Privacy Policy

This Privacy Policy explains which personal data DOLIAM collects when you visit this website, why, on what legal basis, for how long, and what rights you have. It applies only to data processed through this website. It was last updated on 29 October 2026 and replaces the version of 18 September 2026.

1. Who we are and which law applies

This website is published by DOLIAM, a simplified joint-stock company (société par actions simplifiée) incorporated under French law, registered with the Versailles Trade and Companies Register under number 381 324 771, with its registered office at 109 rue des Côtes, 78600 Maisons-Laffitte, France.

DOLIAM is established in France and acts as data controller for the personal data collected through this website. The processing of your personal data is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and by the French Data Protection Act of 6 January 1978 as amended (loi Informatique et Libertés). The competent supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

For any question about your personal data or to exercise your rights, write to contact@doliam.fr or to DOLIAM, 109 rue des Côtes, 78600 Maisons-Laffitte, France. We answer within one month.

2. What data we process and why

2.1 When you contact us

When you write to one of the e-mail addresses shown on the website, we process your name, your e-mail address and the content of your message in order to answer you and, where relevant, to prepare a business relationship. Legal basis: our legitimate interest in answering the people who contact us, and, where applicable, steps taken at your request prior to entering into a contract. We keep this correspondence for three years after our last exchange, unless a contract is concluded, in which case it is kept for the duration of the relationship and the applicable statutory limitation periods.

The website also offers an application form for the MedTech Industrial Campus. That form is hosted by Mailchimp, a service of Intuit Inc. (United States). The data you enter in it is collected and stored by Intuit on our behalf, and we use it solely to assess and answer your application. Legal basis: steps taken at your request prior to entering into a contract. Because Intuit is established in the United States, submitting the form transfers your data outside the European Union; Intuit Inc. is certified under the EU-U.S. Data Privacy Framework. We keep applications for three years after our last exchange. You are free to write to us at contact@doliam.fr instead of using the form.

2.2 Google Analytics, only with your consent

If you click “Accept” or enable the “Statistics” category in the consent banner, we also use Google Analytics 4, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), acting as our processor under the Google Ads Data Processing Terms. No Google Analytics script is loaded and no Google Analytics cookie is placed before you give your consent.

Google Analytics places cookies on your device (see section 3). It collects the pages you view, your interactions with them (scrolling, clicks on external links, file downloads), the website that referred you, your approximate location (country and region) and technical data about your browser and device. It assigns you a pseudonymous identifier. According to Google, Google Analytics 4 does not log or store the IP addresses of users in the European Union.

We have configured Google Analytics to limit processing to what audience measurement requires:

• Google signals, advertising features and ad personalisation are disabled;
• Google Analytics is not linked to any advertising account;
• sharing of data with Google for its own purposes (benchmarking, product improvement, modelling) is disabled;
• we send Google no information that directly identifies you (no name, e-mail address or account identifier), and e-mail addresses and query parameters appearing in page addresses are automatically redacted;
• event-level data is deleted after 2 months; only aggregated reports are kept beyond that period.

Purpose: to produce statistics on how this website is used and to improve its content. Legal basis: your consent (article 6(1)(a) GDPR and article 82 of the French Data Protection Act). You can withdraw it at any time, as easily as you gave it, through the “Manage consent” link at the bottom of every page. Withdrawal stops any further collection and does not affect the lawfulness of processing carried out before it.

Google may transfer the data to Google LLC in the United States, acting as its sub-processor (see section 5). Retention: Google Analytics cookies expire after 13 months at most; event-level data is kept for 2 months.

2.3 Embedded videos (YouTube)

Some pages present videos hosted on YouTube. They are displayed in YouTube’s privacy-enhanced mode (youtube-nocookie.com) and nothing is loaded from Google until you click the play button. When you click, your browser connects to Google’s servers, which receive your IP address and may place cookies according to Google’s privacy policy (policies.google.com/privacy). Your click constitutes your consent to that loading. For this processing, Google acts as an independent controller. Google may transfer the data to the United States under the EU-U.S. Data Privacy Framework.

2.4 Technical logs and security

Our hosting provider records, for each request, your IP address, the date and time, the page requested and the technical identification of your browser. These logs are used solely to keep the website secure, to detect abuse and to diagnose incidents. Legal basis: our legitimate interest in the security of the website and our legal obligation to retain connection data. Retention: twelve months.

2.5 Your consent choices

When you make a choice in the consent banner, whether you accept or refuse, a functional cookie records that choice so that the banner is not shown again and your preference is respected. This cookie contains no personal data other than your choice. Legal basis: our legitimate interest in proving and honouring your consent. Retention: six months. After this period, or if you delete your cookies, the banner asks for your choice again.

3. Cookies and similar technologies

By default this website places no tracking cookie. The only cookies placed without your consent are the functional cookies that record your consent choices.

This website uses no advertising or marketing cookie. You can change your choices at any time through the “Manage consent” link at the bottom of every page, and you can delete cookies through the settings of your browser. Details are given in our Cookie Policy.

4. Who receives your data

Your data is accessible only to the DOLIAM staff who need it for the purposes described above (communication, IT). It is processed on our behalf by the following processors, bound by contract: OVH SAS (hosting, servers located in France); our website maintenance provider; Intuit Inc., which hosts our campus application form; and Google Ireland Limited, for Google Analytics, only where you have given consent. When you play a YouTube video, Google receives data as an independent controller (see 2.3). Your data may also be disclosed to the authorities where the law requires it. DOLIAM does not sell personal data and does not share it for advertising purposes.

5. Transfers outside the European Union

Data processed by Google (Google Analytics after consent, YouTube after you play a video) may be transferred to Google LLC in the United States. Data you submit through the campus application form is transferred to Intuit Inc. in the United States.

These transfers rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-U.S. Data Privacy Framework, to which Google LLC and Intuit Inc. are certified. If this decision ceased to apply, we would suspend the transfers concerned or rely on another safeguard provided for by article 46 GDPR, and update this policy. No other transfer outside the European Union takes place.

6. How long we keep your data

• E-mail correspondence: three years after our last exchange.
• Campus applications: three years after our last exchange.
• Google Analytics: cookies 13 months at most, event-level data 2 months.
• Technical logs: twelve months.
• Consent choices: six months.

7. Your rights

Under the GDPR and the French Data Protection Act you have the right to access the personal data we hold about you, to have it rectified or erased, to obtain the restriction of its processing, to object to processing based on our legitimate interest, to receive the data you have provided to us in a portable format, and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to define directives regarding the storage, erasure and communication of your personal data after your death (article 85 of the loi Informatique et Libertés).

To exercise these rights, write to contact@doliam.fr or to the postal address given in section 1. We may ask you to confirm your identity when the request does not allow us to identify you with certainty. If you consider that your rights have not been respected, you may lodge a complaint with the CNIL at www.cnil.fr.

8. Security and changes to this policy

All exchanges between your browser and this website are encrypted in transit (TLS). DOLIAM implements technical and organisational measures appropriate to the risk, in accordance with article 32 of the GDPR, including access control, regular updates of the software running the website and separation of administration accounts.

We may update this policy when the website, the tools it uses or the applicable law change. The version in force is the one published on this page, with its date at the top. Substantial changes will be indicated here.

Manage consent · Cookie Policy · Terms of Use