Legal
Privacy
How DecaPlants handles personal data on this website and in our work with you.
Last updated 28 October 2026
1. Who we are
DecaPlants SAS (“DecaPlants”, “we”) is the controller of the personal data described in this notice.
- Controller
- DecaPlants SAS
- Address
- 47 rue Vivienne, 75002 Paris, France
- Privacy contact
- contact@decaplants.com
For any question about your data, or to use your rights, write to us at the address above.
2. What this notice covers
This notice covers this website (decaplants.com) and the ways you can reach us from it: email, the contact page, our Slack community and our social media pages. It also covers the people we work with at customers, partners and suppliers, and people who apply to join us.
Process data from customer plants is covered by our agreement with each customer. See Projects and plant data below.
3. What we collect and why
Visiting this website
When you visit this website, our hosting provider automatically records the technical data your browser sends: IP address, date and time, the page requested, the referring page, and your browser and operating system. We use it only to deliver the website, keep it secure and fix errors. We don’t use analytics, advertising or tracking tools, and we don’t build profiles of visitors.
Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR)
Fonts
To display our typeface, Geist, your browser loads font files from Google Fonts, a Google service. This sends Google your IP address and browser details. Google’s privacy policy applies to that request.
Legal basis: our legitimate interest in presenting the website consistently (Art. 6(1)(f) GDPR)
Contacting us
The form on our contact page doesn’t send anything to our servers. When you press Submit, it opens your own email app with your message ready, and nothing reaches us until you press send. We then receive what you choose to send: your name and email address, and if you add them, your phone number, company, inquiry type and message. The same applies when you email us directly. We use this to answer you and, where relevant, to arrange a demo or follow up on a business discussion.
Legal basis: steps you ask for before a contract (Art. 6(1)(b)) or our legitimate interest in answering inquiries (Art. 6(1)(f))
Customers, partners and suppliers
For the people we work with, we keep business contact details (name, company, job title, email and phone number) and our correspondence. For customers we also keep what we need for contracts and invoicing.
Legal basis: performing our contracts (Art. 6(1)(b)), legal obligations such as accounting (Art. 6(1)(c)) and our legitimate interest in managing business relationships (Art. 6(1)(f))
Projects and plant data
In projects, DecaOS works with process data from a customer’s plant: measurements, lab results, batch records and models. This is mostly not personal data. Where it does include personal data, such as operator names or user IDs in records, we process it on our customer’s behalf and on their instructions, as set out in our agreement with them, including a data processing agreement where Article 28 GDPR requires one. Questions about that data are best sent to the company that runs the plant. Integrations explains how DecaOS connects to plant systems.
Applying to work with us
If you apply for a job or an internship, we use your application (CV, cover letter, contact details and anything else you send us) and our interview notes to assess it. If we don’t hire you, we keep your application for up to two years after our last contact so we can consider you for future roles, unless you ask us to delete it sooner.
Legal basis: steps before a contract (Art. 6(1)(b)) and our legitimate interest in recruiting (Art. 6(1)(f))
Our Slack community
Our community runs on Slack, a service of Slack Technologies, a Salesforce company. If you join, Slack processes your account data under its own terms and privacy policy. Members of the community, including DecaPlants, can see your profile and the messages you post there.
Legal basis: our legitimate interest in running the community (Art. 6(1)(f))
Social media
The LinkedIn, X and YouTube icons on this website are plain links. Nothing loads from these services until you click, and their own privacy policies then apply. If you follow or contact us on these platforms, we see what the platform shows us, such as your public profile.
News from DecaPlants
If we send you news about DecaPlants by email, we do so with your consent or, for existing business contacts, on the basis of our legitimate interest. Every message lets you opt out, and you can object at any time by writing to us.
4. Cookies and browser storage
This website doesn’t use cookies for analytics, advertising or tracking, and it doesn’t store anything in your browser. Our hosting provider may set strictly necessary security cookies to protect the site. Consent Settings lists everything the website uses.
5. Who we share data with
We don’t sell personal data. We share it only with:
- Service providers who help us run DecaPlants: website hosting (Webflow), fonts (Google), our email and office software, and our community (Slack). They act on our behalf or, where stated above, under their own terms.
- Professional advisers, such as accountants and lawyers, when we need them.
- Authorities, courts and regulators, when the law requires it or to protect our rights.
- A buyer or investor, if DecaPlants is involved in a merger, acquisition or financing, under a duty of confidentiality.
6. Transfers outside the European Union
Some of our providers, such as Webflow, Google and Slack, are based in the United States, so data may be processed there. In that case we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission’s standard contractual clauses.
7. How long we keep data
| Data | How long we keep it |
|---|---|
| Website logs | For a limited period, for security and troubleshooting only |
| Inquiries and prospects | Up to three years after our last contact |
| Customers, partners and suppliers | For the relationship, then for the limitation periods set by law |
| Accounting records | Ten years, as French law requires |
| Job applications | Up to two years after our last contact |
| Slack community | Until you leave the community or ask us to remove your content |
8. Security
We protect personal data with technical and organisational measures suited to the risk, including encrypted connections (HTTPS), access limited to the people who need it, and providers chosen for their security practices. No system is completely secure, so if you think your data with us is at risk, please tell us straight away.
9. Your rights
Under the GDPR and the French Data Protection Act, you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- object to how we use it, and to direct marketing at any time;
- receive data you gave us in a portable format;
- withdraw your consent at any time, where we rely on it;
- give instructions on what happens to your data after your death.
To use any of these rights, email contact@decaplants.com. We reply within one month and may ask you to confirm your identity.
You can also complain to the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr), or to the authority where you live or work.
10. Changes to this notice
We update this notice when our activities change. The date at the top shows the current version, and we make significant changes clear on this website.