Last updated: 10 October 2026. This English version is provided for convenience; only the French version is legally binding.
CB Systems (Céleste Bellier EI) takes the protection of personal data seriously, in line with the General Data Protection Regulation (GDPR) and the French Data Protection Act. This policy explains what data we process, in what capacity, why, with whom, and what your rights are. It complements our terms of sale and our legal notice.
1. Data controller
Céleste Bellier EI, micro-enterprise, SIREN 102 895 836, 9 Rue Fiol, 69003 Lyon, France. Contact: contact@cb-systems.fr.
2. Our two roles: controller or processor
Controller: for data we collect and use on our own behalf: website visitors, contact, appointment and audit requests, business prospecting, customer management, shop orders and withdrawals.
Processor: when we process personal data on behalf of our customers, through the automations and tools we set up for them (replies to Google reviews, loyalty programmes, review collection, website forms, follow-ups of their own customers). Our customer is then the controller, we act on its instructions, and a data processing agreement under article 28 GDPR governs the relationship (see section 12).
3. Data collected
Website, contact, appointments and audit. Name, email, phone, company and town (if you provide them), the slot, format and subject of the meeting, the content of your messages, and the history of your requests and cancellations.
Shop. Order and delivery details (name, address, email). Payment is handled by our provider Stripe: we never store your card details. For a withdrawal: name, email, order and products concerned, and the content of your statement.
Business prospecting (B2B). Business contact details of establishments (name, sector, area, public address, phone and website, business email published on their website), together with their public Google rating and reviews, including the display name of the authors of the reviews we quote as examples in our messages. This data comes from public sources (Google business profile, the establishment's website) and is used to offer our services.
Browsing. Anonymous audience measurement data, see section 11. Our servers also keep technical logs (IP address, browser type) for security.
On behalf of our customers (processor). Depending on the tool: for replies to Google reviews, the display name, rating, text and date of reviews posted on our customer's profile, and the reply published; for a loyalty programme, first name, last name, email, phone, date of birth, visit history and consent; or messages received through their website form. This data belongs to our customer and is processed on its instructions.
4. Purposes
Answering your requests; organising and managing appointments; producing and sending requested audits; performing services, delivering orders and handling withdrawals; keeping our customer and prospect files; business prospecting; meeting our accounting and legal obligations; securing and improving the website. And, as a processor, running the automations agreed with our customers on their behalf.
5. Legal bases
Depending on the case: your consent (forms, audit, marketing communications); performance of a contract (services, orders); a legal obligation (invoicing, withdrawal, statutory guarantees); our legitimate interest (website security, B2B prospecting, with a right to object). For processing carried out as a processor, the legal basis is determined by our customer, the controller.
6. Retention periods
Prospects: 3 years from the last contact. Prospecting objection list: 3 years from your request, to make sure you receive no further messages. Customers: 10 years after the end of the contract (accounting obligations). Shop: 10 years for accounting records, 5 years for exchanges about withdrawals, guarantees and complaints (limitation period). Server logs: 12 months. Audience measurement: limited to that purpose. Data processed on behalf of a customer: kept for the term of our contract with that customer, then returned or deleted on its instructions.
7. Recipients and processors
Your data is never sold. We use technical processors, strictly as needed for the purposes above:
- Hostinger: hosting of the website, our automations and databases, on servers located in the European Union;
- our automation platform n8n, self-hosted on our EU servers;
- Google (Ireland / LLC): calendar, email, maps and business profile services, and search measurement, depending on the service;
- Stripe: payment of shop orders;
- Anthropic (Claude AI models): drafting replies to Google reviews and the example replies in our prospecting messages, with the minimum data needed and a contractual ban on reusing it for its own purposes, including model training;
- an SMS provider (Twilio), where SMS are planned;
- productivity tools (for example Notion).
8. Transfers outside the European Union
We favour hosting and processing within the European Union. Some providers (Google, Stripe, Anthropic, Twilio, Notion) may involve transfers outside the EU, in particular to the United States; such transfers are covered by the safeguards provided by the GDPR (adequacy decision or standard contractual clauses), a copy of which you can request at contact@cb-systems.fr.
9. Prospecting, communications and objection
Marketing communications are only sent with your consent, or within the scope of lawful B2B prospecting. Each of our prospecting messages states where your contact details come from and links to this policy. You can object at any time, simply by replying to the message or by writing to contact@cb-systems.fr: your address is then added to our objection list and receives no further messages. The loyalty programmes we run on behalf of our customers rely on the consent of the people concerned and always include an unsubscribe link.
10. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, and the right to set instructions regarding your data after your death. To exercise them, write to contact@cb-systems.fr: we reply within one month (extendable by two months for complex requests). When we process your data on behalf of one of our customers, we forward your request to that customer, the controller, to whom you may also apply directly. You may lodge a complaint with the CNIL.
11. Audience measurement, cookies and local storage
The website sets no cookies. Traffic is measured by a minimal in-house system: a session flag kept in your browser's storage (sessionStorage, cleared when the tab is closed) and a visit event sent to our own tools, hosted on our server, containing the page viewed, the referring site, any campaign parameters (UTM), the device category (mobile, tablet or desktop) and whether the session is new. No IP address, identifier or data that could identify you is recorded by this system; no profile is built; nothing is shared with third parties or combined across sites.
The shop basket is kept in your browser's local storage (localStorage), only to remember the items you chose; it is cleared after payment. We use no advertising trackers. These systems, limited to anonymous in-house audience measurement and to the basket you request, fall within the consent exemptions set out in the CNIL guidelines.
12. Processing on behalf of our customers
When we set up a tool processing personal data for a customer (reviews, loyalty, forms, follow-ups), we act under a data processing agreement complying with article 28 GDPR (article 11 and appendix 2 of our terms of sale), which sets out the subject matter, duration, nature and purpose of the processing, the data and data subjects, security measures, the use of sub-processors and what happens to the data at the end of the contract (return in a usable format or deletion). Each customer warrants that it has a legal basis for the data entrusted to us and has informed the people concerned.
13. Data security
We implement appropriate technical and organisational measures: hosting in the European Union, restricted and authenticated access, data segregation per customer, databases not publicly exposed, regular encrypted backups, and firewalls. In the event of a data breach likely to put your rights at risk, we notify the people and authorities concerned as required by the GDPR.
14. Contact
For any question about this policy or your data: contact@cb-systems.fr.