Personal data

Who is responsible

La plateforme PINT, Institut de NeuroPhysiopathologie (Aix-Marseille Université / CNRS), 27 bd Jean Moulin, 13005 Marseille, is the controller for the personal data processed through this site, within the meaning of Regulation (EU) 2016/679 and the amended Law 78-17 of 6 January 1978. Day-to-day handling is carried out by the facility team.

Data protection officer

Questions about this policy, and requests concerning your data, can go to the data protection officer of Aix-Marseille Université at dpo@univ-amu.fr, or by post to Aix-Marseille Université, 58 bd Charles Livon, 13284 Marseille Cedex 07. You can also write to the facility at inp-pint@univ-amu.fr and we will pass the request on.

Creating an account

Registration asks for a name, an email address, an organisation, a city and a country. The name and the address identify you when you sign in and let us reply to you; the organisation, city and country tell us which institution the request comes from, which sets the applicable rate and, in reports to funding bodies, how we count the teams served. Nothing else is required, and there is no optional profile to fill in.

Downloading the ITC/DSC Viewer

The form asks for an email address, an organisation, a department, a city and a country. We use these to tell users about corrected versions and to report, in aggregate, how widely the software is used. Downloading does not create an account and does not add you to any mailing list beyond notices about the software itself.

Working on an order

Once an order is open, the file accumulates what the work needs: the description of the requested measurements, information about the samples, messages exchanged with the facility and the documents attached to them, and the quotations and invoices issued.

Sample information is scientific data, not personal data, but it travels with the name of the person who submitted it, so it is covered by this policy. Results and raw data belong to you; we neither publish them nor pass them on.

Writing through the form

The contact form passes your name, email address and message to the people at the facility you picked — or to the team if you picked nobody. The message shows up in their workspace and is announced to them by email; a reply goes from there to your address. Your IP address, the browser you used and the result of the anti-robot check are stored as well, so that a flood of machine-written messages can be told apart. These exchanges are kept until someone deletes them by hand: deciding that a conversation has stopped being useful is not ours to do for you. Write to us and yours will be removed.

Legal bases

Accounts, orders and correspondence are processed because they are needed to perform the service you asked for (article 6.1.b of the Regulation) and because running a shared research facility is part of the public service mission of Aix-Marseille Université (article 6.1.e). Invoices and accounting records are kept because the law requires it (article 6.1.c). Download records and site statistics rest on our legitimate interest in supporting users and in knowing how the site is used (article 6.1.f).

Visit statistics

Traffic is measured by our own software, running on the same server as the site. No third-party analytics service, advertising network or social media widget is involved. One outside service does see you, and only on the pages that carry a form: the anti-robot widget from Cloudflare, which the contact form and the software download form use to tell a person from a script. It receives your address and browser details, we cannot see what it collects, and it is there because those two forms were otherwise being used to send us machine-written mail. Everything else on this site, including the animations, is served from here.

Each visit records the page viewed, the interface language, the referring site if there is one, the kind of device, the IP address, the time spent on the page, how far down it was scrolled, the labels of the buttons and links clicked, and any script error the page ran into. The address is used to derive an approximate country, city and network operator and to tell one visitor from another; it is not used to identify you personally. When there is no visitor cookie, a daily fingerprint made from the address and the browser stands in for it — it is deliberately impossible to match across days. If you are signed in, the record notes that someone signed in was reading, and nothing more: no name, no address, no account. Addresses that carry a link from an email are stored with the secret part replaced, so a password-reset or invitation link never reaches these tables.

These figures tell us which methods and pages people actually read, which languages are used and where the audience comes from — things we report to the bodies that fund the facility. Detailed records are kept for 60 days; after that only daily totals remain, and those no longer relate to an identifiable person. Crawlers are counted separately from human visits so that they do not distort the figures; their addresses are kept for 90 days. You can object to being counted at any time by writing to inp-pint@univ-amu.fr.

Cookies

The site sets three cookies, all issued by this server: one that keeps you signed in for the length of your session; one that remembers whether you read the site in English or in French, kept for a year; and one holding a random number, kept for thirteen months, which lets us tell a returning visitor from a new one without knowing who either of them is. Inside the client area a fourth one remembers which language you are editing content in. The anti-robot widget mentioned above may set its own; that one is Cloudflare's, not ours.

The first two are strictly necessary and are exempt from consent under article 82 of Law 78-17. The third serves only the statistics described above; it is never used for advertising or profiling, and can be refused by writing to us or by blocking cookies for this site in your browser. There are no third-party cookies at all — which is why you are not shown a consent banner.

How long we keep things

Account details stay while the account exists; ask us and we delete it, apart from what the accounting rules below oblige us to keep. Orders, sample descriptions, related correspondence, quotations and invoices are kept for ten years from the end of the financial year in which the work was invoiced. Detailed visit records are kept sixty days, the record of a returning visitor thirteen months — the life of the cookie — crawler addresses ninety days, and daily totals, which name no one, indefinitely. The form for downloading the ITC/DSC Viewer is handled by the platform's software distribution service; the address given there is used to tell you about corrected versions and for nothing else.

Who sees the data

Inside the facility, access is limited to the staff who handle your order. For invoicing, the details needed to issue and collect an invoice — name, organisation, address, amounts, order reference — are passed to the finance department of Aix-Marseille Université and, where the client is a public body, to the public invoicing channels the institution is required to use.

Beyond that, and beyond what the anti-robot widget on the two forms sees, nothing is shared. We sell no data, run no advertising and give no access to commercial partners.

Where the data is stored

Everything described here is stored on servers located in France and is not transferred outside the European Union. Access to the site and to the client area is encrypted; access to the administration interface is restricted and logged.

Your rights

You can ask for a copy of your data, have it corrected, ask for it to be deleted, ask us to restrict how it is used, object to processing based on our legitimate interest, and receive the data you provided in a reusable format. Write to inp-pint@univ-amu.fr or to the data protection officer. We answer within one month, extended to three for a complex request, telling you why.

Some of what we hold cannot be deleted on request: invoices and the records attached to them must be kept for the accounting period set out above.

Complaints

If you are not satisfied with our answer, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

Updates

This policy changes when the site changes. The current version dates from 20 August 2026; registered users are told by email when a change affects what we collect or how long we keep it.