doubt exists as to the requester's identity. A response is provided within one month of receipt, extendable by two further months under Article 12(3) GDPR where the request is complex.
Security
The company implements technical and organisational measures appropriate to the nature of the data processed, including transport-layer encryption, access control on a need-to-know basis, periodic credential rotation, and logging of administrative actions. In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the supervisory authority is notified within 72 hours of becoming aware, in accordance with Article 33 GDPR.
Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement.
The competent authority in France is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
Contact
Questions and requests concerning this notice or the company's processing of personal data may be sent to:
LIFeLiDAR SAS, Data Protection1 Place Sophie Laffitte
06560 Valbonne, France
info@lifelidar.com
Updates to this notice
We may revise this notice when our processing activities, applicable rules, or supervisory guidance change. The date below records the latest revision; significant changes will be identified on the page.
Last updated, 13 September 2026