Legal

Privacy policy

Last updated: 16 October 2026

In short

I only collect what I need to answer your request and run this site.
No advertising cookies, no data sold or shared for marketing.
Audience measurement (Google Analytics) only runs if you accept it, and you can change your mind at any time.
You can access, correct or delete your data at any time: contact@oryotech.com.

1. Who is responsible for your data

The data controller for this website (oryotech.com) is OryoTech, a sole proprietorship run by ST3RN, SIRET [SIRET], [ADRESSE POSTALE], France.

For any question about your personal data, write to contact@oryotech.com.

2. What data I collect and why

Purpose	Data	Legal basis (GDPR)	Retention
Answering your contact or scoping-call request	Name, work email, the service you need, your message	Steps taken at your request before a contract (Art. 6(1)(b))	3 years after our last exchange, unless we start working together
Running an engagement (audit, pentest, training)	Contact details and the information needed for the engagement	Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c))	Duration of the engagement, then as required by law (e.g. 10 years for accounting records). Technical data from tests is handled under the NDA and the engagement terms.
Blog comments	Name, email, IP address, comment content	Legitimate interest in moderating comments (Art. 6(1)(f))	As long as the comment is published
Website security	IP address, browser information, login attempts, pages requested	Legitimate interest in protecting the site (Art. 6(1)(f))	[X] days in security logs
Audience measurement, to understand how the site is used and improve it (only if you accept)	Pages visited, time on page, referring site, approximate location (country, city), device and browser type, a random identifier stored in a cookie	Your consent (Art. 6(1)(a)), which you can withdraw at any time	Analytics cookies: 13 months maximum. Statistics in Google Analytics: 14 months. Your cookie choice: 6 months

I do not use your data for profiling or automated decisions, and I never sell or rent it.

3. Cookies

Strictly necessary cookies (no consent needed)

technical cookies needed for the site to work securely and quickly;
a cookie that remembers your cookie choice for 6 months;
a cookie remembering your name and email if you choose to save them when posting a comment;
session cookies used for the site's administration, which never concern visitors.

Audience measurement cookies (only with your consent)

If you click Accept on the cookie banner, the site loads Google Analytics 4, which sets the _ga and _ga_ cookies (13 months maximum). They give me anonymous statistics on how the site is used. Google Signals and advertising features are turned off, and the data is not used for advertising.

If you click Refuse, or make no choice, Google Analytics is not loaded at all. Refusing is as easy as accepting and has no effect on your use of the site.

You can change your choice at any time: cookie settings (also in the footer of every page).

There are no advertising cookies on this site.

4. Who receives your data

Only me. To run the site, I rely on a small number of providers who process data on my behalf and are contractually bound to protect it:

Website and email hosting: my hosting provider, identified in the legal notice as required by law. It stores the site, contact form messages and emails.
Anti-spam protection: a bot-detection service on the contact form. It processes technical data such as your IP address and browser information, without advertising cookies.
Comment avatars: a profile-picture service that may display an avatar next to blog comments, based on a hashed version of the commenter's email address.
Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): audience measurement, only if you accept it. Google Analytics 4 does not log or store IP addresses.

Some of these providers may transfer data outside the European Union, in particular to the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses. You can ask for the list of providers and the safeguards that apply by writing to contact@oryotech.com.

5. How your data is protected

I apply technical and organisational security measures suited to the risks, including encrypted connections (HTTPS), strictly limited access, regular updates and monitoring. Messages sent through the contact form are kept with my hosting provider and in my professional mailbox, which only I can access.

6. Your rights

Under the GDPR and the French Data Protection Act, you have the right to:

access your data and get a copy of it;
have it corrected or deleted;
restrict or object to its processing;
receive it in a portable format;
give instructions about what happens to your data after your death.

To exercise these rights, email contact@oryotech.com. I will reply within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr).

7. Changes to this policy

This policy may be updated, for example if the site's tools change. The date at the top of the page shows the latest version.