Last updated: 8 July 2026
Who we are
ASTORM GROUP is a consulting and engineering firm with offices in Paris (headquarters), Tunis and Casablanca. We are the data controller for the data collected on this website, within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and the French Data Protection Act of 6 January 1978, as amended.
This page is provided pursuant to the information obligation set out in Articles 13 and 14 of the GDPR. For any question about your data: contact@astorm-group.com.
What data we collect
We only collect what is useful — nothing more.
- When you submit your CV: your identity and contact details (first name, last name, email, phone), your CV and the information it contains (experience, education, skills, languages), and the corrections you make to the analysis of your profile.
- Technical security data: IP address, browser type and characteristics of the uploaded file (size, format, digital fingerprint). This helps us protect the service against abuse and malicious files — every file is scanned by an antivirus.
- Audience measurement: pages viewed, language and origin of the visit. This relies on an in-house tool, hosted by us — your browsing data is never shared with any third party.
- When you write to us: the information you choose to share by email.
Why we use it
Each use relies on one of the legal bases provided for in Article 6 of the GDPR:
- To manage your application and our talent pool — based on your consent (Art. 6.1.a) and pre-contractual steps taken at your request (Art. 6.1.b). This is the only use made of your CV.
- To keep the platform secure (abuse prevention, antivirus scanning, technical logging) — based on our legitimate interest (Art. 6.1.f) in protecting the service and its users.
- To understand how the site is used (visit statistics aggregated in our dashboards) — based on our legitimate interest (Art. 6.1.f), with an in-house tool that respects your browsing.
Cookies
This site uses a single cookie: a strictly functional language cookie that remembers your preference between French and English for one year.
There are no advertising cookies and no third-party trackers (no Google Analytics, no embedded social networks). Our audience measurement runs server-side, without setting any cookie.
How long we keep your data
The periods below are enforced automatically by our platform, which purges data once it expires.
- Applications and CVs: 2 years after our last contact, so we can reach out if a mission matches your profile. You may request deletion at any time.
- Submission log and related technical data (IP address, browser, file fingerprint): 2 years, together with the application file they secure.
- Visit statistics: 13 months at most.
Who can access your data
Your application data is accessible only to ASTORM GROUP’s recruitment and HR teams, within the scope described above.
It is hosted on our own servers. When we rely on technical providers, they operate under contract and never use your data for their own purposes.
Security and liability
In accordance with Article 32 of the GDPR, we implement appropriate technical and organisational measures to protect your data: encrypted communications (HTTPS), systematic antivirus scanning of uploaded files, strict access control limited to authorised teams, hosting on our own servers and security logging.
However, no information system can be guaranteed to be invulnerable. In the event of fraudulent access to our systems resulting from an external attack (intrusion, malicious code or any other act of cybercrime) committed despite the security measures described above, ASTORM GROUP shall not be held liable, except where fault on its part is proven.
Should such an event occur, we undertake to act in accordance with Articles 33 and 34 of the GDPR: notification of the breach to the supervisory authority within 72 hours and, where the breach is likely to result in a high risk to your rights and freedoms, direct notification of the individuals concerned.
Your rights
In accordance with Articles 15 to 21 of the GDPR, you have the following rights at any time:
- Access (Art. 15) — obtain a copy of the data we hold about you;
- Rectification (Art. 16) — have inaccurate information corrected;
- Erasure (Art. 17) — request deletion of your file;
- Restriction (Art. 18) and objection (Art. 21) — object to a processing operation or ask for it to be suspended;
- Portability (Art. 20) — retrieve your data in a readable format;
- Withdrawal of consent (Art. 7.3) — at any time, without justification.
To exercise these rights, write to contact@astorm-group.com — we will reply within 30 days. If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).
Changes to this policy
We may update this policy to reflect legal or functional changes to the site. The date of the latest update is shown at the top of this page; in the event of a substantial change, we will say so clearly.