Book a demo
Home / GDPR & Data Protection

GDPR & Data Protection Notice

Last updated: 27 August 2026

La Mashine is committed to protecting your personal data and respecting your privacy. This notice explains, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”) and the French Data Protection Act (Loi Informatique et Libertés), how we process the personal data of the people who use our platform and advisory services.

It complements our Privacy Policy and forms part of the framework set out in our Terms & Conditions. If any term is unclear, please contact us at contact@lamashine.com.

1. Data controller

The data controller responsible for processing your personal data is La Mashine, a simplified joint-stock company (société par actions simplifiée) registered in Toulouse, France, with its registered office at 231 rue Pierre et Marie Curie, 31670 Labège, France.

For any question relating to the protection of your personal data, or to exercise your rights, you may contact us by email at contact@lamashine.com or by post at the address above, marking your letter for the attention of the data protection contact.

2. What personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

  • Identification and account data: first and last name, email address, password (stored in hashed form), professional role and the name of your project or company.
  • Content and project data: the information, documents, notes, decisions and other content you enter into the platform in the course of building your project.
  • Advisory data: notes, session records and correspondence generated when you work with our human advisors.
  • Billing data: postal address, VAT number where applicable, subscription plan and transaction history. Card details are handled directly by our payment provider and are not stored on our systems.
  • Technical and usage data: IP address, browser and device information, log data, pages viewed and actions taken within the platform.
  • Communications: the content of your messages to our support and advisory teams.

3. Legal bases for processing

We only process your personal data where we have a valid legal basis to do so under Article 6 GDPR:

  • Performance of a contract (Art. 6(1)(b)): to create and manage your account, provide the platform and advisory services, and handle billing.
  • Legitimate interests (Art. 6(1)(f)): to secure our services, prevent fraud and abuse, improve our product and understand how it is used. We balance these interests against your rights and freedoms.
  • Consent (Art. 6(1)(a)): for non-essential cookies and optional marketing communications. You may withdraw your consent at any time.
  • Legal obligation (Art. 6(1)(c)): to comply with accounting, tax and other statutory obligations.

4. Purposes of processing

We process your personal data to:

  • Provide, operate and maintain the La Mashine platform and advisory services;
  • Authenticate you and keep your account secure;
  • Deliver human support and advisory sessions in the context of your project;
  • Process payments and manage subscriptions;
  • Communicate with you about your account, service updates and, with your consent, relevant news;
  • Analyse and improve the performance, safety and usefulness of our services;
  • Comply with our legal and regulatory obligations.

5. Data retention

We keep your personal data only for as long as necessary for the purposes described above. Account and project data are retained for the duration of your contractual relationship with us.

After your account is closed, we delete or anonymise your project data within a reasonable period, generally within three (3) months, unless a longer retention period is required. Billing and accounting records are retained for ten (10) years to meet our legal obligations under French law. Technical logs are typically kept for up to twelve (12) months.

6. Your rights

Subject to the conditions set out in the GDPR, you have the following rights over your personal data:

  • Right of access: to obtain confirmation of whether we process your data and a copy of that data.
  • Right to rectification: to have inaccurate or incomplete data corrected.
  • Right to erasure: to request deletion of your data where one of the grounds in Article 17 GDPR applies.
  • Right to restriction of processing: to limit how we use your data in certain circumstances.
  • Right to data portability: to receive the data you provided in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
  • Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
  • Right to withdraw consent: where processing is based on your consent, at any time and without affecting the lawfulness of processing carried out beforehand.
  • Right to give instructions regarding the fate of your data after your death, in accordance with French law.

7. How to exercise your rights

You can exercise your rights at any time by writing to contact@lamashine.com or to our registered office. We may ask you for information to confirm your identity before acting on your request.

We will respond within one (1) month of receipt of your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension.

8. International transfers

Our infrastructure and data hosting are located within the European Union. Where a service provider processes personal data outside the European Economic Area, we ensure an adequate level of protection through appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, and we make these safeguards available on request.

9. Recipients and sub-processors

Your personal data is accessed only by authorised La Mashine staff and by carefully selected service providers acting as processors on our behalf, for example hosting, payment, email delivery and analytics providers. These processors are bound by contract to process data only on our instructions and to apply appropriate security measures. We do not sell your personal data. A description of our sub-processors is set out in our Privacy Policy.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These include encryption in transit, access controls on a need-to-know basis, hardened infrastructure and regular review of our security practices. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the competent authority as required by law.

11. Data protection contact

La Mashine has not appointed a formal Data Protection Officer as it is not required to do so, but we have designated an internal contact responsible for data protection matters. You may reach this contact at contact@lamashine.com for any question about this notice or the processing of your data. You can also use our contact page.

12. Complaints to the CNIL

If you consider that our processing of your personal data infringes the applicable regulations, you have the right to lodge a complaint with the French supervisory authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr). We would, however, appreciate the opportunity to address your concerns directly before you do so.