Privacy policy
What happens — and above all what does not happen — to personal data on this website and in the NavOps application.
Last updated :
In short
This website collects no personal data. It sets no cookies, embeds no trackers, has no forms and runs no server-side processing. The processing described below concerns the NavOps application, which is distinct from this website, and the email exchanges you initiate with us.
1. Data controller
- Controller: Lumicraft Foundry Limited, a private company limited by shares registered in Ireland under number 810922, The Black Church, St. Mary’s Place, Dublin 7, D07P4AX, Ireland.
- Contact for personal data matters: confidentialite@navops.fr.
- Data protection officer: none appointed to date; requests are handled at the address above.
2. The www.navops.fr website
2.1 No collection
The website is strictly static. It has no database, no API and no form. No data you might enter could be transmitted, since there is no receiving endpoint.
2.2 No cookies, no trackers
No cookie is set, not even a technical one. No audience measurement, behavioural tracking or advertising tool is present. No resource is loaded from a third-party domain: fonts are self-hosted, precisely to avoid exposing your browsing to a third party. Your light or dark theme choice is remembered in your browser only, without transmission.
Links leading to the application indicate, in the address itself, the page of the website they come from. The website records nothing; the application may read that indication for its own subscription statistics.
2.3 The host’s technical logs
The website’s host keeps connection logs, which may contain an IP address, for security and operational purposes.
- Legal basis: legitimate interest (service security).
- Retention: twelve months at most.
- Recipient: Scaleway SAS, as processor, in France.
2.4 Writing to the team
The Contact page shows email addresses. If you write to us, your message and its content travel through your mail system and ours. They are kept for as long as needed to handle your request, then for at most three years from the last exchange, so that we can follow up. Legal basis: legitimate interest (responding to an enquiry, business relationship).
3. The NavOps application
The application, available on the app.navops.cloud domain in sovereign
cloud mode or on the customer’s infrastructure in On-Premise mode, carries
out processing that this website does not.
3.1 Data processed
- Account data: professional identity (surname, first name, position), professional email address, role and scope of entities.
- Connection data: timestamps, IP address, multi-factor authentication elements, log of actions on sensitive data.
- Steering data: budgets, contracts, projects, applications and suppliers entered by your teams. This data is not personal by nature; it may incidentally contain personal data (a project manager’s name, a supplier contact).
- Billing data: details of the subscribing entity and its billing contact.
3.2 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the subscribed service, managing accounts and access | Performance of the contract |
| Access security, traceability, incident prevention | Legitimate interest |
| Billing and accounting obligations | Legal obligation |
| Assistance and support | Performance of the contract |
| Information on changes to the subscribed service | Legitimate interest |
No data is used for advertising purposes, sold or rented.
3.3 Respective roles
For account and billing data, Lumicraft Foundry Limited is the data controller.
For steering data entered in the application, the customer is the controller and Lumicraft Foundry Limited acts as processor within the meaning of Article 28 of the GDPR. The terms of that processing are set out in the “Processing of personal data” article of the terms and conditions. In On-Premise mode, the publisher does not access steering data and receives no reporting of it.
3.4 Retention periods
- Account data: for the duration of the contract, then ninety days after its end, for the return of data.
- Connection and action logs: twelve months.
- Steering data: for the duration of the contract. At its end, it remains exportable for ninety days, then is deleted within the following thirty days, backups included. A deletion certificate is provided on request.
- Billing data: ten years, under accounting obligations.
3.5 Processors and location
- Sovereign cloud mode: hosting by Scaleway SAS, French regions, backups included. No transfer outside the European Union.
- On-Premise mode: the data stays on your infrastructure. The publisher has no access to it and receives no reporting.
- Other processors: a billing provider and a service email provider, both established in the European Union.
The current list of processors is provided on request, and any change is notified to customers before it takes effect.
3.6 Security
Technical and organisational measures are described on the Security page: tenant isolation, encryption in transit and at rest, multi-factor authentication, least privilege, access traceability, backups located in France. In the event of a data breach likely to result in a risk to individuals, the customer concerned is informed without undue delay, and the competent supervisory authority within seventy-two hours where regulation requires it — the Irish Data Protection Commission for the processing the publisher controls, the customer’s own authority for the processing it controls itself.
4. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, under the conditions set out in the GDPR. To exercise them, write to confidentialite@navops.fr. A reply is provided within one month, extendable by two months for complex requests.
If you use the application in the course of your professional activity, contact your employer first, as controller of the steering data; we assist them in their reply.
As the publisher is established in Ireland, its supervisory authority is the Data Protection Commission — www.dataprotection.ie.
You may lodge a complaint with it, or with the supervisory authority of your country of residence. In France that is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
5. Changes
This policy may change. The date of the last update appears at the top of the page. Any substantial change concerning the application is communicated to customers through the means provided for in the contract, at least thirty days before it takes effect. The French version of this policy prevails.