In short
We are a cybersecurity consultancy: we apply to our own data the restraint we recommend to our clients. In practice, this website sets no cookies, uses no analytics tool and carries no advertising pixel. The only personal data we process is what you send us yourself through the contact form, plus the technical logs required to keep the server secure.
Data controller
- Controller
- PHISHIA, SARL — 29 rue de Bassano, 75008 Paris, France
- Registration
- Nanterre Trade Register B 929 476 471 — SIRET 929 476 471 00016
- Contact
- contact@phishia.fr
PHISHIA has not appointed a Data Protection Officer; requests concerning your data are handled directly by management, at the address above.
What we collect
We collect three things only, and only in the situations described below.
- The contact form — first name, last name, business e-mail address, telephone (optional), company, the subject of your enquiry and the free text of your message. These are the fields you fill in yourself: nothing is inferred or enriched from a third party.
- Contact form logs — for each submission we record the timestamp, the sender's IP address and whether the message was delivered. This trace lets us find a lost enquiry and prove, in the event of a dispute, that a message was indeed received.
- Anti-bot filter logs — when a submission is rejected as automated, we keep the timestamp, the reason for rejection, the IP address, the origin of the request and the declared browser. Neither the message nor the telephone number is kept in that case. This log serves only to check that the filter is not blocking real people.
We collect no special category data within the meaning of Article 9 GDPR, and this website is not addressed to minors.
Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering your enquiry and, where applicable, preparing a proposal | Pre-contractual steps at your request (Art. 6(1)(b)) | 3 years after the last contact |
| Evidencing receipt of an enquiry and retrieving an exchange | Legitimate interest: traceability (Art. 6(1)(f)) | 12 months |
| Protecting the form against automated submissions | Legitimate interest: service security (Art. 6(1)(f)) | 12 months |
| Web server technical logs (access, errors) | Legitimate interest: security and reliability (Art. 6(1)(f)) | As per the host's policy, 12 months at most |
If you object to any of the processing based on our legitimate interest, write to us: we will review the request on its merits and delete the traces concerning you unless something prevents it.
Who has access to your data
Internally, your data is accessible only to the partners and staff of PHISHIA in charge of client relations. It is never sold, rented or exchanged. Our technical processors are:
- Hostinger International Ltd (Larnaca, Cyprus) — website hosting and log storage. Data hosted within the European Union.
- Mailinblack (Marseille, France) — anti-spam filtering of incoming messages, ahead of our mailboxes.
- Microsoft 365 (Microsoft Ireland Operations Limited) — hosting of our business mailboxes, where messages sent through the form arrive.
As Microsoft is a US group, a transfer outside the European Union cannot be ruled out for technical support purposes. Such a transfer is governed by the European Commission's standard contractual clauses and by the EU–US Data Privacy Framework. No other transfer outside the European Union takes place.
Your rights
At any time, you have the following rights over the data concerning you:
- Access — obtain a copy of the data we hold about you;
- Rectification — correct inaccurate or incomplete data;
- Erasure — request the deletion of your data;
- Restriction — freeze a processing operation while it is checked;
- Portability — retrieve your data in an open format;
- Objection — object to processing based on our legitimate interest;
- Post-mortem directives — decide what happens to your data after your death.
To exercise any of these rights, write to contact@phishia.fr, setting out your request. We reply within one month. If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, the CNIL: cnil.fr/fr/plaintes, or 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Cookies
This website places no cookie on your device — not a technical one, not an analytics one, not an advertising one. It carries neither Google Analytics, nor an advertising tag, nor a share button connected to a social network. That is why you are never shown a consent banner.
Typefaces are loaded from Google Fonts, which discloses your IP address to Google when the page is displayed. No cookie is set by that request.
Security
Exchanges with the website are encrypted with TLS. The contact form is protected by a signed token, a bot trap and a cap on the number of submissions per IP address. Access to the logs is restricted at server level and those files are not exposed on the web.
Changes
This policy may change, in particular if we add a tool to the website. Any substantial change will be signalled by the update date below. The website's legal notice is available on the legal notice page.
Last updated : 26 October 2026.