Home Legal Register

Chronological Compliance Schedule

Governance & Data Compliance Register

One ordered record of how InfraCoreSys collects, retains, audits, and erases data — followed by the four contractual policies that govern every engagement.

Last revised : 12 October 2026 · Version 4.2 · Applies to all InfraCoreSys clients and visitors

ControllerInfraCoreSys

Registered Address16 BOULEVARD GARIBALDI, 75015 PARIS, FRANCE

Data Contact[email protected]

Supervisory AuthorityCNIL (France) · GDPR 2016/679

Phase 00 · Day 0

Lawful Intake

Basis recorded at the moment data is captured.

Phase 01 · Day 1+

Encrypted Retention

Held for the fixed terms in Schedule §1 below.

Phase 02 · Quarterly

Security Audit

Access review, CVE sweep, and penetration testing.

Phase 03 · Expiry + 30d

Verified Erasure

Deletion confirmed, backups purged within 90 days.

Schedule §1 · Retention Timetable

Data Retention Schedule

Every category of personal data held by InfraCoreSys, 16 BOULEVARD GARIBALDI, 75015 PARIS, FRANCE, has a fixed expiry. Periods run from the last meaningful interaction unless a statutory term is longer.

Data Category	Purpose	Retention	Legal Basis
Kickoff brief & contact details	Answering inquiries, scoping projects	24 months	Art. 6(1)(b) / 6(1)(f)
Contracts & statements of work	Delivery, disputes, audit trail	10 years after expiry	Art. 6(1)(c) · Code de commerce L.123-22
Invoices & payment records	Tax and accounting obligations	10 years	Art. 6(1)(c) · Livre des procédures fiscales
Support tickets & email threads	Service history and continuity	36 months	Art. 6(1)(b)
Infrastructure logs & telemetry	Incident forensics, SLA reporting	12 months rolling	Art. 6(1)(f)
Security event logs	Intrusion detection & audit evidence	12 months	Art. 6(1)(f)
Cookie consent flag (`cookie_accepted`)	Remember your banner choice	Until cleared in your browser	Art. 6(1)(a)

Schedule §2 · Handling Lifecycle

Ordered Handling Lifecycle

T+0 · Collection

Briefs arrive over TLS 1.3 from the contact form or direct email to [email protected]. The lawful basis is stamped on the record at capture.
T+0 · Encryption & Segregation

Data is written to EU-hosted stores encrypted with AES-256 at rest. Client environments are segregated; production credentials never leave the vault.
Day 1–30 · Purpose-Limited Use

Access is limited to the delivery team named in your statement of work. No marketing reuse, no profiling, no sale of personal data — ever.
Quarterly · Access Review

Role assignments are re-certified each quarter; dormant accounts and stale keys are revoked within 5 business days of the review.
Expiry · Verified Deletion

When a retention term ends, records are purged within 30 days and backup copies age out within 90 days. Deletion is logged and available on request.

Schedule §3 · Client Rights

Your Rights, in Order of Exercise

Under GDPR Chapters III, any individual whose data InfraCoreSys processes may exercise the following rights free of charge.

Right of Access (Art. 15)

Receive a copy of the data we hold about you and the purposes of processing.

Rectification (Art. 16)

Correct inaccurate contact, billing, or brief details at any time.

Erasure (Art. 17)

Request deletion where no statutory retention obligation applies.

Portability (Art. 20)

Obtain your brief and correspondence in a structured, machine-readable export.

Objection & Restriction (Art. 21–18)

Object to processing based on legitimate interest, or pause processing while a dispute is reviewed.

Complaint (Art. 77)

Lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France.

How to exercise them : send a signed request to [email protected] from the address on file. We acknowledge within 48 hours and respond within 30 days, as required by GDPR Art. 12(3).

Schedule §4 · Security Audits

Security Audit Cadence

Q1–Q4 Internal configuration and access-control review of every InfraCoreSys-managed control plane.
Annual Independent third-party penetration test of client-facing surfaces; findings remediated within 14 days for critical severity.
Continuous CVE and dependency scanning across images and registries, with automatic patch PRs for critical CVEs.
Semi-annual Documented disaster-recovery failover drill covering restore points, RPO/RTO evidence, and escalation paths.
On event Post-incident review delivered within 5 business days, including timeline, root cause, and preventive actions.

Policy §5 · Effective 12 October 2026

Privacy Policy

1. Controller. InfraCoreSys, 16 BOULEVARD GARIBALDI, 75015 PARIS, FRANCE, is the data controller for personal data processed through this website and during service delivery. Contact our data desk at [email protected].

2. Data we collect. Identity and contact details you provide in a kickoff brief (name, email, phone, organization); project correspondence; billing records processed by our payment provider; and technical data such as IP address, browser type, and page events collected strictly for security and performance.

3. Purposes and legal bases. We answer inquiries and deliver contracted work on the basis of Art. 6(1)(b) GDPR; we meet tax and accounting duties under Art. 6(1)(c); we secure and improve the platform under Art. 6(1)(f) legitimate interest; and we place non-essential cookies only with your consent under Art. 6(1)(a).

4. Processors. Personal data is shared only with vetted processors: our EU-hosted infrastructure provider, our email provider, and Stripe for payment processing. Each operates under a written data-processing agreement. We do not sell, rent, or broker personal data.

5. International transfers. Primary storage remains in the European Economic Area. Where a processor operates outside the EEA, transfers rely on Standard Contractual Clauses supplemented by encryption and access controls.

6. Retention. Periods are fixed in Schedule §1. At expiry, records are erased within 30 days and backups within 90 days.

7. Your rights. Access, rectification, erasure, portability, restriction, and objection are described in Schedule §3. You may also complain to the CNIL at any time.

8. Security. TLS 1.3 in transit, AES-256 at rest, least-privilege access, and the audit cadence in Schedule §4. Report a suspected vulnerability to [email protected]; we acknowledge within 48 hours.

Policy §6 · Effective 12 October 2026

Terms of Service

1. Parties & acceptance. These terms govern every engagement between InfraCoreSys, 16 BOULEVARD GARIBALDI, 75015 PARIS, FRANCE, and the client identified in the applicable statement of work (SOW). Commencing an engagement, or paying an InfraCoreSys invoice, constitutes acceptance of these terms and the referenced policies.

2. Scope. Services are defined in the SOW: audits, Infrastructure-as-Code migrations, Kubernetes hardening, CI/CD engineering, cost optimization, observability, disaster recovery, and SRE retainers. Changes to scope, timeline, or price require a written change order signed by both parties.

3. Fees & payment. Fixed-fee work is invoiced 50% at kickoff and 50% at handover unless the SOW states otherwise; retainers are invoiced monthly in advance. Invoices are payable within 10 calendar days via our secure Stripe checkout, reachable through any Pay link on this site. Late balances accrue 1.5% interest per month or the maximum permitted by French law, whichever is lower.

4. Delivery & cooperation. Turnaround dates quoted on the services timeline start on the kickoff date and assume timely access to accounts, repositories, and decision-makers. Delays in client access extend delivery day-for-day. Acceptance occurs when the client signs the handover record or uses the deliverables in production without written objection within 10 business days.

5. Intellectual property. Upon full payment, InfraCoreSys assigns to the client all worldwide rights in client-specific deliverables — infrastructure code, pipelines, runbooks, and dashboards — excluding InfraCoreSys background tooling, frameworks, and reusable modules, which are licensed to the client perpetually and royalty-free for internal use.

6. Confidentiality. Each party protects the other's confidential information with at least the care it uses for its own, for three years after disclosure. Source credentials and production data remain the client's exclusive property.

7. Warranties & availability. Deliverables conform materially to the SOW for 30 days after handover; remedies are correction or, at our option, a proportional refund. Retainer clients receive a 99.99% monthly uptime commitment on InfraCoreSys-managed control planes, with service credits per the SLA annex.

8. Liability. InfraCoreSys is liable only for direct, foreseeable damage and its aggregate liability is capped at the fees paid by the client in the 12 months preceding the claim. We are not liable for indirect loss, lost profits, or third-party platform outages beyond our control. Nothing limits liability for fraud, willful misconduct, or personal injury.

9. Termination. Either party may terminate for material breach not cured within 15 days of written notice. Retainers may be cancelled before the next billing cycle. On termination, completed milestones remain payable and all client data is returned or erased within 30 days at the client's election.

10. Governing law. These terms are governed by French law. Disputes are first escalated to good-faith negotiation for 30 days, then submitted to the competent courts of Paris, France. Consumers retain any mandatory protections of their home jurisdiction.

Policy §7 · Effective 12 October 2026

Cookie Policy

1. What we store. This site uses a minimal footprint. No advertising cookies, no cross-site tracking pixels, and no third-party behavioral profiling are deployed by InfraCoreSys.

Name	Type	Duration	Purpose
cookie_accepted	localStorage	Until cleared	Remembers that you acknowledged the consent banner
session (HTTP)	Essential cookie	Session	Maintains a secure, load-balanced connection
stripe_session	Essential (Stripe)	Up to 24 hours	Secures checkout when you use a Pay link

2. Consent & withdrawal. The consent flag is written only after you press Acknowledge on the banner. You may withdraw at any time by clearing site data for infracoresys.com in your browser settings; the banner will reappear on your next visit.

3. Browser controls. All major browsers let you block or delete cookies under Settings → Privacy. Blocking essential cookies may prevent secure checkout and form delivery from working correctly.

4. Questions. Contact [email protected] for a current cookie inventory, or see the Privacy Policy for the wider processing picture.

Policy §8 · Effective 12 October 2026

Refund & Reimbursement Policy

1. Cooling-off window. For fixed-scope engagements paid in advance, you may cancel for a full refund within 14 calendar days of payment, provided no engineering work has begun. To request it, write to [email protected] with your payment reference.

2. Pre-work cancellation. If you cancel after payment but before the kickoff call, we refund the advance in full minus any third-party charges already incurred (for example domain registrations or cloud credits purchased on your behalf).

3. Mid-project cancellation. Once work has started, refunds are calculated pro-rata against completed milestones in the statement of work. Work delivered and accepted — including audit reports and completed pipeline stages — is invoiced at its SOW value; the unused balance is returned.

4. Retainers. SRE retainers renew monthly and may be cancelled any time before the next billing date. The current month is non-refundable once pager coverage has commenced; no partial-month credit applies.

5. SLA credits. If InfraCoreSys-managed control planes fall below the 99.99% monthly commitment, service credits of 10% of the monthly fee per full 30 minutes of unavailability are applied to the next invoice, capped at 100% of that month's fee. Credits are the exclusive remedy for availability failures.

6. Non-refundable items. Completed audits, third-party licenses, cloud consumption, and bank or payment-processor fees are non-refundable once incurred, except where required by French consumer law.

7. Method & timing. Approved refunds are issued to the original payment method through Stripe within 10 business days of approval. You will receive a confirmation email from [email protected] with the settlement reference.

← Return to the Roadmap Open the Kickoff Brief →