Privacy Policy
This Privacy Policy explains which personal data DOLIAM collects when you visit this website, why, on what legal basis, for how long, and what rights you have. It applies only to data processed through this website. It was last updated on 18 September 2026 and replaces the version of May 2021.
1. Who we are and which law applies
This website is published by DOLIAM, a simplified joint-stock company (société par actions simplifiée) incorporated under French law, registered with the Versailles Trade and Companies Register under number 381 324 771, with its registered office at 109 rue des Côtes, 78600 Maisons-Laffitte, France.
DOLIAM is established in France and acts as data controller for the personal data collected through this website. The processing of your personal data is governed by Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and by the French Data Protection Act of 6 January 1978 as amended (loi Informatique et Libertés). The competent supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
For any question about your personal data or to exercise your rights, write to contact@doliam.fr or to DOLIAM, 109 rue des Côtes, 78600 Maisons-Laffitte, France. We answer within one month.
2. What data we process and why
2.1 When you contact us
When you write to one of the e-mail addresses shown on the website, we process your name, your e-mail address and the content of your message in order to answer you and, where relevant, to prepare a business relationship. Legal basis: our legitimate interest in answering the people who contact us, and, where applicable, steps taken at your request prior to entering into a contract. We keep this correspondence for three years after our last exchange, unless a contract is concluded, in which case it is kept for the duration of the relationship and the applicable statutory limitation periods.
The website also offers an application form for the MedTech Industrial Campus. That form is hosted by Mailchimp, a service of Intuit Inc. (United States). The data you enter in it is collected and stored by Intuit on our behalf, and we use it solely to assess and answer your application. Legal basis: steps taken at your request prior to entering into a contract. Because Intuit is established in the United States, submitting the form transfers your data outside the European Union; Intuit Inc. is certified under the EU-U.S. Data Privacy Framework. We keep applications for three years after our last exchange. You are free to write to us at contact@doliam.fr instead of using the form.
2.2 Audience measurement (Matomo)
We measure how the website is used with Matomo, an open-source analytics tool installed on our own server in France. No data is sent to Matomo or to any other company. Matomo is configured to meet the conditions under which the CNIL exempts audience measurement from consent:
- it places no cookie and no identifier on your device;
- your IP address is truncated (the last two bytes are removed) before it is stored, so that it no longer identifies your device;
- it records only the pages viewed, the previous site that referred you, the type of browser, device and screen, the approximate country, and the time spent on the page;
- it is used solely to produce anonymous statistics about this website, with no cross-site tracking and no profiling.
Legal basis: our legitimate interest in understanding how the website is used and improving it. Retention: raw visit data is deleted after 13 months; aggregated statistics are kept for 25 months. If you nevertheless do not wish to be counted, enable the “Do Not Track” option of your browser: Matomo honours it.
2.3 Google Analytics, only with your consent
If you click “Accept” or enable the “Statistics” category in the consent banner, we also use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics places cookies on your device (see section 3), collects the pages you view, your interactions, your approximate location, and technical data about your browser and device, and assigns you a pseudonymous identifier. Google may transfer this data to Google LLC in the United States; this transfer is covered by the EU-U.S. Data Privacy Framework, to which Google LLC is certified. Legal basis: your consent, which you can withdraw at any time through the “Manage consent” link at the bottom of every page. Retention: cookies expire after 13 months at most; data is kept in Google Analytics for 14 months at most.
2.4 Embedded videos (YouTube)
Some pages present videos hosted on YouTube. They are displayed in YouTube’s privacy-enhanced mode (youtube-nocookie.com) and nothing is loaded from Google until you click the play button. When you click, your browser connects to Google’s servers, which receive your IP address and may place cookies according to Google’s privacy policy. Your click constitutes your consent to that loading. Google may transfer the data to the United States under the EU-U.S. Data Privacy Framework.
2.5 Technical logs and security
Our hosting provider records, for each request, your IP address, the date and time, the page requested and the technical identification of your browser. These logs are used solely to keep the website secure, to detect abuse and to diagnose incidents. Legal basis: our legitimate interest in the security of the website and our legal obligation to retain connection data. Retention: twelve months.
2.6 Your consent choices
When you make a choice in the consent banner, a functional cookie records that choice so that the banner is not shown again and your preference is respected. This cookie contains no personal data other than your choice. Legal basis: our legitimate interest in proving and honouring your consent. Retention: twelve months.
3. Cookies and similar technologies
By default this website places no tracking cookie. Audience measurement with Matomo works without any cookie or identifier. The only cookies placed without your consent are the functional cookies that record your consent choices (cmplz_*), valid for twelve months.
The following cookies are placed only after you accept the “Statistics” category: _ga and _ga_* (Google Analytics), valid for 13 months, used to distinguish visitors and sessions. YouTube may place its own cookies once you start a video (see 2.4). You can change your choices at any time through the “Manage consent” link at the bottom of every page, and you can delete cookies through the settings of your browser.
4. Who receives your data
Your data is accessible only to the DOLIAM staff who need it for the purposes described above (communication, IT). It is processed on our behalf by the following processors, bound by contract: OVH SAS (hosting, servers located in France); our website maintenance provider; Intuit Inc., which hosts our campus application form; and, only where you have given consent or clicked a video, Google Ireland Limited. Your data may also be disclosed to the authorities where the law requires it. DOLIAM does not sell personal data and does not share it for advertising purposes.
5. Transfers outside the European Union
Data processed by Matomo, by our hosting provider and by our e-mail systems stays in the European Union. Data processed by Google (Google Analytics after consent, YouTube after you play a video) may be transferred to Google LLC in the United States. These transfers rely on the European Commission’s adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework, to which Google LLC is certified. Data you submit through the campus application form is transferred to Intuit Inc. in the United States, which is certified under the same framework. No other transfer outside the European Union takes place.
6. How long we keep your data
- E-mail correspondence: three years after our last exchange.
- Campus applications: three years after our last exchange.
- Matomo audience data: raw data 13 months, aggregated statistics 25 months.
- Google Analytics: cookies 13 months at most, data 14 months at most.
- Technical logs: twelve months.
- Consent choices: twelve months.
7. Your rights
Under the GDPR and the French Data Protection Act you have the right to access the personal data we hold about you, to have it rectified or erased, to obtain the restriction of its processing, to object to processing based on our legitimate interest, to receive the data you have provided to us in a portable format, and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You also have the right to define directives regarding the storage, erasure and communication of your personal data after your death (article 85 of the loi Informatique et Libertés).
To exercise these rights, write to contact@doliam.fr or to the postal address given in section 1. We may ask you to confirm your identity when the request does not allow us to identify you with certainty. If you consider that your rights have not been respected, you may lodge a complaint with the CNIL at www.cnil.fr.
8. Security and changes to this policy
All exchanges between your browser and this website are encrypted in transit (TLS). DOLIAM implements technical and organisational measures appropriate to the risk, in accordance with article 32 of the GDPR, including access control, regular updates of the software running the website and separation of administration accounts.
We may update this policy when the website, the tools it uses or the applicable law change. The version in force is the one published on this page, with its date at the top. Substantial changes will be indicated here.