Two very different situations often get confused, so let us separate them at the outset. This page governs one of them: apply.fr, its enquiry form, and e-mail you address to us. The other is what sits inside a client's own systems while we look after them. There, the client decides what happens to the data and we merely follow instructions, bound by a written agreement under article 28 of the GDPR. Nothing below applies to that second case.
Who answers for this data
Apply is the controller. The details identifying that controller are set out just below and repeated in the legal notice. Anything to do with privacy goes to office@apply.fr, where a named colleague handles it.
In legal terms, the Apply brand and the apply.fr website are run by the company Apply LLP:
- Legal name - Apply LLP, director Andrey Vasin
- Registered address - Bukhar Zhyrau Boulevard 62B, 050057 Almaty, Kazakhstan
- BIN - 220540005599
- Email - office@apply.fr
What actually gets stored
Four categories, and nothing beyond what a reply or a contract genuinely requires. Nothing on this site asks for a social security number, health information, or any other special-category data.
- Whatever you type into the form - a name, one way of reaching you (e-mail or phone, your choice), the subject you pick from the list, and the message itself.
- Three technical values captured at submission - originating page, IP address, browser user agent. Bots and abusive submissions are caught with these; nothing else uses them.
- Contract-related records - who we deal with at your company, billing information, and the correspondence that accumulates around the engagement.
- Support tickets - the symptom as reported, the thread that follows, and a technical log of the operations carried out.
Passwords have no place in a web form or a plain e-mail. Credentials reach us one way only: through an encrypted route settled between us beforehand.
The uses it is put to
- Replying to you, and costing the work if you want a figure.
- Signing and then performing a contract with you or your company.
- Running support tickets, with a record of what was changed and when.
- Invoicing, plus the accounting and tax duties that come with it.
- Keeping the site standing against spam, automated submissions and attack attempts.
- Standing on either side of a legal claim, in the unlikely event one arises.
Grounds and retention
Article 6 of the GDPR supplies a different ground for each use, and each use has its own clock. When the clock runs out, the data goes.
| Use | Ground | Retention |
|---|---|---|
| Replying to a form submission or an e-mail | Article 6(1)(b) GDPR, pre-contractual steps, together with 6(1)(f), our legitimate interest in answering someone who approached us | For the enquiry and the exchange it leads to; sooner if you object |
| Performing the contract, handling tickets | Article 6(1)(b) GDPR, performance of a contract | Throughout the engagement, then until the relevant limitation periods lapse |
| Invoices and accounting records | Article 6(1)(c) GDPR, a legal duty under accounting and tax rules | The period fixed by the French commercial code and tax legislation |
| Blocking spam and abuse | Article 6(1)(f) GDPR, our legitimate interest in a secure site | IP address and user agent, for as long as abuse detection requires |
| Browser preferences | Strictly necessary for the site to function | Yours to erase, whenever you choose |
Cookies and what your browser keeps
No audience measurement runs here. No advertising pixel, no tracking cookie, no third-party script watching you read. Two cookies exist: one carries your session, the other shields the form from cross-site request forgery. Remove them and the form stops working; close the session and the browser discards them itself.
Separately, local storage in your browser retains three trivia: which city you selected, whether you prefer the light or dark theme, and whether the cookie notice has already been dismissed. None of it travels to our server, and clearing your browser data wipes all three. Were analytics ever switched on, this document would change first and your consent would be sought before anything was set.
Third parties with access
Nothing is sold, and nothing feeds advertising. Access stops at the handful of suppliers without whom the service could not run.
- Our host - operates the machine serving this site and holding form submissions.
- Our mail provider - carries the office@apply.fr mailbox and the correspondence in it.
- Public authorities - where legislation compels disclosure, a tax audit being the usual example.
Each works to a written processing agreement and acts on our instruction alone. Should any of them move data beyond the European Economic Area, it happens under the safeguards the GDPR lays down, the European Commission's standard contractual clauses among them.
Erasure and the measures around it
Once a record no longer serves any use in the table above, it is deleted outright or stripped of anything that could point back to a person.
- Access is granted by need, not by seniority or convenience.
- Accounts are personal, never shared, and carry a second authentication factor wherever the platform supports one.
- Traffic is encrypted end to end; backups sit apart from production, not alongside it.
- Fields that serve no reply and no contract are simply not collected.
What you are entitled to ask
The GDPR hands you a set of rights, exercisable whenever you like, and without explanation except where the legislation itself demands one.
- See the data and take a copy of it (article 15).
- Have anything wrong or outdated corrected (article 16).
- Have it erased, the right commonly called being forgotten (article 17).
- Freeze processing while something is contested (article 18).
- Take it elsewhere in a machine-readable form (article 20).
- Object where our legitimate interest is the ground relied on (article 21).
Expect a response promptly, and in no case later than a month. If our handling strikes you as unlawful, the French supervisory authority hears complaints: cnil.fr.
One exception binds us regardless of what you ask: accounting records stay until the statutory period expires. Once it does, they are deleted like everything else.
Where to write
Queries about this text, and any request to see, correct or delete what we hold, belong at office@apply.fr. The mailbox is read Monday to Friday, 8:00-18:00 CET. Other routes to us are listed on the contact page.