Last updated: 27/03/2026
Normandy Hadrontherapy is committed to protecting the personal data of its users and to complying with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and French Law No. 78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended).
1. Data Controller
Normandy Hadrontherapy
1 rue Claude Bloch, 14000 Caen, France
Email: ilyass.agram@normandy-hadrontherapy.com
Phone: +33 2 72 88 80 00
2. Data Collected and Purposes
We only collect data that is necessary for the purposes described below.
2.1 Website browsing
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Browsing data (IP address, pages visited, timestamps) | Audience measurement, security | Legitimate interest | Up to 13 months |
| Cookies | See section 6 | Consent | Up to 13 months |
2.2 Contact form
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Last name, first name, email, phone number, message | Responding to your enquiry | Legitimate interest / Performance of a contract | 3 years from last contact |
2.3 Recruitment — Job applications
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Last name, first name, contact details, CV, cover letter, professional experience and qualifications | Processing your application for a position | Pre-contractual measures (Art. 6.1.b GDPR) | 2 years from last contact, unless the applicant expressly consents to a longer period |
| Additional information added by our teams (status, follow-up notes) | Managing the recruitment process | Legitimate interest | 2 years from last contact |
3. Recipients of Personal Data
Your data is processed by authorised personnel of Normandy Hadrontherapy and, where applicable, by the following sub-processors:
- Website host: EasyW3 — data hosted in France
- Tag management: Google Tag Manager (Google LLC, United States) — tag deployment tool. GTM does not set its own persistent cookies; it conditionally loads third-party scripts (Analytics, reCAPTCHA…) based on the consent collected. Transfer to the United States under Standard Contractual Clauses.
- Audience measurement: Google Analytics 4 (Google LLC, United States) — loaded via GTM. Anonymised IP address, browsing behaviour. Transfer to the United States under Standard Contractual Clauses.
- Anti-spam protection: Google reCAPTCHA v3 (Google LLC, United States) — analyses browsing behaviour to assign a risk score on forms, with no visible interaction required from the user. Transfer to the United States under Standard Contractual Clauses.
- Videos: Vimeo Inc. (United States) — videos embedded as iframes. Vimeo may collect viewing and browsing data. Transfer to the United States under Standard Contractual Clauses.
- Videos: YouTube / Google LLC (United States) — videos embedded as iframes. Google may collect viewing and browsing data. Transfer to the United States under Standard Contractual Clauses.
- Videos: LinkedIn / LinkedIn Corporation (United States) — embedded videos via iframe. LinkedIn may collect viewing and browsing data. Transfer to the United States under standard contractual clauses.
- Maps: Google Maps / Google LLC (United States) — maps embedded via iframe. Google may collect location and browsing data. Transfer to the United States under standard contractual clauses.
Your data is not sold to third parties.
4. Your Rights
Under the GDPR and French data protection law, you have the following rights over your personal data:
- Right of access (Art. 15 GDPR) — obtain a copy of your data
- Right to rectification (Art. 16 GDPR) — correct inaccurate or incomplete data
- Right to erasure (Art. 17 GDPR) — request deletion of your data
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR) — receive your data in a structured format
- Right to object (Art. 21 GDPR) — object to processing based on legitimate interest
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
To exercise these rights, please contact us at: ilyass.agram@normandy-hadrontherapy.com or by post to the registered office address stated in section 1.
We will respond within one month of receiving your request (extendable to three months for complex requests).
You also have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés — www.cnil.fr) or with the supervisory authority of your country of residence.
5. Security
Normandy Hadrontherapy implements appropriate technical and organisational measures to protect your data against loss, alteration, unauthorised disclosure or unauthorised access, in accordance with Article 32 of the GDPR.
6. Cookies
A cookie is a small text file placed on your device when you visit a website. We use the following types of cookies:
| Type | Purpose | Duration | Consent required |
|---|---|---|---|
| Essential technical cookies | Website operation (session, security) | Session | No |
| Audience measurement cookies — Google Analytics (_ga, _gid, _ga_*) | Anonymised traffic statistics (truncated IP address). Data processed by Google LLC (United States) under Standard Contractual Clauses. | _ga: 2 years — _gid: 24h | Yes |
| Google Maps cookies | Display of interactive maps embedded in the website | Up to 6 months | Yes |
| Google Tag Manager — no persistent cookie of its own | Tag container: loads third-party scripts (Analytics, reCAPTCHA…) only based on consent collected. Does not collect browsing data by itself. | No persistent cookie of its own | Yes (for the tags it fires) |
| Google reCAPTCHA v3 — _GRECAPTCHA | Anti-spam protection on forms: analyses browsing behaviour to generate a risk score, with no visible user interaction. Data processed by Google LLC (United States) under Standard Contractual Clauses. | 6 months | Yes |
| Vimeo — video player cookies | Playback of Vimeo videos embedded as iframes. Vimeo may collect viewing and browsing data. Data processed by Vimeo Inc. (United States) under Standard Contractual Clauses. | Up to 1 year | Yes |
| Linkedin — video player cookies | Playback of Linkedin videos embedded as iframes. Linkedin may collect viewing and browsing data. Data processed by Linkedin Inc. (United States) under Standard Contractual Clauses. | Up to 1 year | Yes |
| YouTube / Google — video player cookies | Playback of YouTube videos embedded as iframes. Google may collect viewing and browsing data. Data processed by Google LLC (United States) under Standard Contractual Clauses. | Up to 2 years | Yes |
You can manage your cookie preferences at any time via the cookie banner. You may also configure your browser to refuse cookies, which may affect certain website features.
For more information on Google’s privacy practices: policies.google.com/privacy.
7. Changes to This Policy
This privacy policy may be updated at any time. The date of the last update is shown at the top of this document. We encourage you to review it periodically.