PERSONAL DATA PROTECTION POLICY

1. Purpose and scope

This policy describes how MARVIN.AI processes the personal data collected via the ask-marvin.ai website (showcase site).

It does not cover use of the MARVIN.AI SaaS platform accessible to clients: on that platform, MARVIN.AI acts as a processor (Art. 28 GDPR) on the instructions of the client company, which remains the data controller. The details of the processing carried out on the platform are provided under the client contract (DPA and dedicated policy).

2. Data controller

For the processing related to this showcase website, the data controller is:

MARVIN.AI, SAS with share capital of €1,000.00
46 rue Saint-Antoine — 75004 Paris
Paris RCS 102 383 452

Data Protection Officer (DPO): dpo@ask-marvin.ai

3. Data collected

3.1 — Contact form

When you write to us via the contact form, you send us:

• your first and last name;
• your professional email address;
• where applicable, your company and your job title;
• the content of your message.

No sensitive data within the meaning of Article 9 of the GDPR is requested.

3.2 — Technical data

When you browse the site, technical data is processed by our host Cloudflare for security and proper-functioning purposes (IP address, browser type, URL visited, timestamp). This data is kept temporarily (≈ 30 days) then deleted.

3.3 — Anonymous audience measurement

The site uses Cloudflare Web Analytics, which sets no cookie and stores neither an individual IP address nor an identifier allowing cross-site tracking. The aggregated statistics cover the number of page views, countries of origin and traffic sources.

4. Purposes and legal bases

• Responding to your contact request — Performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR).
• B2B commercial prospecting (follow-ups, demos, professional content) — MARVIN.AI's legitimate interest in promoting its business to professional prospects (Art. 6(1)(f)). Right to object guaranteed at any time.
• Site security, abuse prevention, logging — Legitimate interest (Art. 6(1)(f)).
• Anonymous audience measurement — Legitimate interest (Art. 6(1)(f)), CNIL consent exemption for strictly necessary audience measurement.

In accordance with the CNIL guidance applicable to B2B prospecting, you can object at any time to receiving commercial solicitations by writing to dpo@ask-marvin.ai or via the unsubscribe link included in our communications.

5. Retention periods

• Messages received via the contact form and associated contact details — 3 years from the last contact (period recommended by the CNIL for B2B prospecting), then deletion or archiving in a legal archive database.
• Cloudflare technical logs — approximately 30 days.
• Anonymous audience statistics — no limit (non-personal data).

6. Recipients and processors

The data is accessible to authorized staff within MARVIN.AI (sales and support teams). It is also processed by the following technical processors:

• Cloudflare, Inc. — Site hosting (CF Pages), CDN, security (anti-DDoS), anonymous audience measurement. Location: United States (global network).
• Twilio SendGrid — Delivery of notification emails. Location: United States.
• Axeptio SAS — Cookie consent management platform (collection and storage of your choices). Location: European Union (France).

The data may also be processed by the internal office and messaging tools used by MARVIN.AI, hosted in the European Union. Each processor is bound to MARVIN.AI by a contract governing the processing of personal data, in accordance with Article 28 of the GDPR.

7. Transfers outside the European Union

Cloudflare and Twilio SendGrid are established in the United States. Transfers are governed by:

• the European Commission's standard contractual clauses (decision 2021/914);
• the processors' certification under the EU–US Data Privacy Framework (adequacy decision of 10 July 2023);
• additional technical measures (TLS encryption in transit, access controls, logging).

No data from the site is transferred to other third countries.

8. Your rights

In accordance with Articles 15 to 22 of the GDPR and the amended French Data Protection Act, you have the following rights over your data:

• right of access;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to portability;
• right to object, in particular to commercial prospecting;
• right to define post-mortem directives regarding the fate of your data.

You can exercise these rights by writing to dpo@ask-marvin.ai, providing proof of your identity in the event of reasonable doubt. MARVIN.AI responds within one month, extendable by two months if the request is complex.

You also have the right to lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris — www.cnil.fr).

9. Security

MARVIN.AI implements appropriate technical and organizational measures to protect data against any destruction, loss, alteration, disclosure or unauthorized access: end-to-end TLS encryption, named access controls with strong authentication, logging, environment separation and an incident-management policy.

10. Cookies and consent management

The site uses a consent management platform (CMP) provided by Axeptio (Axeptio SAS, France). From your first visit, a banner lets you accept, refuse or configure by category the cookies and trackers that are not strictly necessary. Refusing is as easy as accepting, and your choice is stored for your subsequent visits.

In accordance with CNIL recommendations, no cookie or tracker subject to consent is placed before your agreement. To this end, the site implements Google Consent Mode v2 in "advanced" configuration: by default, storage for audience-measurement and advertising purposes (analytics_storage, ad_storage, ad_user_data, ad_personalization) is set to "denied" and is only activated after your consent is collected.

Cookies strictly necessary for the technical operation of the site, as well as the cookieless anonymous audience measurement (Cloudflare Web Analytics, see § 3.3), do not require consent.

You can change or withdraw your choice at any time by reopening the Axeptio cookie management panel, accessible via the "Manage my cookies" link on the site.

11. Changes to the policy

MARVIN.AI may update this policy to reflect changes to the site, its processors or the regulations. The version in force is the one published on this page. The date at the bottom of the document indicates the last update. In the event of a substantial change, a notice will be displayed on the homepage for a reasonable period.