Data protection
Privacy policy
Last updated: 20 August 2026
This is a courtesy translation. Only the French version is legally binding; in the event of any discrepancy, the French text prevails.
Our business consists of handling customer data and financial flows. We therefore treat data protection as a condition of practice, not a formality. This document explains which data we process, why, for how long, and what your rights are.
1. Data controller
NCC — Nicolas Costes Consulting, an EURL (French single-member limited liability company) with share capital of €100, registered under number 928 145 218 R.C.S. Toulouse, with registered office at 16 rue de la Gimone, 31240 L'Union, France.
For any question relating to personal data: contact@ncostesconsulting.fr. No Data Protection Officer has been appointed, as this is not mandatory given the nature of our activity.
2. This website does not track you
The ncostesconsulting.fr website sets no cookies, uses no audience measurement tool, no advertising pixel and no social media button that tracks your browsing. No consent banner is therefore required.
The Vigileo client guide is displayed entirely within your browser: no reading data is recorded or transmitted.
Our hosting provider OVH SAS does, however, retain technical connection logs (IP address, date and time, pages requested) for a limited period, for security and proper operation of the server. These logs are stored in France and are not used by us for any commercial purpose.
3. Data you send us
The only personal data we collect is what you choose to send us, by email or by telephone:
- identity and role (first name, last name, position held)
- business contact details (email, telephone, company)
- information about your needs (outstanding balance, invoice volume, difficulties encountered)
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to your request for a review or a quotation | Pre-contractual measures taken at your request | 3 years from last contact |
| Managing the contractual relationship and invoicing | Performance of the contract | Term of the contract, then 10 years (accounting obligations) |
| Business-to-business prospecting | Legitimate interest, with a right to object at any time | 3 years from last contact |
4. Recipients
Your data is processed by the Managing Director of NCC — Nicolas Costes Consulting. It is never sold, rented or exchanged. It may be shared with the technical providers strictly necessary to our activity (hosting, email, management tools), acting as processors and bound by confidentiality.
Website hosting and business email are provided by OVH SAS (2 rue Kellermann, 59100 Roubaix, France), on infrastructure located in France. Your exchanges with us therefore remain hosted within the European Union.
We use the providers listed below. Each is bound by a contract governing the security and confidentiality of data, and accesses it only to the extent required for its service. The first three process the data our clients entrust to us — they are our sub-processors under section 5; the others relate to our own administrative management.
| Provider | Role | Data location | Transfer safeguards |
|---|---|---|---|
| OVH SAS | Website hosting and business email | France | No transfer outside the European Union |
| Airtable (Formagrid Inc.) | Vigileo database: invoices, customer contacts, collection and dispute tracking | United States | European Commission standard contractual clauses, incorporated into the Data Processing Addendum agreed with Airtable |
| Make (Celonis Inc.) | Orchestration of Vigileo automations: triggering reminders, updating statuses, dispute alerts | European Union (eu2 zone) | Data stored at rest within the European Union. Occasional access from the United States, notably for support, is covered by the Data Privacy Framework to which Celonis Inc. adheres and by standard contractual clauses |
| Brevo (Sendinblue SAS) | Delivery of collection emails and notifications sent to your customers | France, Germany and Belgium | No transfer outside the European Union. French company, servers located exclusively within the European Union |
| LegalPlace (SAS) | Issuing and tracking our own client invoices, administrative and accounting management of NCC | European Union | French company. Data stored in data centres located in European Union member states |
Where a provider hosts data outside the European Union, the transfer is covered either by an adequacy decision of the European Commission or by the standard contractual clauses adopted by that same Commission, supplemented where appropriate by additional security measures. The list above is kept up to date; our clients are informed in advance of any change of sub-processor.
5. Your own customers' data: our role as processor
In the course of our collections, cash management and accounts receivable services, we process data relating to your customers — contact identities, contact details, invoices, payment behaviour and collection correspondence.
For this processing, you remain the data controller and we act as a processor within the meaning of article 28 GDPR. We act solely on your documented instructions and never use this data for any other purpose, in particular never for our own prospecting.
The precise arrangements — nature and duration of processing, categories of data and data subjects, security measures, sub-processors, and the fate of the data at the end of the assignment — are set out in the data processing agreement entered into with each client. On completion, your data is returned to you and then deleted from our systems, subject to any legal retention obligation.
6. Security
We implement measures proportionate to the sensitivity of the data processed: password-protected access with strong authentication, encrypted workstations, file transfer through secure channels, segregation of data between clients, and access strictly limited to those working on the assignment.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability provided for by the GDPR, together with the right to give instructions concerning the fate of your data after your death.
These rights may be exercised at contact@ncostesconsulting.fr. We respond within one month. Proof of identity may be requested where there is reasonable doubt as to the identity of the person making the request.
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
If your request concerns data processed on behalf of one of our clients, we forward it without delay to that client, who is the data controller.
8. Changes
This policy may be updated to reflect legal developments or changes in our practices. The date of the latest update appears at the top of this page.