Privacy policy

Elsanor Group — last updated: 05/08/2026

1. Data controllers

The elsanor.com website presents the activities of the Elsanor group. Three group companies act as data controllers, each for its own activity:

Website audience measurement is carried out jointly by the group companies. Our customers are exclusively professionals; the data processed mainly concerns the representatives and contacts of our customers, prospects and partner resellers.

2. Data collected and purposes

Contact forms (identity, contact details, message content): to answer your enquiries. Legal basis: pre-contractual measures / legitimate interest. Retention: 3 years after the last contact.

Professional customer portal accounts (identity, business contact details, orders, invoicing, deliveries, history) — Elsanor Commercialisation: performance of the commercial relationship. Legal basis: contract; accounting and tax obligations for invoicing. Retention: duration of the commercial relationship, then legal archiving (10 years for accounting records).

Reseller directory and map (company name, business contact details, points of sale, opening hours and time slots): public presentation of partner resellers. Legal basis: partnership agreement. Publication is controlled by the reseller from their own area; removal on simple request.

Newsletter and availability mailings (business email): business-to- business commercial information related to your activity. Legal basis: legitimate interest. Every message includes an immediate unsubscribe link.

Audience measurement and form security: see the Cookies section below.

3. Recipients, hosting and processors

Data is intended for the internal departments of the Elsanor group. It is neither sold nor transferred.

Hosting: 1984 ehf, Reykjavík, Iceland — a member of the European Economic Area, therefore subject to the GDPR. Technical administration of the infrastructure may be carried out by a provider located outside the EEA; such access is governed by contract, limited to operational needs and covered by the appropriate safeguards provided for by the GDPR (standard contractual clauses).

Other processors: OVH (email delivery, France); Google Ireland Ltd (Google Analytics audience measurement, Google Tag Manager and reCAPTCHA anti-spam protection — only after your consent, see section 4).

4. Cookies and trackers

On your first visit, a banner lets you accept or refuse the placement of cookies, service by service. No tracker subject to consent is placed before your choice, and refusing is as simple as accepting.

Strictly necessary cookies (session, customer portal authentication, storing your consent choice): exempt from consent.
Google Analytics 4 and Google Tag Manager: audience measurement — placed only if you accept them.
Google reCAPTCHA v3: anti-spam protection for forms — loaded only if you accept it; otherwise, submitting the form will offer to enable it.

You may change your choices at any time via the « Manage cookies » link in the footer. Consent validity: up to 13 months.

5. Retention periods

Periods are specified per purpose in section 2. Otherwise, data is kept for the time strictly necessary for the purpose pursued, then deleted or archived in accordance with legal obligations.

6. Your rights

Under the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them, write to the relevant company (see section 1) or by post to Ponsal, 56450 Surzur, France, providing proof of identity. Reply within one month. You may lodge a complaint with the CNIL (cnil.fr).

7. Security

Data is protected by appropriate technical and organisational measures: encryption of communications (TLS), access control, logging and regular backups.