Privacy policy
Data controller
The controller of personal data processed through this site and the KronoCal and KronoForms services is Cardinal Codes (Hanni Molabaccus), Entrepreneur individuel. For any question about your data: contact@cardinalcodes.com. Cardinal Codes is not required to appoint a data protection officer (DPO); the controller answers data requests directly.
Browsing this site
This site sets no cookies, embeds no trackers and performs no audience measurement. No personal data is collected while simply browsing.
Data collected, purposes, legal basis and retention
SaaS accounts (KronoCal, KronoForms): first name, last name, e-mail address, and the content you create with the tool (schedules, forms and their answers). Purpose: provide the service you subscribed to. Legal basis: performance of the contract. Retention: for the duration of the subscription, then 12 months after it ends, unless you request earlier deletion.
Payments: payments are processed by Stripe. Cardinal Codes neither collects nor stores your bank details. Purpose: collect subscriptions and issue invoices. Legal basis: performance of the contract and legal obligation (accounting). Retention: invoices and accounting records kept for 10 years (Article L123-22 of the French Commercial Code).
E-mail exchanges: if you write to us by e-mail, your address and message are used solely to answer you. Legal basis: our legitimate interest in answering business inquiries. Retention: 24 months after our last exchange.
Newsletters: where applicable, sending information about our products relies on your consent, with a right to object at any time. Retention: 3 years after the last contact.
Processors and recipients
Cardinal Codes relies on a limited set of processors: Cloudflare (website hosting, United States, Data Privacy Framework participant) and Stripe (payments, United States, Data Privacy Framework participant). The production host of the KronoCal and KronoForms applications (European Union) will be listed here when the applications go live. No data is sold or shared with third parties for commercial purposes.
Transfers outside the European Union
The processors listed above may process data in the United States. These transfers are covered by the EU-US Data Privacy Framework or, failing that, by the European Commission's standard contractual clauses.
Your rights
In accordance with the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability over your data. To exercise them, write to contact@cardinalcodes.com; we answer within 30 days. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr).
Security
Traffic to this site and the applications is encrypted (TLS). Access to production data is limited to the people who need it. In case of a personal data breach likely to result in a high risk, the people concerned and the CNIL are informed in accordance with the GDPR.
Changes to this policy
This policy may change as the services evolve. The date of the latest version is published at the bottom of this page.
Version of 2026-10-08.