Data protection policy

Last updated: October 2026

A. Introduction

This page details the personal data collected on wearetandem.ai, how it is used, how long it is kept and how to exercise your rights.

By browsing our site and consenting to cookies under the conditions below, you accept the processing of your personal data in accordance with this policy.

Data controller: TANDEM GROUP (SAS), 60 rue François Ier, 75008 Paris, RCS Paris 102 349 081. For any question relating to the processing of your data, use our contact form.

B. Personal information we collect

The following types of personal information may be collected, stored and used:

Information about your device, including your IP address, approximate geographic location, browser type and version, and operating system.
Information about your visits and use of the site, including referral source, visit duration, pages viewed and navigation paths, as well as the origin of your visit (utm campaign parameters, ad click identifier, referring site, landing page) when you fill in a form.
Information such as your name, email address, phone number, company, job title, company size and revenue, the services you are interested in and how you heard about Tandem, which you provide through the contact form or when you request a resource (guide, white paper).
Information you submit when subscribing to our newsletter, either directly or by checking the box on a resource form (name, email address).
The content of messages you send us by email or via the contact form, including their metadata.
The information you enter to book a meeting through Calendly: contact details, company and chosen time slot.
Any other personal information you voluntarily provide.
Before disclosing personal information about another person, you must obtain their prior consent.
We do not collect any sensitive data under the GDPR (racial origin, political opinions, religious beliefs, health data, etc.).
No automated decision producing legal effects is taken from the data collected on the site.

You remain solely responsible for the accuracy and currency of the information you provide.

C. How we use your personal information

Personal information provided through our site is used for the purposes described below. The legal basis for processing is, as applicable, your consent, the performance of pre-contractual measures, or our legitimate interest in growing our business.

Administer our site, respond to your contact requests and give you access to the resources you request.
Personalize our responses and prepare our commercial meetings.
Send you the Optimia newsletter if you have subscribed (you can unsubscribe at any time from each email).
Send you communications about our services where you have given explicit consent.
Issue and keep invoices and accounting documents related to our services.
Measure site audience and improve content (anonymized statistics).
Prevent fraud and ensure the technical security of the site.
Respond to any legal request from a competent authority.
Assert our rights in the context of a potential dispute.
Any other purpose compatible with the above, subject to prior information.
Identify where your request comes from (channel, campaign, landing page), with your consent for the part stored in a cookie, to measure how well our communication works.

Without your explicit consent, we will never share your personal information with third parties for direct marketing purposes.

D. Recipients of your information

Your personal data is accessible to authorized persons within Tandem Group, within the limits of their duties, and to our technical subcontractors acting on our behalf.

We may share data with the following categories of recipients:

Our web host, Vercel, and our content management platform, Sanity, which run the site and store its content.
Our operational tools: Attio, our CRM, where contact and resource requests are recorded with their origin; Slack for internal notifications; Calendly for meeting bookings; Substack for the Optimia newsletter; Google Workspace (Google Sheets) to record resource requests; Google Analytics and Google Ads, with your consent, for audience and campaign measurement; Resend for transactional emails when that service is enabled.
Our legal and accounting advisors, and any public or judicial body in the case of a legal obligation.

We ensure that these subcontractors provide sufficient personal data protection guarantees.

E. International transfers

Some of our subcontractors are based in the United States: Vercel (site hosting), Calendly (meeting booking), Substack (newsletter), Google (shared spreadsheet, Google Analytics, Google Ads), Slack (team messaging) and Resend (email delivery). Attio, our CRM, is based in the United Kingdom, which benefits from a European Commission adequacy decision.

These transfers rely on the EU-US adequacy decision (Data Privacy Framework) where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

You can request a copy of the guarantees in place via our contact form.

F. Retention of your data

We retain your personal data for the strict duration necessary for the purpose of the processing, then we archive or delete it. Prospect data is retained for 3 years from the last active contact. Customer data is retained for 10 years from the end of the commercial relationship (accounting obligation). The visit origin cookie (tdm_attr) is kept for 13 months at most, and your cookie choice for 12 months.

We may retain certain data beyond these periods if required by law or if necessary to defend our rights in court.

G. Security of your data

We implement reasonable technical and organizational measures to protect your data against loss, alteration or unauthorized access: TLS encryption across the entire site, hosting on professional GDPR-compliant infrastructure, access limited to authorized persons.

You acknowledge, however, that the transmission of information over the internet is never entirely secure, and that we cannot guarantee absolute security.

In the event of a data breach likely to create a risk to your rights, we undertake to notify the CNIL within 72 hours and, where applicable, to inform you directly.

H. Your rights

In accordance with the GDPR and the French "Informatique et Libertés" law, you have the following rights over your personal data:

Right of access: confirm that your data is processed and obtain a copy.
Right of rectification: have inaccurate or incomplete data corrected.
Right to erasure (right to be forgotten): request deletion of your data in the cases provided by law.
Right to restriction: restrict the use of your data in certain situations.
Right to portability: receive your data in a structured and readable format.
Right to object: object to processing, in particular for commercial prospecting purposes.

To exercise these rights, use our contact form.

You also have the right to lodge a complaint with the CNIL, the French supervisory authority: cnil.fr.

I. Third-party websites

Our site contains links to third-party sites (LinkedIn, YouTube, Spotify, Substack, Calendly). We have no control over these sites and decline all responsibility for their privacy policies or practices.

We invite you to consult the privacy policies of these third-party sites before sharing personal data with them.

J. Changes

We may update this policy. The date of the last change appears at the top of this page.

K. Cookies

Our site uses cookies and trackers for the following purposes. Apart from strictly necessary cookies, none is set without your consent, collected by our consent manager (tarteaucitron):

Strictly necessary cookies: essential for site operation (language preference, remembering your cookie choice for 12 months). They do not require your consent.
Audience measurement (Google Analytics): site traffic statistics, with your consent.
Tandem attribution (tdm_attr cookie, 13 months at most): remembers where your visit came from (campaign, referring site, landing page) so we know how you found us if you write to us, with your consent. Without consent, this origin is only kept while you browse, with no cookie.
Advertising (Google Ads): measures the performance of our ad campaigns, with your consent.
Vercel Web Analytics measures site traffic without cookies or data that could identify you; it does not require consent.

Google Analytics and Google Tag Manager are loaded on every page in Google Consent Mode: until you accept, Google tools set no cookie and only receive technical signals with no identifier.

You can change your choice at any time through the "Cookie settings" link at the bottom of every page, or set your browser to block or delete cookies. Blocking all cookies may limit your experience on the site.