Legal Transparency Layer

Controller. GridVisionForge, 92600, 45 quai du Docteur Dervaux, Asnières-sur-Seine, France, is the data controller for personal data processed through this website and our security engagements. You can reach our privacy desk at [email protected].

Data we collect. We process identification and professional contact details you transmit through the contact console (name, work email, company, phone), the content of your project brief, billing data required to issue invoices, and limited technical logs (IP address, user agent, referring page) generated when you browse this site.

Purposes and legal bases. Contact data and briefs are processed to answer your request and prepare a scoped proposal (pre-contractual measures, Article 6(1)(b) GDPR). Invoicing and payment records are kept to comply with French tax and accounting obligations (legal obligation, Article 6(1)(c)). Technical logs are processed to secure the platform and prevent abuse (legitimate interest, Article 6(1)(f)). Newsletter or advisory updates are sent only with your explicit consent (Article 6(1)(a)), withdrawable at any time.

Retention. Prospective client briefs are retained for 24 months from the last meaningful contact. Client contract records and invoices are retained for the statutory 10-year accounting period. Security logs are purged after 12 months.

Recipients and transfers. Data is accessible only to GridVisionForge engineers under professional secrecy obligations and to our hosting, payment, and email providers acting as processors under Article 28 agreements. Our infrastructure is hosted within the European Economic Area. We do not sell, rent, or broker personal data.

Your rights. You may request access, rectification, erasure, restriction, portability, or object to processing, and you may withdraw consent at any time. Write to [email protected]; we answer within one month. You may also lodge a complaint with the CNIL (commission-nationale-informatique-et-libertes.fr).

Scope. These terms govern every service published on this site — perimeter defense architecture, automated penetration testing routines, incident response pipelines, red team simulations, cloud posture hardening, compliance readiness audits, credential monitoring, phishing simulations, and zero-trust reviews — delivered by GridVisionForge, 92600, 45 quai du Docteur Dervaux, Asnières-sur-Seine, France.

Proposals and acceptance. Each engagement starts with a written proposal stating scope, deliverables, timeline, and price. Work begins once you approve the proposal and, where applicable, the engagement deposit is settled through our payment rail. Prices are quoted in euros or US dollars excluding VAT unless expressly stated otherwise.

Client obligations. You warrant that you are authorized to grant testing access to the systems in scope, that you will provide credentials and network reachability on the agreed dates, and that you will notify us of any change that could invalidate the test plan. Testing performed outside the agreed window, or against systems not listed in the scope, is not covered by these terms.

Delivery and acceptance. Deliverables (architecture blueprints, findings reports, remediation playbooks, compliance evidence packs) are issued at the end of the stated turnaround. You have 10 calendar days to report material discrepancies against the agreed scope; after that, the deliverable is deemed accepted.

Intellectual property. On full payment, all worldwide rights in client-specific deliverables transfer to you. GridVisionForge retains ownership of its pre-existing tooling, scan signatures, methodologies, and templates, granting you a perpetual, non-exclusive licence to use them inside your own organization.

Confidentiality. Both parties keep project materials, vulnerabilities, and business information confidential for five years after engagement close, except where disclosure is required by law.

Liability. GridVisionForge performs services with reasonable skill and care. To the extent permitted by French law, our aggregate liability per engagement is limited to the amount you paid for that engagement. We are not liable for indirect loss, lost profits, or loss of data arising from systems outside the agreed scope, nor for outcomes caused by client-side changes made against our written advice.

Governing law. These terms are governed by French law. Parties will first attempt good-faith resolution by email; failing that, disputes fall to the competent courts of Paris, without prejudice to mandatory consumer protections.

Cookies are small text files placed on your device when you visit gridvisionforge.com. GridVisionForge uses a minimal set of them, and strictly necessary cookies are deployed only to keep the site functional and secure.

Essential cookies. gvf_cookie_consent stores your cookie decision locally for up to 12 months so the consent banner does not reappear on every visit. Session-keeping and load-balancing cookies may be set by our host to deliver pages securely over TLS; they carry no profiling data.

Analytics. Where enabled, analytics cookies measure aggregated page performance (page views, load timing, referrer) to help us harden delivery. They are activated only after consent and are never used to build advertising profiles.

Third-party media. Embedded maps are served by Google Maps. Loading such embeds may cause Google to set its own cookies under its respective privacy policy. You can avoid this by contacting us directly for directions instead.

Managing cookies. You can delete stored cookies and block future ones at any time through your browser settings (Chrome, Firefox, Safari, Edge). Blocking essential cookies may degrade site functionality, such as remembering your consent choice.

Questions about this policy go to [email protected], GridVisionForge, 92600, 45 quai du Docteur Dervaux, Asnières-sur-Seine, France.

We would rather fix a scope mismatch than hold your funds hostage. Refund requests are handled by GridVisionForge at [email protected] and answered within 5 business days.

Engagement deposits. A deposit secures your slot in the delivery schedule. If you cancel before work starts, the deposit is refunded in full, less any payment-processing fees already incurred. Once the reconnaissance or build phase has begun, the deposit is non-refundable because engineering hours have already been committed.

Fixed-scope modules. If we fail to deliver the deliverables listed in an approved proposal, you may either request a corrected delivery within a reasonable period at no extra cost or terminate the engagement and receive a pro-rata refund for work not performed.

Retainers and subscriptions. Monthly retainers (incident response pipeline, credential monitoring) can be cancelled at any time before the next billing cycle; the current cycle remains billable and is not pro-rated. Annual pre-payments are refundable on a pro-rata basis for the unused full months.

Consumer cooling-off. Where you act as a consumer and the service has not yet begun, you benefit from the 14-day right of withdrawal under French consumer law. By requesting an immediate start within that period, you expressly agree that performance begins at once and acknowledge that you owe a proportionate amount for services already rendered.

How refunds are paid. Approved refunds are issued to the original payment method through our Stripe rail within 10 business days of approval. Card and bank fees charged by the processor cannot be returned to us and may therefore be deducted where stated by law.

Chargebacks. Please contact us before initiating a chargeback — most disputes are resolved within one reply. Unwarranted chargebacks may result in suspension of active support while the payment provider investigates.