Privacy policy

In brief

I set out here which personal data are processed when you visit pysgs.net or write to me, for what purpose, for how long, and how to exercise your rights. This policy is drawn up under Articles 12 to 14 of Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés).

• No cookies are set by pysgs.net, and no audience measurement, advertising or tracking tools are used.
• Technical logs (IP address, requested page, etc.) are recorded on the server to keep the site running and secure.
• Messages sent to pysgs@proton.me are used to reply to you, to prepare a quote and, if a quote is accepted, to carry out and document the work.
• On the Portfolio page, previews of external websites are loaded: your IP address is then sent to those sites, which may set their own cookies.
• No data are sold. No automated decision is made about you.
• You can access your data, have them corrected or erased, and object at any time to processing based on my legitimate interest (sections 7 and 8).

1. Data controller

The controller for the processing described on this page is Mathieu Arbez EI, publisher of pysgs.net under the name PYSGS.

• Email: pysgs@proton.me

Further information about the publisher is given in the legal notice (/en/legal-notice/).

The data described below are collected directly from you, during your visit or through your message (Article 13 GDPR). If data about you are passed to me by a third party, for example in a message that mentions you, they are handled under the same rules; where informing you individually is impossible or would involve disproportionate effort, this page serves as information about them (Article 14(5)(b) GDPR). You can obtain any available information on their source by exercising your right of access (Article 15(1)(g) GDPR).

2. Web server logs

When you visit pysgs.net, the following information is automatically recorded in the web server's access and error logs:

• your IP address;
• the date and time of the request;
• the requested address (URL);
• your browser identifier (user agent: browser and operating system type and version);
• the referring page (referrer), when your browser sends it;
• the HTTP response code (for example 200 or 404);
• in case of an error, its technical description (error log).

• Purposes: keeping the site running, diagnosing errors, detecting and handling abuse and intrusion attempts.
• Legal basis: my legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR).
• Retention period: 6 months at most.
• Access: the logs are stored on the server and consulted by me only. The server is provided by Vultr, acting as processor (section 6).
• Requirement: sending this information is technically necessary to display the site.

These logs are not used for audience measurement or profiling.

3. Messages sent by email

If you write to pysgs@proton.me, the following data are processed:

• your email address and the associated name;
• the content of your message and its attachments;
• any information you choose to include (organisation, position, phone number, project description, etc.);
• the date and time of sending and receipt.

• Purposes: replying to you, assessing your request and preparing a quote; if a quote is accepted, performing the contract, meeting my legal obligations, in particular accounting and tax obligations, and keeping evidence of our exchanges.
• Legal basis: when you ask for a quote or a service, steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); for other messages, my legitimate interest in replying to people who contact me (Article 6(1)(f) GDPR); if a quote is accepted, performance of the contract (Article 6(1)(b) GDPR), compliance with my legal obligations (Article 6(1)(c) GDPR) and my legitimate interest in being able to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).
• Retention period: 1 year from the last exchange. If a quote is accepted, the exchanges needed for the contract are kept 5 years after the end of the work, accounting records (invoices in particular) being kept for 10 years.
• Recipients: your messages are read by me only. They are stored in the mailbox provided by Proton AG, acting as processor (section 6).
• Optional: writing to me is not mandatory. Without a valid email address, no reply can be sent to you.

It is recommended to send only the information needed for your request, and no sensitive data (health, opinions, etc.).

4. Cookies and page preloading

No cookies or other trackers are used by pysgs.net: no audience measurement, no advertising, no tracking pixel, no external scripts. Fonts are hosted on the site's own server; no request is sent to a third-party service to display them.

As no tracker requiring consent is set by pysgs.net, no cookie banner is displayed when you arrive on the site. The sites shown as previews on the Portfolio page may set their own cookies when those previews are loaded: see section 5.

To speed up navigation, some pages of pysgs.net may be preloaded by your browser before you click a link (prefetching and speculation rules). These pages are requested from pysgs.net only: no data are sent to third parties as a result. These requests are recorded in the server logs like any other (section 2).

5. Previews of external websites (Portfolio page)

Six websites are presented on the /en/portfolio/ page as live previews, displayed in embedded frames (iframes) with security restrictions (sandbox attribute). These restrictions do not prevent the embedded site from running scripts or setting cookies. Each preview comes with a link to the actual site. The sites shown are:

• shake-document-protect.org, mathieu-arbez-hermoso.net and thisisnotanespresso.net, the publisher's own projects;
• armel.ink, a client's site;
• nostalgiafun.io;
• wagmigeneration.net.

The previews are loaded as follows:

• on computers, previews are loaded automatically when they come close to the area shown on screen, when the page opens or as you scroll;
• on phones and narrow screens, only the wagmigeneration.net preview is loaded, under the same conditions; the others are replaced by a still image. During a check carried out on 24 October 2026, three cookies with random names and a 24-hour lifetime were set by wagmigeneration.net when its preview loaded.

When a preview is loaded, a direct connection is made between your browser and the site concerned:

• your IP address and the technical information sent by any browser (such as the browser type) are sent to that site;
• cookies belonging to that site may be set on your device.

Responsibility: by embedding these previews, I determine the collection of your IP address by the embedded site and its transmission to that site. For the sites I publish, I am the sole controller of this operation. For the other sites, I am a joint controller with the publisher of the embedded site, for this operation only (Court of Justice of the European Union, 29 July 2019, Fashion ID, C-40/17). This operation is based on my legitimate interest in showing work as it actually is (Article 6(1)(f) GDPR).

For the sites I do not publish, the essence of how our obligations are shared is as follows (Article 26 GDPR): I provide the information set out on this page, and requests about the collection and transmission of your IP address can be sent to me; the publisher of each embedded site is responsible for any processing it carries out afterwards. You may exercise your rights with me as well as with each of those publishers (Article 26(3) GDPR).

Any further processing by each site, in particular through its cookies, is the responsibility of its publisher and is covered by the information that publisher provides on its own site.

To avoid these transmissions, you can choose not to open the Portfolio page. You can also block third-party cookies in your browser settings.

6. Service providers and transfers outside the European Union

Two service providers process data on my behalf, as processors (Article 28 GDPR):

• Website hosting: The Constant Company, LLC (Vultr), 319 Clematis Street, Suite 900, West Palm Beach, FL 33401, United States. The pysgs.net server is located in a data centre in Frankfurt am Main (Germany), in the European Union.
• Email: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. According to Proton, messages are stored encrypted on servers located exclusively in Switzerland, Germany or Norway.

Apart from these two service providers and the sites whose previews are loaded on the Portfolio page, which then receive your IP address (section 5), no data are disclosed to third parties, except where required by law (for example at the request of a judicial authority).

Switzerland and Norway: the European Commission has found that Switzerland ensures an adequate level of protection (Decision 2000/518/EC of 26 July 2000, kept in force by Article 45(9) GDPR and confirmed in the review published by the Commission in January 2024). Norway is part of the European Economic Area, where the GDPR applies.

United States: the server is located in Germany, but Vultr is a company established in the United States; access to data from that country, for example for technical support, cannot be ruled out. Vultr states that it participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023), and that its other transfers are covered by the European Commission's standard contractual clauses (Article 46 GDPR). A copy of these safeguards can be obtained on request at pysgs@proton.me.

7. Your rights

You have the following rights over data concerning you:

• right of access: to know whether data about you are processed and to obtain a copy (Article 15 GDPR);
• right to rectification: to have inaccurate data corrected or incomplete data completed (Article 16);
• right to erasure: to have your data deleted, in the cases set out in Article 17;
• right to restriction: to have the use of your data suspended, for example while a dispute is checked (Article 18);
• right to data portability: to receive the data you provided to me for a quote request or a contract in a structured, commonly used and machine-readable format, and to send them to another controller (Article 20);
• right to set instructions on the storage, erasure and disclosure of your data after your death, and to appoint a person to carry them out. Your specific instructions can be sent to me at pysgs@proton.me; you may state in them whether your data may be disclosed to a third party you name. Without such instructions, your heirs may exercise some of these rights under the conditions laid down in Article 85 of French Law No. 78-17 of 6 January 1978. Unless instructed otherwise, your data are deleted at the end of the periods stated on this page.

Your right to object is set out separately, in section 8.

None of the processing described on this page is based on your consent.

8. Right to object

You may object at any time, on grounds relating to your particular situation, to processing based on my legitimate interest: the server logs, messages that are not quote requests, keeping evidence of our exchanges and the automatic loading of previews on the Portfolio page (Article 21 GDPR).

The processing of your data then stops, unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims (Article 21(1) GDPR). To exercise this right, see section 9.

9. How to exercise your rights

To exercise your rights, write to pysgs@proton.me.

• You receive a reply within one month of receipt of your request. This period may be extended by two further months if the request is complex or requests are numerous; you are then informed within the first month (Article 12(3) GDPR).
• Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive (Article 12(5)).
• Where there is reasonable doubt about your identity, additional information may be requested (Article 12(6)).
• For server logs, an IP address cannot be linked to a person without additional information: state the IP address you used and the approximate date and time of your visit. Otherwise, the data concerned cannot be found (Article 11 GDPR).

10. Complaint to the CNIL

If you consider that the processing of your data does not comply with the rules, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), or with the supervisory authority of the EU Member State where you live, where you work or where the alleged infringement took place (Article 77 GDPR):

• online: www.cnil.fr/fr/plaintes;
• by post: CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France.

You may contact me first to try to resolve the issue, but this is not required.

11. Security

Technical and organisational measures appropriate to the risks are in place to protect your data (Article 32 GDPR), including:

• encryption of exchanges between your browser and pysgs.net (HTTPS);
• data minimisation: the site is static, with no database, no forms and no user accounts;
• encrypted storage of messages by Proton.

If a personal data breach is likely to result in a high risk to your rights and freedoms, you are informed without undue delay (Article 34 GDPR).

12. What is not done

• No data are sold, rented or transferred for commercial purposes.
• No profiling and no decision based solely on automated processing take place (Article 22 GDPR).
• No service offered on pysgs.net is aimed at children.

13. Changes to this policy

This policy may be changed, in particular when the site, the service providers or the law change. The version in force is the one published on this page. The French version is the legally binding version; this English version is a translation.

Last updated: 24 October 2026.