Data Protection Policy

Last updated: September 14, 2026

At Stroople, we recognize the importance of protecting your personal data and are committed to respecting your privacy.

This privacy policy describes the types of data we collect, how it is processed, your rights as a user, and the measures implemented to ensure its protection, in accordance with the General Data Protection Regulation (GDPR) and applicable French law.

Purposes of Processing

We process personal data on this site to:

• Secure the site and prevent abuse (e.g., bot and fraud prevention);
• Measure audience and usage to improve the site;
• Respond to your requests submitted via contact or appointment forms;
• Manage newsletter subscriptions and send informational emails (double opt-in);
• Provide gated content downloads (e.g., white papers) and manage related follow-ups (with your consent where required);
• Manage recruitment (evaluate applications and communicate with candidates);
• Operate Stroople Signal, our free threat intelligence tools, including the My Alerts notification service.

Recruitment

As part of its recruitment process, Stroople collects and processes personal data of applicants, including résumés, cover letters, and professional information. This data is used to evaluate applications, communicate with candidates, and facilitate the recruitment process.

Candidates’ personal data is retained for a maximum period of two years following the end of the recruitment process, unless the candidate has provided consent for a longer retention period. After this period, the data is securely deleted in accordance with applicable regulations.

Job applications via our ATS

Our Careers page embeds a widget provided by an external applicant tracking system (ATS) so that visitors can browse and apply to open positions directly. This widget uses functional cookies needed to operate its own application form; these are strictly necessary for the service you request when you choose to apply online and are therefore not subject to consent, though they are listed under Cookies below for transparency. If you prefer not to apply online, you can send your application directly to [email protected].

Information you submit through this widget (résumé, cover letter, application answers) is processed by our ATS provider on our behalf, under a data processing agreement. Its privacy and cookie policy describes any additional processing it carries out.

Cookies

Stroople uses cookies and similar technologies to improve user experience, analyze website traffic, and ensure the proper functioning and security of the website.

Consent management. Cookies that require consent are managed via our cookie banner and preferences panel. Consent records are retained for 6 months. You can modify or withdraw your consent at any time via the cookie manager available on our site (“Cookie settings” link in the footer).

Categories used on this site:

• Security/CDN. Cookies that are essential to protect the site (e.g., bot mitigation, web application firewall challenges) and forms (e.g., our Cloudflare Turnstile anti-bot check), balance traffic, and serve cached content, all provided through Cloudflare. These are strictly necessary for the service and therefore not subject to consent. They are listed here for transparency.
• Google Analytics 4 (statistics). Helps us understand how visitors use the site so we can improve content and usability. IP addresses are anonymized (truncated). Data collected: pages visited, time on page, interactions, device/browser type, general location, etc. Retention: user-/event-level data in GA4 is configured to 14 months (server-side setting). Typical first-party cookies include _ga (2 years), _ga_<container-id> (2 years), and _gid (24 hours). This data is used solely for internal statistical analysis and is not combined with other sources of personal data.
• Preferences — language setting. A first-party cookie that stores your language preference so the site opens in the same language on future visits.
• Email delivery for security alerts (Brevo). Our Stroople Signal “My Alerts” tool lets you create anonymous, cookie-free alert rules identified only by a random token stored in your browser, and optionally choose to receive matching results by email. If you choose the email channel, your address is used solely to deliver the alerts you configured, is not combined with any other Stroople data source, and is sent through our provider Brevo, an EU-based email service. See “Stroople Signal — My Alerts” below for details.
• Google Maps. We embed a Google Maps widget solely to help visitors locate our offices. Loading it connects your browser to Google, which may set cookies; the map is disabled by default and loads only after you accept this category.

Your browser settings. You can also manage and delete cookies through your browser. Deleting or blocking some cookies may affect your browsing experience and certain features of our site (e.g., form protection, language preference) may not function properly.

Tracking pixels in our emails

As part of sending our newsletter (CyberSec Insights), we use tracking pixels through our email service provider, MailPoet, to determine whether you open our emails and which links you click. This information allows us to measure the effectiveness of our campaigns and tailor the content and frequency of our communications based on your level of engagement. This tracking is subject to your consent, collected when you subscribe to the newsletter, and you may withdraw it at any time using the unsubscribe link included in every email.

Our Stroople Signal alert emails, sent through Brevo, include tracking that indicates whether a link in the email was clicked. We use this information to improve the experience of our subscribers, for example by understanding which alerts are useful, and to detect inactive addresses so that we can automatically pause notifications after a period of inactivity, with a prior warning. This processing is covered by the consent you give on the My Alerts page when you choose to receive alerts by email, and you can withdraw it at any time by deleting your alert rule or unsubscribing from the My Alerts page.

Per-campaign newsletter tracking data is retained for 6 months. If you do not open any of our newsletter emails for 18 consecutive months, your newsletter subscription will be automatically suspended.

Social networks

When you click outbound links to social media platforms, those platforms may collect cookies or other identifiers to track your browsing and personalize your experience on their services, in accordance with their own privacy policies.

Forms and Appointments

Stroople provides contact forms and an appointment scheduling system to facilitate interactions with clients and prospects. When you use these forms or request an appointment, we collect information such as your first name, last name, email address, and any details you choose to provide.

For security and deliverability, forms use Cloudflare Turnstile, a privacy-preserving anti-bot check that runs as part of the Cloudflare security stack described above, and emails may be routed via a secure email provider (SMTP). This data is collected to process your request, schedule and organize appointments, and contact you regarding your inquiry or appointment. The information is not shared with third parties unless necessary to provide the requested service or as required by law.

Stroople Signal — My Alerts

Stroople Signal is a set of free, account-free cybersecurity monitoring tools available on this site, including My Alerts, which lets you save watch rules (for example, a vendor name, a sector, or a CVE) and receive a notification whenever matching threat intelligence appears in our sources.

My Alerts does not require an account and does not ask for your name. Each rule is identified only by a random token stored in your browser. If you choose email as your notification channel, your email address is collected solely to send you the alerts you configured, and this processing is based on your consent (Article 6.1.a GDPR), collected via the checkbox on the My Alerts page and re-confirmed each time you create or edit a rule. Alert emails are sent through Brevo, acting as our sub-processor. If you choose the webhook channel instead, no email address is collected, and the destination URL you provide is stored encrypted.

You may withdraw your consent, change your notification channel, or delete a rule at any time from the My Alerts page or via the unsubscribe link included in each alert email, without affecting the lawfulness of processing carried out before withdrawal. If no activity occurs on an alert rule for 12 months, its email notifications are automatically paused, with a warning sent 30 days beforehand. Records of your consent are kept for as long as the rule exists, then for a further 3 years, separately from any other Stroople data.

Data Security and Protection

We implement appropriate technical and organizational measures to ensure the security of your personal data, including TLS encryption, least-privilege access, multi-factor authentication on administrator accounts, and logging/monitoring. Access to personal data is restricted to authorized personnel and to service providers under contract.

Some service providers (for example, analytics or security providers) may process data outside the European Union. Where this occurs, international transfers rely on appropriate safeguards (such as Standard Contractual Clauses and/or recognized frameworks), together with technical and organizational measures.

Rights of Data Subjects

In accordance with the GDPR, you have the right to access, rectify, erase, or restrict the processing of your personal data, as well as the right to data portability and the right to object. To exercise these rights, contact our DPO at [email protected]. You may also lodge a complaint with the CNIL (France).

Privacy Policy Updates

We may change this policy at any time. The amended version will take effect upon publication. Please check this policy regularly to stay informed about any changes.

Non-disclosure of Data

Stroople is committed to respecting the confidentiality of your personal data and not selling, renting, sharing, or disclosing this information to third parties, except when necessary for the provision of requested services or if required by law. We take all necessary steps to ensure that the personal data we hold is accessible only for legitimate purposes and in compliance with current regulations.

Data Retention

Stroople ensures that your personal data is retained only for as long as necessary to achieve the purposes for which it was collected, unless the law requires longer retention. We regularly assess the data we hold and delete any that are no longer necessary.

Indicative retention periods:

• Consent records (cookie preferences): 6 months.
• Analytics (Google Analytics 4): unaggregated user-/event-level data retained 14 months within GA4; cookie lifetimes as listed above.
• Newsletter contacts: up to 3 years from the last contact or our last marketing communication; proofs of consent/opt-out may be retained for the statutory limitation period.
• Forms and appointments: for the time needed to process your request, then archived per applicable legal retention periods.
• Recruitment: up to 2 years after the end of the process (unless you consent to a longer period).
• Job applications submitted via our ATS: governed by our ATS provider while stored on its platform; see the Recruitment section above.
• Email delivery logs: message metadata retained only for diagnostics and for a limited period (e.g., 90 days), then purged.
• Stroople Signal alert rules and delivery logs (My Alerts): email notifications are automatically paused after 12 months of inactivity, with a 30-day prior warning; consent audit records are kept for the life of the rule plus 3 years.

Contact

If you have any questions or concerns regarding this policy, please contact our DPO at [email protected]