Privacy policy
Last updated: 30 September 2026
In short
No analytics or advertising cookie is set without your consent. If you accept, we measure site traffic and the performance of our ads; if you reject, nothing is loaded and the site works the same way. You can change your mind at any time (see “Cookies and trackers”).
Personal data is only collected when you get in touch: contact form, callback request or conversation with the Ambre virtual assistant. That data is used to reply to you. It is never sold or shared.
Data controller
What we collect
Contact form
The following fields are sent when you submit the form:
- Name
- Company
- Work email address
- Phone number
- Topic of the enquiry
- Message
Only the name and email address are required. The other fields help us prepare a useful answer.
Callback request
When you ask for a callback, we receive your name, your phone number and, if you provide them, your company, the nature of the request, your preferred time and a few words about your topic.
Ambre virtual assistant
Ambre is an assistant based on artificial intelligence. The messages you write to her are sent from our server to Google's Gemini language model service to generate her answers. Anything that looks like a card number or a password is masked automatically before sending; never share passwords, access codes or sensitive data. During your visit the conversation is kept in your browser's session storage, cleared when the tab is closed.
Skill Group stores nothing until you agree that Ambre sends your request. If you agree, we store the contact details you give, the information relevant to the request (company, need, size, sites, timing, ticket reference where relevant), the summary prepared by Ambre and the text of the conversation. Ambre's answers do not bind Skill Group: any proposal is confirmed by the team. Ambre makes no decision about you.
Request context
With your request, we record the page you sent it from, the page through which you arrived on the site, the type of page viewed just before (for example an expertise or industry page), the referring site and, if you came from a campaign, its parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term). This information is kept during your visit in your browser's session storage, cleared when the tab is closed, and attached to your request only if you send it.
If you accepted advertising cookies, the identifier of your click on our ad (for example gclid for Google, fbclid for Meta, li_fat_id for LinkedIn) is kept for 90 days in your browser and attached to your request if you send one. It tells us which ad led to a request and lets us inform the advertising platform concerned when the request succeeds.
From your answers (timing, company size, topic, callback requested) we also compute a priority indicator that helps us organise our callbacks. It leads to no decision about you: every request is handled.
Server logs
For security and diagnostics, our host automatically keeps connection logs containing the IP address, request timestamp and browser type. We do not use these logs for commercial purposes.
What we do not do
- No analytics or advertising cookie without your consent
- No sale or transfer of your data
- No automated decision about you
- No calls to Google Fonts: the site typeface is served from our own domain
The site displays partner technology logos, served from our own domain. If one were missing, a fallback request would be made to cdn.simpleicons.org, without sending any information about you beyond the HTTP request itself.
Purpose and legal basis
Form data is processed to answer your enquiry and, where relevant, prepare a commercial proposal. The legal basis is your consent, given by submitting the form, together with our legitimate interest in responding to a business enquiry.
Audience and advertising measurement rest on your consent, collected by the cookie banner (article 82 of the French Data Protection Act), which you can withdraw at any time.
Server logs rest on our legitimate interest in keeping the service secure and available.
Recipients and processors
Your data is accessible only to the Skill Group staff handling your enquiry. We use the following processors:
- Netlify, Inc. : site hosting and form handling. A United States company, covered by the European Commission's standard contractual clauses.
- Microsoft 365 (Microsoft Ireland Operations Ltd) : delivery and storage of notification emails.
- Supabase, Inc. : database storing requests sent through the contact form and the Ambre assistant, and the record of your cookie choices. Data hosted in the European Union; a United States company, covered by the European Commission's standard contractual clauses.
- Google LLC (Gemini API) : generation of the Ambre assistant's answers from the messages you send her. A United States company, processing governed by the Gemini API terms and Google's data processing terms, which include the European Commission's standard contractual clauses. For a publisher established in the European Economic Area, these terms exclude using the messages to improve Google's products.
Only with your consent, browsing data is also shared with:
- Google Ireland Limited (Google Tag Manager, Google Analytics, Google Ads): processor for audience measurement, controller of its own processing for advertising.
- Meta Platforms Ireland Limited (Meta pixel): joint controller for the collection by the pixel, controller of its own processing afterwards.
- LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag): joint controller for the collection by the tag, controller of its own processing afterwards.
Transfers outside the European Union
Site hosting is provided by a United States company, and the mailbox that receives your enquiries runs on infrastructure that may involve processing outside the European Union. These transfers are covered by the standard contractual clauses adopted by the European Commission, alongside each provider's own security measures.
Data shared with your consent with Google, Meta and LinkedIn may be processed in the United States by their parent companies, certified under the EU-US Data Privacy Framework recognised by the European Commission on 10 July 2023.
Retention
- Enquiries with no commercial follow-up: three years from last contact
- Enquiries leading to a contract: duration of the contract, then the applicable statutory retention periods
- Host server logs: twelve months at most
- Cookie choices: six months in your browser; record of that choice: thirteen months
- Analytics and advertising cookies: thirteen months at most (see the list above)
- Traffic statistics in Google Analytics: fourteen months
Your rights
You have the right to access, correct, erase, restrict, object to and port your data. Write to contact@skill-group.fr at any time. We answer within one month.
If our answer does not satisfy you, you may lodge a complaint with the French data protection authority, cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Security
The site is served over HTTPS only. Form submissions are encrypted in transit and protected by an anti-bot measure. Access to received messages is limited to authorised staff.
Changes to this policy
Any substantial change will be reflected in the date shown at the top of this page. Please check it whenever you get in touch again.