Privacy Policy

1. Introduction and Scope

Cerri Lisa (“we”, “our”, or “the Enterprise”) operates the digital research and acoustic engineering portal accessible via https://zenovio.info. We are deeply committed to protecting the fundamental privacy rights of our site visitors, researchers, academic partners, and consulting clients.

This Privacy Policy outlines the categories of information we collect, the lawful grounds governing our data processing under the European Union General Data Protection Regulation (Regulation EU 2016/679 – GDPR) and the French Loi Informatique et Libertés, how such data is safeguarded, and the statutory rights available to you.

2. Identity of the Data Controller

The Data Controller responsible for personal data collected through this website is:

• Enterprise: Cerri Lisa (Entrepreneur individuel)
• Principal / Representative: Lisa Cerri
• Registration (RNE / SIREN): 993 418 664
• APE / NAF Code: 5920Z (Enregistrement sonore et édition musicale)
• Registered Office: 14 Rue de la Baratina, 66430 Bompas, France
• Direct Telephone: +33 4 68 53 12 90
• Dedicated Privacy Email: [email protected]

3. Categories of Data Processed & Methods of Collection

We collect data through two primary mechanisms: voluntary submissions through our technical consultation channels and automated technical server diagnostics.

A. Voluntarily Submitted Information

When you submit an acoustic consultation request, download technical whitepapers, or initiate project correspondence via our online intake forms, we may collect:

• Full Name and Professional Title;
• Institutional or Corporate Affiliation;
• Direct Contact Information (email address, telephone number, physical studio address);
• Project Scope Data (room architectural dimensions, audio stem specifications, loudness compliance targets, budget brackets).

B. Automated Technical Diagnostics & Server Logs

When accessing our online calculation utilities (such as the Sabine RT60 Estimator or Uncompressed PCM Bitrate Calculator), our web server automatically records standard access logs necessary for infrastructure security and denial-of-service prevention:

• Internet Protocol (IP) address (truncated / anonymized where appropriate);
• Timestamp, HTTP request method, and URI path requested;
• HTTP status codes and bytes transferred;
• User-Agent string (browser version, operating system architecture);
• Referring URL.

4. Legal Basis for Data Processing (GDPR Article 6)

We process personal data strictly where permitted under European Union law:

Processing Purpose	Data Categories	Lawful Basis under GDPR
Handling consultation inquiries & project quotations	Name, email, phone, studio technical specifications	Article 6(1)(b): Necessary for the performance of a contract or pre-contractual measures.
Platform security, DDoS prevention & server diagnostics	IP address, HTTP request headers, access logs	Article 6(1)(f): Legitimate interests in maintaining operational integrity and cybersecurity.
Statutory accounting, tax & commercial recordkeeping	Invoicing coordinates, SIREN/VAT numbers, transaction records	Article 6(1)(c): Compliance with French legal obligations (Code de commerce, CGI).
Interactive preferences & non-essential telemetry	Cookie identifiers, localized browser preferences	Article 6(1)(a): Freely given, specific, informed, and unambiguous user consent.

5. Data Retention Periods

Cerri Lisa adheres to strict data minimization principles. Personal information is retained only for the duration strictly necessary to fulfill the purposes for which it was gathered:

• Consultation Inquiries (Non-contractual): Retained for a maximum of 24 months from the date of final communication, after which records are permanently expunged.
• Client & Accounting Files: Commercial contracts, project specifications, and statutory invoices are retained for ten (10) years in accordance with Article L. 123-22 of the French Commercial Code.
• Web Server Security Logs: Automatically rotated and purged on a rolling 30-day schedule.
• Cookie Consent Telemetry: Stored locally on your device for a maximum of twelve (12) months.

6. Security Measures & Technical Safeguards

We implement robust physical, electronic, and procedural safeguards designed to protect personal information against unauthorized access, destruction, alteration, or disclosure:

• Encryption in Transit: 256-bit TLS (Transport Layer Security) with strict HTTPS enforcement across all endpoints;
• HTTP Security Headers: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and X-XSS-Protection enabled;
• Access Restrictions: Multi-factor authentication and role-based access control for administrative consoles;
• Zero Code Footprint: We do not deploy third-party advertising trackers, social network tracking pixels, or intrusive behavioral profiling scripts.

7. International Data Transfers

All primary server infrastructure and operational databases utilized by Cerri Lisa are located within the European Economic Area (EEA). We do not transfer personal data to jurisdictions outside the EEA unless adequate safeguards are established pursuant to Chapter V of the GDPR (such as European Commission Standard Contractual Clauses – SCCs).

8. Your Statutory Rights under GDPR

As a data subject located within the European Union, you enjoy enforceable rights under Articles 15 to 22 of Regulation (EU) 2016/679:

• Right of Access (Art. 15): You may request confirmation as to whether your personal data is processed and obtain a copy of that data.
• Right to Rectification (Art. 16): You may request the prompt correction of inaccurate or incomplete personal records.
• Right to Erasure / “Right to be Forgotten” (Art. 17): You may request the deletion of your personal data where retention is no longer justified.
• Right to Restriction of Processing (Art. 18): You may request temporary suspension of data processing under certain statutory circumstances.
• Right to Data Portability (Art. 20): You may receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You may object at any time to processing based on legitimate interests.

To exercise any of these rights, submit a written request accompanied by proof of identity to [email protected] or via registered postal mail to:

9. Supervisory Authority & Right to Lodge a Complaint

If you consider that our processing of your personal information infringes statutory data protection regulations, you retain the right to lodge a formal complaint with the French national supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr • Phone: +33 (0)1 53 73 22 22

10. Updates to this Policy

We reserve the right to amend this Privacy Policy periodically to reflect evolving regulatory directives or enhancements to our digital services. Material changes will be published directly on this page with an updated revision timestamp.