Privacy Policy

1. Data controller

EPR Representative (SASU, SIREN 108 686 874), registered office 61 rue de Lyon, 75012 Paris, France, is the data controller for the personal data collected through this website and through the provision of EPR authorized representative services. Contact: via the contact form.

2. Data we collect

Through the contact form: name, business email, company name, country, message content. Through the mandate process: company registration data, tax IDs, contact persons, product data, sales channels, and accounting data needed to file eco-organism declarations.

Through the free audit form (French companies): company name, SIREN, email, phone (optional), eco-organisations concerned, notes and attached files (declarations, eco-organisation invoices). Attached files are transmitted by email to EPR Representative and are not stored on the website: the server reads them to attach them to the email, then discards them.

Through routine web traffic: IP address, browser type, pages viewed, logged by our hosting provider. We measure audience with Cloudflare Web Analytics, which works without cookies and reports aggregated page views without identifying visitors, and we use Google Search Console, which reports how the site appears in Google Search and places nothing on this site. We set no advertising cookies and carry out no personal profiling or cross-site tracking.

3. Legal bases (GDPR article 6)

We rely on a different legal basis depending on the processing activity:

• Pre-contractual steps (Art. 6(1)(b) GDPR), for quote requests, scoping conversations, contact form submissions, partnership inquiries: data is processed to respond to a request you made before any contract is signed.
• Consent (Art. 6(1)(a)), for the lead-magnet download (PDF checklist) and any optional follow-up communications with educational content. Consent is freely given when you submit the form and may be withdrawn at any time.
• Performance of the contract (Art. 6(1)(b)), once a mandate is signed, for filing dossiers with eco-organisms, ADEME SYDEREP, marketplace handoffs, and annual declarations.
• Legal obligation (Art. 6(1)(c)), for French EPR retention, accounting and tax obligations.
• Legitimate interest (Art. 6(1)(f)), for operating and securing the website (anti-spam honeypots, server logs).

4. Recipients and named sub-processors

Personal and business data is shared, strictly for service execution, with the French eco-organisms (Citeo, Léko, Adelphe, Citeo Pro, Ecosystem, Ecologic, Refashion, Ecomaison, Valdelia, Batribox, Valobat, Ecominéro), ADEME via the SYDEREP system, and, when required, marketplaces verifying registration numbers (Amazon France, Cdiscount, ManoMano, Fnac/Darty, TikTok Shop FR).

Named third-party sub-processors (Art. 13(1)(e) GDPR):

• Cloudflare, Inc. (United States), website hosting, content delivery and audience measurement (Cloudflare Web Analytics: no cookie, aggregated page views, no visitor identified). Privacy: cloudflare.com/privacypolicy.
• Resend, Inc. (United States), transactional email delivery (replies, lead-magnet links, mandate documents). Privacy: resend.com/legal/privacy-policy.

5. International transfers (Art. 13(1)(f) GDPR)

The two sub-processors above are established in the United States. Transfers rely on the European Commission's Standard Contractual Clauses (SCCs), Implementing Decision (EU) 2021/914, as the transfer mechanism, supplemented by each provider's additional safeguards documented in their Data Processing Agreements. We rely on the adequacy mechanism where one applies. Eco-organism and ADEME data stays within the EU.

6. Retention

Contact form data: 24 months from last contact. Mandate and declaration data: kept for the duration of the contract and 10 years after termination, to comply with French commercial and EPR retention rules.

7. Your rights

Under the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. Submit requests through the contact form. You may also lodge a complaint with the French CNIL (www.cnil.fr).

8. Cookies

The website sets no cookie of its own. Cloudflare, our host, may set a strictly necessary security cookie to filter automated traffic. Cloudflare Web Analytics works without cookies. No consent banner is required because no tracking, profiling, or advertising cookie is deployed (article 82 of the French Data Protection Act). The source of your first visit (referring site or campaign tag, first page viewed and date) is kept in your browser's session storage, without any cookie, and is erased when you close the tab; it leaves your browser only if you submit a form. When you submit a form, the domain of the site that referred you or the campaign tag of the link you followed (for example a search engine or an AI assistant), and the first page you visited, are sent with it, to tell us how you found us.

9. Updates

This policy may be updated. Material changes are announced on the homepage and effective 30 days after publication.