Privacy Policy

The data controller within the meaning of Article 4(7) GDPR is:

KONZEPT SERVICES SUARL (SUARL (Société Unipersonnelle à Responsabilité Limitée), totalement exportatrice et non résidente), 15 Rue Omar Kaddeh, Immeuble Le Montplaisir, 2ème étage B25, 1073 Montplaisir, Tunis, Tunisie. Managing Director: Hassan Arouri. Email: hello@konzeptservices.com.

Data protection enquiries: hello@konzeptservices.com.

Appointing a Data Protection Officer is not mandatory under Article 37 GDPR; data protection responsibility rests directly with management.

Contact for data subject requests from the EU: hello@konzeptservices.com. A representative in the Union pursuant to Article 27 GDPR will be designated and published here should the exemptions of Article 27(2) GDPR cease to apply; until then you may exercise all data subject rights directly through the contact details above.

We process data you actively provide (contact form, email, phone, contractual data) as well as technical data automatically generated when you use the website.

This may include: salutation, first and last name, company, role, email, phone, postal address, country, VAT number, the content of your message, IP address, device and browser information, access timestamp and referrer URL.

Please do not submit special categories of personal data within the meaning of Article 9 GDPR (e.g. health, religion, political opinions).

Obligation to provide data (Article 13(2)(e) GDPR): providing personal data is neither a statutory nor a contractual requirement. However, without the information marked as mandatory in our forms (in particular name, company, email) we cannot process your enquiry or enter into and perform a contract.

We process your data on the following legal bases:

• Article 6(1)(b) GDPR – pre-contractual and contractual performance, handling enquiries;
• Article 6(1)(c) GDPR – compliance with legal obligations (in particular tax retention);
• Article 6(1)(f) GDPR – legitimate interests (operation, security and improvement of the website, direct marketing to existing customers, fraud prevention);
• Article 6(1)(a) GDPR – consent (newsletter, non-essential cookies, reference citation).

Only strictly necessary cookies are set without consent. Any other cookies, in particular for analytics, marketing or personalisation, are activated only after your express consent via our consent banner (Article 6(1)(a) GDPR, Article 82 of the French Data Protection Act).

You may withdraw your consent at any time with effect for the future by adjusting your browser settings or re-opening our consent tool.

We send newsletters only with your consent (double opt-in). Every email contains an unsubscribe link. You may also opt out at any time by writing to hello@konzeptservices.com.

We disclose personal data only where permitted by law: (1) at your request, (2) to perform the contract, (3) where required by a legal obligation or a competent authority, or (4) to carefully selected processors (Article 28 GDPR), in particular hosting, email and IT providers as well as tax partners. All processors are bound by GDPR-compliant agreements.

We do not sell or rent personal data.

Our registered office and part of our service delivery are located in Tunisia. Tunisia is currently not covered by an adequacy decision of the European Commission (Article 45 GDPR). Transfers of personal data from the EEA to us or to our Tunisian establishment therefore rely on appropriate safeguards under Article 46(2)(c) GDPR, namely the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented by a documented Transfer Impact Assessment and additional technical and organisational measures (encryption in transit and at rest, strict access control, confidentiality undertakings). A copy of these safeguards is available on request (Article 46(1) GDPR).

Any other third-country transfers (for example to our host Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) likewise rely on an adequacy decision (Article 45 GDPR), the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (Article 46 GDPR).

Website hosting, email and database services run in data centres located within the European Union. Our team additionally accesses this data from Tunisia; such access constitutes a third-country transfer and is covered by the safeguards described in section 7. EU-only processing can be agreed separately in a data processing agreement.

Data is retained only for as long as necessary for the purposes pursued or as required by statutory retention periods (in particular 6 and 10 years for tax matters). Contact enquiries that do not lead to a contract are deleted 36 months after the last interaction, unless renewed by new activity.

In accordance with Article 32 GDPR, we implement appropriate technical and organisational measures to protect your data (TLS encryption, access controls, corporate VPN, locked workstations, regular audits, ISO 27001 in progress). In the event of a notifiable breach, we will notify the competent authority and, where required, the affected individuals without undue delay (Articles 33 and 34 GDPR).

You have, at any time, the right to:

• access (Article 15 GDPR);
• rectification (Article 16 GDPR);
• erasure (“right to be forgotten”, Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• objection, in particular to direct marketing (Article 21 GDPR);
• withdraw consent at any time with effect for the future (Article 7(3) GDPR);
• issue post-mortem instructions regarding your data (Article 85 of the French Data Protection Act).

Please address your requests to hello@konzeptservices.com. We will respond within the statutory period of one month (extendable by two months under Article 12(3) GDPR). Proof of identity may be requested.

One-page summary: controller, purposes and legal bases, cookies, third-country transfers, retention, your rights and complaint bodies.

Under Article 77 GDPR you may lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement. As we are established outside the EU and have not designated a representative under Article 27 GDPR, no one-stop-shop lead authority applies. The supervisory authority competent for our seat in Tunisia is the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), 21 Rue de Turquie, 1001 Tunis, Tunisia, www.inpdp.tn.

Users in the EU may additionally contact the competent authority of their Member State, for example the competent state authority in Germany or the Commission Nationale de l’Informatique et des Libertés (CNIL) in France.

KONZEPT SERVICES SUARL may publish a list of customer references or testimonials on its website. Upon written request to hello@konzeptservices.com, we will remove the relevant publications without delay.

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

We reserve the right to update this Policy to reflect changes in the law or in our services. The current version is always available on this page.

For any data protection enquiry, please email hello@konzeptservices.com or write to: KONZEPT SERVICES SUARL, Data Protection, 15 Rue Omar Kaddeh, Immeuble Le Montplaisir, 2ème étage B25, 1073 Montplaisir, Tunis, Tunisie.

When you use our contact or registration form, we process the data you provide (name, company, email, phone, market, services, message) solely to handle and answer your enquiry. The controller is KONZEPT SERVICES SUARL.

The legal basis is your consent (Article 6(1)(a) GDPR) and, for pre-contractual requests, Article 6(1)(b) GDPR. This wording matches the consent checkbox in the form verbatim.

For accountability purposes we store, together with your enquiry, the time of consent, the consent text shown, its version, and the language and form through which consent was given.

You may withdraw your consent at any time with effect for the future by emailing hello@konzeptservices.com. Withdrawal does not affect the lawfulness of processing carried out beforehand. Enquiries that do not lead to a contract are deleted no later than 36 months after the last interaction.