This notice describes the personal data that LIFeLiDAR SAS processes, the purposes for which it is processed, the legal grounds, the retention periods, and the rights individuals hold under the GDPR. It applies to visitors of lifelidar.com, recipients of correspondence, and counterparties engaged in commercial, research, or contractual dealings with the company.
01 · Identity of the controller
The data controller is LIFeLiDAR SAS, a société par actions simplifiée registered in France, with its registered office at:
LIFeLiDAR SAS1 Place Sophie Laffitte
06560 Valbonne
Sophia Antipolis, France
General data-protection enquiries: info@lifelidar.com. The company has not appointed a designated Data Protection Officer; statutory criteria under Article 37 GDPR are not met. The contact above handles requests in lieu.
02 · Scope
This notice covers personal data collected through the public website at lifelidar.com, contact and contract correspondence (email, telephone), commercial registers and tender procedures, and research collaboration records. It does not cover personal data processed by independent third parties on their own infrastructure (e.g. funding agencies, peer-review platforms, journal publishers); refer to their own notices.
The notice does not cover bio-optical measurements taken in the field. Survey outputs (chlorophyll, CDOM, sediment, hydrocarbon signatures) are environmental measurements and do not constitute personal data within the meaning of Article 4(1) GDPR.
03 · Categories of personal data we process
The company processes the following categories of personal data:
- Identification & contact
- Name, organisation, role, professional email address, telephone, postal address.
- Correspondence content
- Body of emails, messages submitted through the contact form, attachments.
- Contractual data
- Counterparty identifiers, purchase orders, invoices, banking details for payment, signatory information on contracts.
- Technical website data
- IP address, user-agent string, referrer, pages requested, timestamps. Held in raw server logs.
- Newsletter data (when offered)
- Email address, double opt-in confirmation timestamp, delivery and open events.
No special categories of data within the meaning of Article 9 GDPR are processed. No automated decision-making within the meaning of Article 22 GDPR is performed.
04 · Purposes and lawful basis
Each processing activity rests on one of the lawful bases set out in Article 6(1) GDPR:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing requested information | Pre-contractual measure at the data subject's request — Art. 6(1)(b) |
| Performing contracts (sales, services, collaboration agreements) | Performance of a contract — Art. 6(1)(b) |
| Issuing invoices and meeting accounting obligations | Compliance with a legal obligation — Art. 6(1)(c) |
| Maintaining server logs for security and integrity | Legitimate interest — Art. 6(1)(f) |
| Sending the newsletter (when offered) | Consent — Art. 6(1)(a) |
| Defending or pursuing legal claims | Legitimate interest — Art. 6(1)(f) |
Where processing relies on consent, the data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
05 · Recipients and processors
Personal data is accessed by authorised employees of LIFeLiDAR SAS on a need-to-know basis. Categories of external recipients are limited and bound by data-processing agreements where required:
- Infrastructure providers — managed hosting and domain services located within the European Economic Area.
- Transactional and newsletter email — Resend Inc., used to deliver service and marketing email when applicable.
- Accounting and audit — chartered accountant and statutory auditor, subject to professional secrecy.
- Banking partners — for the purpose of payment processing.
- Public authorities — where disclosure is required by law, court order, or regulatory request.
Personal data is not sold, rented, or otherwise made available for direct-marketing purposes outside the company.
06 · International transfers
Personal data is primarily processed within the European Economic Area. Where a processor operates infrastructure outside the EEA, transfers are governed by an adequacy decision of the European Commission or, in its absence, by the Standard Contractual Clauses adopted under Article 46(2)(c) GDPR, together with any supplementary measures required by the case law of the Court of Justice of the European Union.
A copy of the safeguards in place for any specific transfer may be requested from info@lifelidar.com.
07 · Retention
Personal data is retained only for the period required by the purpose for which it was collected, by applicable legal obligations, or by the statute of limitations. Indicative periods:
| Category | Period |
|---|---|
| Enquiry and prospect correspondence | 3 years from last contact |
| Contractual and commercial records | 10 years (French Commercial Code, Art. L. 123-22) |
| Accounting records and supporting documents | 10 years |
| Server access logs | 12 months |
| Newsletter subscription | Until withdrawal of consent, then 3 years from withdrawal for proof of consent |
Beyond the operational retention period, data may be archived in restricted form for the duration of the relevant limitation period before being deleted or anonymised.
08 · Your rights
Under Articles 15 through 22 GDPR, data subjects have the following rights with respect to the personal data the company processes about them:
- Access — to obtain confirmation of processing and a copy of the data (Art. 15).
- Rectification — to correct inaccurate or incomplete data (Art. 16).
- Erasure — to obtain deletion of the data in the cases listed in Article 17.
- Restriction — to limit processing in the cases listed in Article 18.
- Portability — to receive data provided in a structured, commonly used, machine-readable format and to transmit it to another controller, where Article 20 applies.
- Objection — to object, on grounds relating to the particular situation, to processing based on legitimate interest (Art. 21).
- Withdrawal of consent — to withdraw consent at any time without effect on prior lawfulness (Art. 7).
- Post-mortem directives — to issue directives regarding the use of personal data after death, pursuant to French Loi Informatique et Libertés Art. 85.
To exercise any of these rights, write to info@lifelidar.com or to the postal address shown above. Identification may be required where reasonable doubt exists as to the requester's identity. A response is provided within one month of receipt, extendable by two further months under Article 12(3) GDPR where the request is complex.
10 · Security
The company implements technical and organisational measures appropriate to the nature of the data processed, including transport-layer encryption, access control on a need-to-know basis, periodic credential rotation, and logging of administrative actions. In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the supervisory authority is notified within 72 hours of becoming aware, in accordance with Article 33 GDPR.
11 · Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement.
The competent authority in France is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
12 · Contact
Questions, requests, and concerns regarding this notice or the processing of personal data by the company may be addressed to:
LIFeLiDAR SAS — Data Protection1 Place Sophie Laffitte
06560 Valbonne, France
info@lifelidar.com
13 · Updates to this notice
The notice may be revised to reflect changes in processing activities, in the regulatory environment, or in published guidance from supervisory authorities. The date below records the most recent revision. Material changes are signalled on the page; routine clarifications are not.
Last updated · 11 May 2026