Privacy Policy

Contents

Who we are Data we collect How we use it Legal basis Retention Third parties International transfers Your rights Cookies Contact

Velox Energy SAS ("Velox AI", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what data we collect through ai.velox-energy.com, why we collect it, and what rights you have under the General Data Protection Regulation (GDPR) and applicable French law.

1. Who we are

The data controller is:

2. Data we collect

We collect personal data only when you actively provide it through this website. We do not collect data passively beyond standard server logs and session cookies.

2.1 Contact and demo request form

When you submit the contact form or request a demo, we collect:

• First and last name
• Professional email address
• Company name and role (optional)
• Topic and message content

2.2 Platform accounts

If you are a Velox AI platform user, we additionally collect your login credentials (email and hashed password), your organisation and role, and usage logs for security and audit purposes.

2.3 Technical data

Our servers automatically record standard access logs: IP address (anonymised after 30 days), browser type, pages visited and timestamps. This data is used exclusively for security and performance monitoring.

2.4 Environmental telemetry — not personal data

The climate and environmental data captured by Velox AI physical sensor nodes (temperature, humidity, wind speed, air quality, etc.) is not personal data under GDPR. It is environmental telemetry from physical infrastructure and is therefore outside the scope of this Privacy Policy.

3. How we use your data

Purpose	Legal basis
Respond to your demo request or enquiry	Legitimate interest / Pre-contractual steps
Provide and manage your platform access	Performance of contract
Send product updates and relevant communications (if you opt in)	Consent
Comply with legal and regulatory obligations	Legal obligation
Detect and prevent fraud or security incidents	Legitimate interest
Improve the website and platform (aggregated, anonymised analytics)	Legitimate interest

4. Legal basis for processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Legitimate interest — responding to enquiries, fraud prevention, website analytics
• Performance of contract — providing platform access and services you have subscribed to
• Legal obligation — compliance with applicable French and EU law
• Consent — marketing communications (you may withdraw at any time)

5. Data retention

• Contact form submissions — retained for 3 years from last contact
• Platform account data — retained for the duration of the contract, then 5 years for legal compliance
• Server access logs — IP addresses anonymised after 30 days; aggregated logs retained for 12 months
• Marketing communications — until you withdraw consent

6. Third parties and sub-processors

We share your data only with sub-processors necessary to deliver our services, all operating under GDPR-compliant data processing agreements:

Sub-processor	Location	Purpose
Google Cloud Platform (GCP)	EU (europe-west1)	Infrastructure hosting, database, API
OVH	France	Website hosting (ai.velox-energy.com)
Cloudflare	EU/US	Bot protection (Turnstile) on contact form
Google Analytics 4	EU/US	Anonymous website traffic analytics (IP anonymised, cookieless mode)

We do not sell, rent or trade your personal data to any third party.

7. International transfers

Our primary infrastructure is hosted within the European Union (GCP europe-west1, Belgium). Where data is processed outside the EEA (notably by Cloudflare), appropriate safeguards are in place via Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — Obtain a copy of the personal data we hold about you
• Right to rectification (Art. 16) — Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17) — Request deletion of your data, subject to legal retention obligations
• Right to restriction (Art. 18) — Request that we limit processing of your data
• Right to portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest
• Right to withdraw consent — Withdraw marketing consent at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@velox-energy.com. We will respond within 30 days. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) at www.cnil.fr.

9. Cookies

This website uses a minimal number of cookies:

Cookie	Type	Duration	Purpose
Session cookie	First party	Session	Maintains your session during navigation. Deleted on browser close.
Cloudflare Turnstile	Third party (Cloudflare)	Session	Bot detection on the contact form. No tracking or advertising purpose.
_ga, _ga_*	Third party (Google)	2 years	Anonymous traffic analytics via Google Analytics 4. IP anonymised. No advertising purpose.

We use Google Analytics 4 with IP anonymisation enabled. We do not use advertising cookies or tracking pixels. We do not track your behaviour across other websites or use your data for advertising purposes.

10. Contact & updates

For any privacy-related question or to exercise your rights:

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Significant changes will be notified to platform users by email.