How we handle your personal data

Discretion is at the core of our profession. This policy explains what personal data InTheBoardroom collects through this website and in its business relationships, why, for how long, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

InTheBoardroom, SAS with a share capital of €1,000, registered office at 10 rue de Penthièvre, 75008 Paris, France, RCS Paris 824 611 552. Contact for any privacy matter: sbenichou@intheboardroom.fr.

2. Data we collect

When you contact us by email or through a link on this website: your name, email address, company, position and the content of your message.
In the course of a business relationship: professional contact details of the people we work with at clients, investors, counterparties and advisors, and the correspondence exchanged.
When you browse this website: technical connection data recorded by our host (IP address, date and time, pages requested, browser type), used only for security and proper operation of the site.

We do not ask for sensitive data and we do not use this website to build profiles of visitors.

3. Purposes and legal bases

PurposeLegal basis

Answering your enquiriesOur legitimate interest in responding to people who contact us

Performing our engagements and managing client relationshipsPerformance of a contract, or steps taken at your request before entering into one

Developing our professional network and sharing our insights with professional contactsOur legitimate interest, with the right to object at any time

Meeting our accounting, tax and other legal obligationsCompliance with a legal obligation

Securing this websiteOur legitimate interest in keeping the site secure and available

4. Who receives your data

Your data is accessed only by the InTheBoardroom team members who need it. It is also processed on our behalf by our technical providers, acting as processors under contract: Microsoft (website hosting and business email). We may share information with other advisors working on the same transaction only where this is necessary for the engagement and subject to confidentiality. We never sell personal data.

5. Transfers outside the European Union

Where a provider may access data from outside the European Economic Area, the transfer is covered by the safeguards required by the GDPR, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.

6. How long we keep it

Professional contacts and prospects: three years from our last exchange.
Clients: for the duration of the relationship, then for the applicable limitation periods.
Accounting records: ten years, as required by French law.

7. Cookies

This website does not use advertising or audience measurement cookies. It only uses what is strictly necessary for it to function, which does not require your consent. If we add an audience measurement tool, we will update this policy and ask for your consent where required.

8. Your rights

You may request access to your data, its rectification or erasure, the restriction of its processing, and its portability. You may object at any time to processing based on our legitimate interest, in particular to receiving our insights. Under French law, you may also give instructions on what should happen to your data after your death.

To exercise these rights, write to sbenichou@intheboardroom.fr or to InTheBoardroom, 10 rue de Penthièvre, 75008 Paris, France. We will answer within one month. If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

9. Security

We apply technical and organisational measures appropriate to the confidential nature of our work: encrypted connections, restricted access, and providers bound by confidentiality and security commitments.

10. Changes

We may update this policy. The date at the top of the page shows the latest version.