Institutional Arch of Diligence Consulting, House of Educational Diplomacy, opening onto a European landscape within an architecture dedicated to knowledge, cooperation and decision-making.

Privacy Policy

Privacy Policy

Diligence Consulting · House of Educational Diplomacy®
In force as of 25 August 2026 · Version 3.0

This Privacy Policy describes how Diligence Consulting collects, uses, retains and protects the personal data of persons who interact with the House, its forms, its services and its website. It is established in accordance with Regulation (EU) 2016/679 (GDPR), French law No. 78-17 of 6 January 1978 as amended, and the recommendations of the French Data Protection Authority (CNIL).

Contents

  1. Data controller
  2. General processing principles
  3. The nine functions of the House
  4. Processing carried out on behalf of Commanditaires
  5. Technical providers, processors and recipients
  6. Transfers outside the European Union
  7. Cookies and tracers
  8. Data security
  9. Your rights
  10. How to exercise your rights
  11. Complaint to the CNIL
  12. Amendments to this Privacy Policy
  13. Absence of automated decision-making

1. Data controller

Data controller: Diligence Consulting
Legal form: SASU
SIRET: 849 526 389 00010
Registered office: 11 rue des Tisserands, 77930 Fleury-en-Bière, France
Legal representative: Sandrine Ouilibona, President
Point of contact: co*****@******************ng.fr
Purpose of requests: exercise of GDPR rights and any question relating to data protection

Diligence Consulting has not appointed a Data Protection Officer. Questions relating to data protection may be addressed to the point of contact indicated above.

2. General processing principles

Diligence Consulting processes personal data in accordance with the principles set out in Article 5 of the GDPR:

  • Lawfulness, fairness, transparency: processing operations rest on explicit legal bases
  • Purpose limitation: data are used only for the declared purposes
  • Data minimisation: only strictly necessary data are collected
  • Accuracy: data subjects may at any time request the rectification of their data
  • Storage limitation: retention periods are specified for each processing operation
  • Integrity and confidentiality: data are protected by appropriate technical and organisational measures
  • Accountability: the House documents its processing operations and can demonstrate its compliance

3. The nine functions of the House

Diligence Consulting operates nine distinct processing functions as a data controller. Each is described below with its own purpose, legal basis and retention period.

3.1 · Arché request and preliminary examination

Purpose
Receipt and preliminary examination of the institutional request submitted via the Arché form; decision to propose or to decline the opening of a determination.
Legal basis
Pre-contractual measures (Art. 6.1.b GDPR) where the data subject is likely to enter into a contract with Diligence themselves. Otherwise, legitimate interest (Art. 6.1.f GDPR) where the data subject acts in a professional capacity on behalf of a legal entity whose request is being examined.
Data collected
First name, last name, position, professional email, phone number, institution name, institutional website, country of establishment, intended country or countries of entry, institutional question, imminent decision and deadline.
Retention
24 months from the last interaction, for traceability of the preliminary examination.
Recipients
Diligence Consulting only. Processor: HubSpot Inc. (form hosting).

3.2 · Execution of Arché and institutional mandates

Purpose
Formalisation, execution and monitoring of the accepted Arché determination and the institutional mandates entered into by the Commanditaire.
Legal basis
Performance of a contract (Art. 6.1.b GDPR) where the data subject is a party to the contract. Otherwise, legitimate interest (Art. 6.1.f GDPR) relating to the execution of the B2B professional relationship.
Data collected
Identity and professional contact details of signatories and persons involved in the mandate, information relating to the institution and the mandate, steering milestones.
Retention
Duration of the mandate, then 5 years (commercial prescription, Art. L110-4 French Commercial Code). Certain elements necessary for evidence of the contract or for the defence of the House’s rights may be archived until the expiry of applicable limitation periods.
Recipients
Diligence Consulting only. Processors: HubSpot Inc. (relationship), NetExplorer (documentation), Microsoft Corporation (exchanges), Trello (operational steering).

3.3 · Management of Commanditaires’ professional contacts

Purpose
Professional communication with staff members and referents designated by the Commanditaire for the execution of mandates (project leads, technical referents, executives).
Legal basis
Legitimate interest (Art. 6.1.f GDPR) — administration of the B2B relationship with natural persons acting on behalf of the Commanditaire.
Data collected
First name, last name, position, professional contact details, history of relational exchanges and operational steering elements within the framework of the mandate.
Retention
Purely relational CRM data are deleted 36 months after the end of the mandate. Exchanges necessary for evidence of the contract or for the defence of the House’s rights may be retained until the expiry of applicable limitation periods.
Recipients
Diligence Consulting only. Processors: HubSpot Inc., Microsoft Corporation, Trello (steering only).

3.4 · Invoicing and legal obligations

Purpose
Issuance of quotes and invoices, collection, bookkeeping, compliance with tax and legal obligations.
Legal basis
Legal obligation (Art. 6.1.c GDPR) — accounting and tax obligations of the House.
Data collected
Corporate name, invoicing address, VAT number, invoiced and paid amounts, banking details of the Commanditaire, identity of invoicing contacts.
Retention
10 years from the closure of the accounting year (Art. L123-22 French Commercial Code).
Recipients
Diligence Consulting, Qonto (payment institution), chartered accountant, tax authorities upon lawful request.

3.5 · Spontaneous contact requests

Purpose
Response to professional inquiries received via the website forms or by email.
Legal basis
Legitimate interest (Art. 6.1.f GDPR) — responding to persons who take the initiative to contact the House.
Data collected
First name, last name, email, organisation, content of the message.
Retention
12 months after the last interaction, unless converted into a contractual relationship.
Recipients
Diligence Consulting only. Processors: HubSpot Inc., Microsoft Corporation.

3.6 · Targeted B2B prospecting

Purpose
Institutional contact with decision-makers identified within a professional framework, with a view to presenting the services of the House when the approach presents a manifest interest for the data subject in view of their functions.
Legal basis
Legitimate interest (Art. 6.1.f GDPR) — targeted B2B professional prospecting in accordance with the CNIL recommendation on commercial prospecting updated in June 2026.
Source of data
Indirect collection from public sources (institutional directories, organisation websites, professional networks such as LinkedIn, official publications); or direct collection during professional events and conferences in which the House participates.
Data collected
First name, last name, position, organisation, professional contact details, source of identification, contextual elements relevant to the approach.
Retention
3 years from the collection or from the last contact originating from the data subject (CNIL recommendation applicable to prospects).
Information to subject
Upon first contact, and at the latest within one month from the collection save for exceptions provided by the GDPR, the data subject is informed of the purpose of the approach, the source of the data concerning them and their right to object, simply and free of charge, in accordance with Article 14 of the GDPR.
Recipients
Diligence Consulting only. Processors: HubSpot Inc., Microsoft Corporation.

3.7 · Voluntary subscription to editorial communications

Purpose
Sending of the Readings of the House and other editorial publications to persons who have voluntarily subscribed to them.
Legal basis
Explicit consent (Art. 6.1.a GDPR) — separate opt-in checkbox, distinct from other purposes.
Data collected
First name, last name, position, professional email, organisation, opening and click history.
Retention
Until the data subject withdraws consent. An unsubscribe link appears in every communication.
Recipients
Diligence Consulting only. Processor: HubSpot Inc.

3.8 · Audience measurement and website operation

Purpose
Understanding of website traffic on diligence-consulting.fr, measurement of engagement on doctrinal pages, tracking of conversion events (clicks on Arché buttons, downloads).
Legal basis
Consent (Art. 6.1.a GDPR) collected via the cookie management banner. Only cookies strictly necessary for the operation of the website are exempted from consent.
Data collected
Browsing data, technical identifiers (session identifiers, Google Analytics identifiers), traffic source, device type, approximate geographic data, conversion events.
Retention
User-level and event-level data retained by Google Analytics 4: 2 months (configuration adopted by the House). Duration of cookies deposited: in accordance with the default values of the Google Analytics 4 service.
Recipients
Diligence Consulting only. Processors: Google LLC (Google Analytics 4), CookieYes Limited (consent management).

3.9 · Management of objections to prospecting

Purpose
Ensuring the effectiveness of the right to object of persons who have requested to no longer be contacted, by preventing their subsequent reintroduction into a prospecting campaign.
Legal basis
Obligation to respect the right to object (Art. 21 GDPR) and legitimate interest in ensuring its traceability (Art. 6.1.f GDPR).
Data collected
First name, last name, professional email and date of objection. No additional data is retained.
Retention
Minimum 3 years from the expression of the objection, in accordance with the CNIL recommendation of June 2026 on the exclusion list.
Recipients
Diligence Consulting only. Processor: HubSpot Inc. (separate register within the CRM).

4. Processing carried out on behalf of Commanditaires

Within the framework of certain mandates, Diligence Consulting may be required to process personal data concerning the executives, teachers, students, applicants or personnel of a Commanditaire (constitution of institutional files, preparation of audits, regulatory files).

In such situations, Diligence Consulting acts as a processor within the meaning of Article 28 of the GDPR, under the responsibility of the Commanditaire who remains the data controller. Such processing operations do not fall within the scope of this Privacy Policy.

They are governed by a Data Processing Agreement annexed to the engagement letter of the mandate concerned, which defines:

  • the subject-matter, duration, nature and purposes of the processing
  • the categories of data and data subjects concerned
  • the documented instructions of the Commanditaire
  • the technical and organisational security measures
  • the arrangements for the return or deletion of data at the end of the mandate
  • the authorisations relating to subsequent processors

5. Technical providers, processors and recipients

Diligence Consulting relies on the following providers for the implementation of the processing operations described above. Each intervenes according to its own legal status.

5.1 · Processors within the meaning of Article 28 of the GDPR

  • HubSpot Inc. (United States) — Hosting of the CRM, website forms, commercial pipeline and email communications.
  • NetExplorer (France) — Documentary vault hosting Commanditaires’ files, institutional documents and deliverables.
  • Microsoft Corporation (Microsoft 365, United States / European Union) — Outlook professional email and Teams meeting tool.
  • o2switch (Clermont-Ferrand, France) — Hosting of the WordPress website.
  • Atlassian (Trello) — Operational task and milestone management tool, potentially processing limited workflow and user data. No client documents are stored therein.
  • Google LLC (United States) — Google Analytics 4 for website audience measurement.
  • CookieYes Limited (United Kingdom) — Cookie consent management.
  • NortonLifeLock (Gen Digital) (United States) — Workstation cybersecurity.

5.2 · Providers acting as autonomous controllers

  • Qonto (France) — Licensed payment institution, subject to its own regulatory obligations regarding account management, operations monitoring and compliance. Qonto autonomously determines the purposes and means of the processing operations proper to it.

5.3 · Distinct recipients

  • Chartered accountant — Recipient of accounting and tax data within the framework of its assignment. Its precise legal status under the GDPR is defined by its engagement letter.
  • Administrations and authorities — Communication upon lawful or judicial requisition.

5.4 · Ancillary technical suppliers

The House also uses Google Search Console and Semrush for the purpose of monitoring the organic visibility of the website. These tools essentially process aggregated and statistical data relating to the site and its search performance.

5.5 · No commercial transfer

Diligence Consulting does not sell, rent or transfer the personal data collected to any commercial third party.

6. Transfers outside the European Union

Certain technical providers are established outside the European Union, notably in the United States and the United Kingdom.

For the United Kingdom, transfers rely on the adequacy decision renewed by the European Commission in December 2025.

For the United States, where the recipient benefits from the EU-US Data Privacy Framework and where its certification effectively covers the processing concerned, the transfer may rely on this adequacy decision.

In other situations, the House relies on the applicable appropriate safeguards, notably the Standard Contractual Clauses adopted by the European Commission, as well as complementary technical and organisational measures appropriate to the risk.

7. Cookies and tracers

The website diligence-consulting.fr uses different categories of cookies and tracers, whose activation is controlled via the CookieYes consent banner.

7.1 · Strictly necessary cookies

These cookies are essential to the operation of the website. They include in particular the consent management cookie itself. They are exempt from consent.

7.2 · Audience measurement cookies

Cookies placed by Google Analytics 4 for the audience measurement of the website are subject to your prior consent via the banner.

7.3 · Form-related cookies

Cookies that may be placed by HubSpot in connection with the use of the website’s forms are managed according to the configuration of the consent manager.

You may modify your choices at any time via the cookie management icon present on the website.

8. Data security

Diligence Consulting implements technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR, notably access control mechanisms, secure transmissions, backup and incident management.

The details of the technical measures depend on the specific configurations of each provider and tool used. They are documented in the internal register of processing activities of the House.

In the event of a data breach likely to result in a risk to the rights and freedoms of data subjects, a notification is sent to the CNIL within 72 hours, in accordance with Article 33 of the GDPR.

9. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR), notably for prospecting
  • Right to withdraw consent (Art. 7 GDPR)
  • Right to set post-mortem directives (French Data Protection Act)

These rights are exercised under the conditions and within the limits provided for by the regulation. Certain rights depend in particular on the legal basis of the processing concerned and do not apply uniformly to all processing operations.

10. How to exercise your rights

You may exercise your rights by email at the following address:

co*****@******************ng.fr

Subject of the message: “Exercise of GDPR rights”

Please specify in your request:

  • The right you wish to exercise
  • The processing operation or operations concerned
  • Any element allowing verification of your identity

Diligence Consulting undertakes to respond within a maximum period of one (1) month from the receipt of the request, in accordance with Article 12 of the GDPR. This period may be extended by two additional months in the event of a complex request or a high number of requests.

Identity verification is required to prevent any disclosure to an unauthorised third party. Proof of identity may be requested in the event of reasonable doubt as to the identity of the requester.

11. Complaint to the CNIL

If you consider, after having contacted us, that your rights are not respected, you have the right to lodge a complaint with the French supervisory authority:

Authority: Commission Nationale de l’Informatique et des Libertés (CNIL)
Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Phone: +33 1 53 73 22 22
Website: www.cnil.fr
Online complaint form: www.cnil.fr/plaintes

12. Amendments to this Privacy Policy

This Privacy Policy may be updated to reflect the legal, technical or organisational developments applicable to the processing operations.

Any substantial modification affecting the rights of the data subjects or the essential conditions of a processing operation shall be subject to appropriate information, the arrangements of which shall be adapted to the nature of the modification and to the data subjects concerned.

The collection forms of the House (Arché form, contact form, subscription checkbox for the Readings) also carry a short information notice referring to this Privacy Policy, in accordance with Articles 13 and 14 of the GDPR.

13. Absence of automated decision-making

Diligence Consulting does not take any decision producing legal effects or significantly affecting a person on the sole basis of automated processing within the meaning of Article 22 of the GDPR.

The Arché determination and the decisions relating to mandates remain, in all circumstances, an institutional reading rendered by the House. No form, engagement score or automated processing substitutes for this human determination.

Privacy Policy · Version 3.0 · In force as of · General Terms of Sale