Controller
Hexaconto, 53 boulevard Suchet, 75016 Paris, France. Contact: cabinet@hexaconto.com.
Data we collect
Contact form
Data: name, e-mail, phone, company, profile, headcount, need, timeframe, where you are in your search, status of your books, how you heard about us, language and message; depending on your answers, a few details (move to the actual-profit regime for a micro-entrepreneur; type of audit engagement, any involvement of the firm with the company concerned and date of the transaction; reason for changing firm and number of firms over five years) and, depending on your answer, the name of the person or professional who recommended us, or the social network or business directory through which you found us; where applicable, the page you came from, the referral code of the link used and your budget estimate answers (which you can choose not to attach).
Purpose: to answer your request and, where relevant, send you an engagement proposal.
Legal basis: pre-contractual steps taken at your request.
Retention: three years after our last contact.
Online booking
How it works: the booking calendar (Calendly) only loads when you click to display it.
Data: what you enter to book (name, e-mail, time slot, any details) and, if you come from the budget estimator, your answers, prefilled in the details field (you can choose not to attach them).
Purpose: to organise the introductory meeting.
Legal basis: pre-contractual steps taken at your request.
Retention: three years from the last contact, unless a contractual relationship begins.
Audience measurement
Data: pages viewed, traffic source, technical device information, cookie identifiers.
Purpose: understanding how the site is used (Google Analytics 4).
Legal basis: your consent via the cookie banner.
Retention: cookies up to 13 months; statistics up to 14 months.
Introduction form (questionnaire)
Data: your answers about your business and your expectations (legal form, activity, estimated figures, organisation, bookkeeping situation, budget, documents available); the due diligence information requested before any engagement (shareholders, shareholders’ residence, politically exposed person); your contact details (title, name, e-mail, mobile phone) and those of the other directors you list for signing the engagement letter; how you heard about us and, where applicable, the name of the person who recommended us.
How it works: your answers are sent to the firm in two stages, with your consent: the essentials about your business and your contact details at the end of the first questions, then your meeting preparation when you send it, with a summary by e-mail. While you fill it in, they are also kept in your browser (without your contact details) for 30 days at most, so you can pick up where you left off.
Finding your business: if you enter a SIREN or SIRET number, or the name of your business, your browser directly queries the French government’s public business directory (recherche-entreprises.api.gouv.fr), the official gazette of civil and commercial notices (bodacc-datadila.opendatasoft.com) and INSEE (api.insee.fr), with that number or name only. Like any website you visit, these services receive your connection’s IP address.
Purposes: preparing your meeting and, where applicable, offering you an engagement letter; meeting the profession’s due diligence obligations (anti-money laundering and counter-terrorist financing).
Legal basis: pre-contractual measures taken at your request; legal obligation for the due diligence information (French Monetary and Financial Code).
Retention: three years from the last contact, unless a contractual relationship begins.
Preparing your meeting
Data: your contact details (title, name, e-mail address, mobile number), how you heard about us and your answers so far, saved as soon as you give your contact details in the questionnaire.
Purpose: sending you a “Your meeting and your preparation” e-mail, with the link to prepare the meeting on any device; sending you a single reminder, 48 hours after your last activity, if the preparation is not finished; allowing the firm to contact you about your request.
Legal basis: steps taken at your request before entering into a contract.
Retention: 30 days at most. Your contact details and answers so far are deleted as soon as you send your preparation, or as soon as the questionnaire stops on an answer that does not allow us to support you.
My space
Data: your e-mail address; the contact details you complete there (title, name, mobile number, business, your project in a few words); the dates of creation and last sign-in. Your space also shows where your questionnaire and meeting stand, read from the data described above for the same e-mail address.
How it works: passwordless sign-in, with a link sent by e-mail, valid for 20 minutes and usable once; your device stays signed in for 30 days at most, thanks to a strictly necessary cookie (“hx_espace”, and “hx_espace_on”, which only indicates that you are signed in). The link and the session are only stored as an irreversible fingerprint (hash).
Purposes: giving you access, in one place, to the site’s tools and resources; allowing you to follow and prepare your meeting with the chartered accountant; passing on to the firm the contact details you complete.
Legal basis: steps taken at your request before entering into a contract.
Retention: three years after your last sign-in. The “Delete my space” button erases it at once; requests already sent to the firm follow the retention period given for the introduction form.
“Remind me when the time comes”
Data: your e-mail address and the reason for the reminder (project not ready yet, later start, right to carry on a business to be checked).
Purpose: writing to you once, at the planned time, to invite you to fill in the introduction form again.
Legal basis: your request.
Retention: until the reminder is sent (three to four months), then one month before deletion.
Website security
Data: IP address, browser, requests. The IP address, browser and originating page are also included in the internal copy of messages sent through the site’s forms.
Purpose: protecting the site against attacks and abuse, and keeping a record of messages received and sent.
Legal basis: our legitimate interest.
Retention: as long as strictly necessary.
Recipients
Data is used by the firm only. It may be processed on our behalf by our technical providers (hosting, Google e-mail, Calendly for online booking, Google Analytics if you consent, security software). Transfers outside the EU are covered by GDPR safeguards (adequacy decisions including the EU–US Data Privacy Framework, or standard contractual clauses).
Cookies
No audience measurement cookie is set without your consent. We store your choice for 6 months (hx_consent, browser local storage). Google Analytics cookies (_ga, _ga_*) are set only if you click “Accept”. You can change your choice at any time via “Cookie settings” at the bottom of each page. Session storage (hx_slidein, hx_guide_en, hx_contact) only remembers a closed box, your conversation with the site guide and the contact details you just entered, while the tab is open; nothing is sent to us or to third parties. Third-party tools (Urssaf simulators, Calendly booking) load only when you click to start them and may then set their own cookies.
Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability and the right to withdraw consent. Write to cabinet@hexaconto.com. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
The French version of this policy prevails.