Privacy Policy

Data controller

The controller of the personal data collected on the website https://xrbentsh.com is XR BENTSH CONSULTING, a société par actions simplifiée registered with the Paris Trade and Companies Register under number 919 574 053, whose contact address is 20 Rue Quentin Bauchart, 75008 Paris, France.

For any question about your data, write to contact@xrbentsh.com. The company has not appointed a data protection officer.

This policy describes the processing carried out on the website, in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978 (Loi Informatique et Libertés).

Data collected and purposes

The website only collects the data you choose to send through its forms, together with the technical data strictly necessary for its security.

Contact form

• Data: name, email address, telephone number (optional) and the content of your message.
• Purpose: to answer your request and follow up on our exchanges.
• Legal basis: our legitimate interest in answering the requests we receive or, where your request concerns our services, steps taken at your request prior to entering into a contract (Article 6(1)(f) or 6(1)(b) GDPR).

Application for a job offer

• Data: name, email address, telephone number (optional), message and the job offer concerned. The website does not allow CVs to be uploaded.
• Purpose: to review your application, contact you and manage the recruitment or consultant placement process.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).

Newsletter subscription

• Data: email address.
• Purpose: to send you our news and publications.
• Legal basis: your consent, given by ticking the dedicated box, which is never pre-ticked (Article 6(1)(a) GDPR).

Website security and abuse prevention

• Data: IP address, kept only in hashed form in temporary counters, and a truncated IP address included in the notification message.
• Purpose: to limit abusive or automated submissions and keep the website secure.
• Legal basis: our legitimate interest in protecting the website and our services (Article 6(1)(f) GDPR).

Fields marked as mandatory are necessary to process your request. Without them, it cannot be processed. Please do not include any sensitive data in your messages, such as information about health, political opinions or religious beliefs.

This data is not subject to any fully automated decision making or profiling.

Recipients and processors

Your data is accessible only to the XR BENTSH CONSULTING staff authorised to handle your request or application, including in its offices in Paris, Milan, Brussels, Singapore, Abu Dhabi, Doha and New York.

Messages sent through the forms are not stored on the web server. They are forwarded by email to the company’s mailbox.

We use the following processors:

• Google Ireland Limited and Google LLC (Google Workspace), for the company’s email service;
• the website hosting provider, identified in the Legal Notice, for the technical operation of the server.

Where an application concerns an assignment with a client company, your information is shared with that company only with your prior agreement.

Your data is neither sold nor rented. It may be disclosed to competent authorities where required by law.

Transfers outside the European Union

Google LLC, based in the United States, is certified under the EU US Data Privacy Framework. Transfers to this company rely on the adequacy decision adopted by the European Commission on 10 July 2023.

Where members of our teams based in Singapore, the United Arab Emirates, Qatar or the United States access your data to handle your request or application, this transfer is governed by the standard contractual clauses adopted by the European Commission.

You can obtain a copy of the applicable safeguards by writing to contact@xrbentsh.com.

Retention periods

• Contacts and prospects: 3 years from the last exchange.
• Candidates: 2 years from the last contact, unless you agree to a longer period.
• Newsletter: until you unsubscribe or withdraw your consent.
• Anti-abuse counters containing the hashed IP address: 1 hour at most.

The truncated IP address included in the notification message is kept with that message for the period applicable to the request concerned. At the end of these periods, the data is deleted.

Security

XR BENTSH CONSULTING implements appropriate technical and organisational measures to protect your data, including:

• encryption of exchanges between your browser and the website (HTTPS);
• no storage of messages on the web server;
• hashing of IP addresses in anti-abuse counters and truncation of the IP address in notifications;
• access to the mailbox restricted to authorised persons.

Cookies and trackers

The website does not set any cookies and does not use any audience measurement tool or advertising tracker. Fonts are hosted on the website’s own server, so no request is sent to a third party font service during your visit.

The Google Maps map on the Contact page is loaded only after you click on it. Until you click, no data is sent to Google. After your click, Google may receive your IP address and read or set cookies on your device. Any subsequent processing by Google is governed by its own privacy policy.

The buttons for sharing articles on LinkedIn and X are simple links that do not load any third party script. If you use them, you are taken to these platforms, which process your data under their own policies.

Your rights

Under the GDPR and the Loi Informatique et Libertés, you have the following rights over your data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object to processing based on our legitimate interest;
• right to portability of the data you have provided to us, for processing based on your consent or on pre-contractual steps;
• right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• right to set instructions regarding the fate of your data after your death (Article 85 of the Loi Informatique et Libertés).

How to exercise your rights

To exercise your rights, write to contact@xrbentsh.com or by post to XR BENTSH CONSULTING, 20 Rue Quentin Bauchart, 75008 Paris, France.

We respond within one month of receiving your request. This period may be extended by two months for complex or numerous requests. In that case, we will inform you. If there is reasonable doubt about your identity, we may ask you for proof of identity.

To unsubscribe from the newsletter, write to contact@xrbentsh.com or use the unsubscribe link where it appears in the mailing.

Complaint to the CNIL

You may lodge a complaint at any time with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Changes to this policy

We may amend this policy to reflect legal or technical developments. The version in force is the one published on the website with its effective date. In the event of a substantial change, appropriate information will be provided on the website.

In the event of any discrepancy between language versions, the French version prevails.

Effective date

Effective date: 15 September 2026.