Privacy notice
Last updated: 2 November 2026
This notice explains what personal data this website collects, why, who handles it, how long it is kept and how you can use your rights. It applies to ubac-partners.com and its forms.
Who is responsible
The controller is UBAC Partners SAS, 110 avenue Philippe-Auguste, 75011 Paris, France (RCS Paris 105 973 093). For any question about your data, or to use your rights, write to contact@ubac-partners.com. We have not appointed a data protection officer.
Browsing the site
The site has no tracking, no analytics, no advertising and no social media plug-ins. Pages, fonts and scripts are all served from ubac-partners.com: your browser makes no request to any other company while you read the site.
Our host records technical request logs (IP address, browser type, page requested, time) to run and secure the service. We can see them for 7 days.
Browser storage. If you switch between light and dark mode, your choice is kept in your browser under the name ubac-theme, so the next page opens in the mode you chose. It is a setting you asked for and is exempt from consent. Admins who sign in also get a session kept in their browser. There are no other cookies or stored items.
Contact form
| Data | Your role, situation, topic, name, e-mail address, message and preferred contact method. Name, e-mail address and role are required: without them we cannot answer. |
| Purpose | Answering your enquiry and following up on it. |
| Legal basis | Steps taken at your request before a possible contract (GDPR art. 6(1)(b)), and our legitimate interest in answering business enquiries (art. 6(1)(f)). |
| What happens | The site stores nothing. Your message is e-mailed to our contact inbox, read by the partners of UBAC Partners. |
| Retention | 3 years from your last contact with us. |
Job applications (Join us)
| Data | The position, your e-mail address, phone number (optional), message (optional) and resume. Position, e-mail address and resume are required to consider your application. |
| Purpose | Assessing your application and contacting you about it. |
| Legal basis | Steps taken at your request before a possible employment contract (GDPR art. 6(1)(b)). |
| What happens | The site stores nothing. Your application and resume are e-mailed to our careers inbox, read by the partners. |
| Retention | If we do not hire you: 3 months after our decision, or up to 2 years after our last contact if you agree that we keep your application for future openings. |
Expert applications (Experts page)
| Data | Your name, e-mail address, title, LinkedIn profile, short bio, skills, availability for interim work, CV and photo. Name, title and e-mail address are required. |
| Purpose | Reviewing your application to join our network of experts and, if we agree together, showing your expert card on the Experts page. |
| Legal basis | Steps taken at your request (GDPR art. 6(1)(b)) for the review. Publication of your card: your consent (art. 6(1)(a)), which you can withdraw at any time. |
| What happens | Your application is stored in our database and your files in our host's file storage. Your CV is read by an AI service to draft your card; the card is published only after our review. The published card shows your first name, title, bio, skills, LinkedIn link and photo. Your CV and e-mail address stay internal. We receive a notification e-mail with your first name and title only. |
| Retention | If your application is not taken forward: deleted 3 months after our decision. If you join the network: while you are in it, reviewed every 2 years. |
Admin sign-in
The site's admin area is for UBAC Partners staff only. Signing in uses Microsoft accounts. We keep the admin's e-mail address, role and last sign-in time, to control access and keep an audit trail, on the basis of our legitimate interest in securing the site (GDPR art. 6(1)(f)), for as long as the person has admin access.
Protection against abuse
To stop automated abuse of the forms, we count submissions per IP address per hour. These records are deleted after 24 hours. Legal basis: our legitimate interest in keeping the service available and secure (GDPR art. 6(1)(f)).
Who handles the data
Within UBAC Partners, only the partners have access. We do not sell your data and do not share it for marketing. We use these service providers (processors), each bound by a data processing agreement:
| Netlify, Inc. (United States) | Hosting of the site, the form functions and the stored files (photos, CVs). |
| Supabase (database hosted in the EU, Ireland region) | Database of expert applications and admin accounts. |
| Anthropic (Anthropic Ireland, Limited; processing in the United States) | Reads an expert's CV to draft the card. |
| Resend (Plus Five Five, Inc., United States) | Sends the e-mails of the three forms to our inboxes. |
| Microsoft (Microsoft Ireland Operations Limited and Microsoft Corporation) | Our mailboxes, and the admin sign-in. |
Transfers outside the European Union
Some of these providers process data in the United States or give access from there. Each transfer is covered by the safeguard the provider itself states:
- Netlify: certified under the EU-U.S. Data Privacy Framework, with the European Commission's standard contractual clauses as a fallback (Netlify DPA, sections 14.2 and 14.3).
- Supabase: standard contractual clauses for transfers to the United States and Singapore (Supabase DPA, privacy policy).
- Anthropic: standard contractual clauses (Anthropic DPA).
- Resend: EU-U.S. Data Privacy Framework and standard contractual clauses (Resend DPA, sections 6.2 and 11.1).
- Microsoft: standard contractual clauses, and certification under the EU-U.S. Data Privacy Framework (Microsoft DPA).
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent (publication of an expert card, keeping a job application longer), you can withdraw it at any time; this does not affect what was done before. Write to contact@ubac-partners.com; we answer within one month.
You can also complain to the French data protection authority, the CNIL: online complaint service, or by post to CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France.