Deep Serena® is a registered French trademark and technology platform developed by Deep Serena, a company currently being incorporated in Orsay, France.
Last updated: October 2026 · Applicable regulation: GDPR (EU 2016/679) and French Data Protection Act
Deep Serena is currently being incorporated in Orsay, France. The definitive identity and statutory details of the Data Controller will be confirmed and updated in this section upon completion of the incorporation process.
Until that time, responsibility for the personal data processing described in this policy remains associated with the Deep Serena® project under its current pre-incorporation framework.
This website directly collects personal data through the following interaction points:
Deep Serena® does not currently deploy advertising, behavioural tracking, or analytics technologies. Technical request data may nevertheless be processed where necessary for security, abuse prevention, service operation, and infrastructure logging.
The Request a Demo endpoint includes server-side abuse controls that can derive a pseudonymous HMAC value from an upstream client IP address when suitable request headers are available. The application does not intentionally store the raw IP address in the demo request record.
Personal data submitted through the Request a Demo form is processed for the following purposes:
The legal basis for processing professional inquiries is the legitimate interest of Deep Serena® in reviewing and responding to genuine business, research, institutional, and collaboration requests (Article 6(1)(f) GDPR). Where processing is necessary to take steps at your request before entering into a contract, Article 6(1)(b) GDPR may also apply.
No automated decision-making or profiling is performed on the basis of submitted data.
Personal data submitted through this website is accessed exclusively by authorized members of the Deep Serena® team for the purposes described above.
No personal data is sold, rented, or transferred to third parties for marketing, advertising, or commercial purposes.
Data may be accessed by the hosting infrastructure provider solely for technical operational purposes and subject to appropriate data processing agreements.
Scaleway SAS provides the cloud infrastructure used for the current production service. The production Serverless Container and the production PostgreSQL database are deployed in Scaleway's Amsterdam region (nl-ams), Netherlands. Container images are stored in Scaleway Container Registry in the Paris region (fr-par), France.
These identified infrastructure locations are within the European Union. No other infrastructure provider is identified in this policy unless its active production use has been verified.
Personal data submitted through the Request a Demo form is retained only for the time necessary to process the request and for a reasonable follow-up period, taking account of the purpose of the request and any applicable legal or operational requirements.
A fixed public retention period is not stated until the current production retention mechanism and the applicable operational retention schedule have been verified.
A formal, documented retention schedule will be established upon incorporation of the legal entity and will be reflected in an updated version of this Privacy Policy.
The dedicated Privacy & Data Rights Request form collects only the request type, full name, email address, and the information the requester chooses to provide in the request details. Identity documents are not requested by default and document uploads are not supported.
Requests concerning access, rectification, erasure, restriction, or objection are processed as necessary to receive, assess, authenticate where necessary, and respond to data-protection rights requests under applicable law. General privacy questions are processed to respond to the enquiry.
Privacy requests are stored separately from commercial demo requests in the production PostgreSQL service. Their retention is determined separately according to the time necessary to handle the request, document the response where appropriate, and meet applicable legal requirements. No fixed public retention period is claimed at this stage.
The identified core production infrastructure described in this policy is located within the European Union: Paris, France (fr-par) for the Container Registry and Amsterdam, Netherlands (nl-ams) for the production application and PostgreSQL database. These locations do not, by themselves, constitute transfers to a third country outside the EEA.
No transfer outside the EEA is claimed to be absent for every possible technical or third-party service unless verified. If a future processing activity requires a transfer outside the EEA, the applicable transfer mechanism and safeguards will be documented in this policy before a public claim is made about that processing.
Deep Serena® applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration, commensurate with the sensitivity of the data processed and the current stage of the project.
Communications with this website are protected using HTTPS/TLS. The production database uses encryption at rest, and sensitive runtime configuration is maintained as protected server-side secrets in the deployed Scaleway container configuration. Access to submitted data is limited to authorized personnel and infrastructure components with an operational need to process it.
Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you may exercise the following rights where the relevant legal conditions are met:
To exercise any of the above rights, please contact us at:
You also have the right to lodge a complaint directly with the French data protection authority: CNIL — Commission Nationale de l'Informatique et des Libertés — www.cnil.fr.
This website does not currently deploy advertising, marketing, or analytics cookies. Only technologies that are strictly necessary for security and proper operation of the website may be used without optional-cookie consent where permitted by applicable law.
If optional analytics, advertising, marketing, or other non-essential technologies are introduced in the future, this policy and the applicable consent mechanism will be updated before those technologies are activated.
This Privacy Policy will be updated following the formal incorporation of Serena Technologies in France to reflect the definitive identity and statutory details of the Data Controller, confirmed retention schedules, sub-processor information, and any other relevant post-incorporation processing activities.
We encourage you to review this page periodically. The "Last updated" date at the top of this page indicates when the most recent revision was made.
When you submit the Request a Demo form on this website, Deep Serena® collects the following personal data solely to evaluate your request and, where appropriate, to contact you about a potential collaboration.