Privacy Policy

How SPORA handles your data on this website

This document explains what personal data is collected when you visit sporanetwork.ai, why, on what legal basis, who it is shared with, how long it is kept, and how you stay in control of it.

01Who is responsible for your data

The controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the "GDPR") is:

THINKZ IOT FRANCE is established in the European Union, so no Article 27 representative is required. Appointing a Data Protection Officer is not mandatory under Article 37 GDPR given the nature of this website's activity; every request concerning your data is handled at the address above.

02What data we collect

2.1 — Browsing data (collected automatically)

Each time a page is served, our hosting provider technically records: IP address, date and time of the request, page requested, response code, volume transferred, referring page, browser type and operating system. These logs are necessary to run and secure the site.

2.2 — Audience measurement

A first-party session identifier (the spora_vid cookie, scoped to .sporanetwork.ai) counts visits and page views and follows the path between sections of the site. That identifier is a random number: it contains neither your name nor your email address.

2.3 — Campaign parameters in the URL

When you arrive from an advert, a newsletter, a creator link, a QR code or an NFC card, the URL may carry tracking parameters: utm_source, utm_medium, utm_campaign, utm_content, src, c and lang. They tell us which channel you came through — never who you are.

2.4 — Data you give us yourself

• Contact — when you write to info@thinkz.ai or to a named @sporanetwork.ai address: your email address, the content of your message and any attachments.
• White paper and downloadable content — email address, and where applicable first name, last name, company and job title.
• Signing up for SPORA communications — email address, language, country, and the record of your consent (date, time, source form, wording of the box you ticked).
• Events and trade shows (e.g. IFA Berlin, the sporanetwork.ai/ifa pages) — email address, company, context of the meeting and a dated consent box, whether collected online or on a paper card later keyed into our system.
• Surveys and research — questionnaire answers, country, housing type, connected devices you report; your email address is requested only if you want to receive the results.
• Manufacturer and partner enquiries — business contact details shared in the course of an OEM discussion.

2.5 — What this website does not collect

The marketing site collects no data from your connected devices, no energy meter data, and no content from conversations with the SPORA assistant. Those processing operations belong exclusively to the application and its own privacy policy. We also collect no special categories of data within the meaning of Article 9 GDPR.

03Purposes and legal bases

Where processing rests on your consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out beforehand. Where it rests on our legitimate interests, you have a right to object (§9).

04Cookies and trackers

In accordance with Article 5(3) of Directive 2002/58/EC and Article 82 of French Act no. 78-17 of 6 January 1978, no tracker that is not strictly necessary is placed on your device before you consent. The consent banner lets you accept or refuse in one click and with equal ease, and choose purpose by purpose. Your choice is stored for 6 months; after that you are asked again. A refusal is honoured exactly as an acceptance is: no part of the site is withheld if you decline.

Advertising trackers are placed — and the corresponding events sent through server-side conversion APIs — only if you have consented. Data derived from these trackers is kept for a maximum of 25 months, then deleted or anonymised.

You can change or withdraw your choice at any time through the "Cookies" link in the footer, or through your browser settings. A browser-level refusal may affect how some pages display.

05Who has access to your data

Your data is accessible to authorised members of the SPORA team (marketing, engineering, management) and to the providers listed below, who act as processors within the meaning of Article 28 GDPR, on documented instructions and under contract.

Your data may also be disclosed to our professional advisers (lawyers, accountants), to a judicial officer, or to an administrative or judicial authority where the law requires it.

We do not sell your personal data and we do not rent it to any third party for their own marketing.

06Transfers outside the European Union

Some of the providers listed in §5 are established in the United States or transfer data there. Those transfers are governed either by the adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) where the provider is certified under it, or by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented where necessary by additional technical and organisational measures following a transfer impact assessment.

You can obtain a copy of the safeguards in place by writing to info@thinkz.ai.

07How long we keep your data

Once these periods expire, data is deleted or irreversibly anonymised. Anonymised data is no longer personal data and falls outside the scope of this policy.

08Security

We implement the appropriate technical and organisational measures required by Article 32 GDPR: HTTPS/TLS encryption across the whole site, environment segregation, least-privilege access management, strong authentication on administration tools, documented API key rotation, access logging, and training for authorised personnel.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours in accordance with Article 33 GDPR and inform you under the conditions of Article 34.

09Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

• Access (Art. 15) — confirm whether your data is processed and obtain a copy of it.
• Rectification (Art. 16) — have inaccurate or incomplete data corrected.
• Erasure (Art. 17) — have your data deleted, subject to any legal retention obligation.
• Restriction (Art. 18) — have a contested processing operation temporarily frozen.
• Portability (Art. 20) — receive the data you provided in a structured, commonly used, machine-readable format.
• Objection (Art. 21) — object at any time to processing based on our legitimate interests, and without giving reasons to direct marketing.
• Withdrawal of consent (Art. 7(3)) — at any time, in particular through the unsubscribe link in every email we send or through the cookie manager.
• Post-mortem instructions (Art. 85 of the French Data Protection Act) — set out what should happen to your data after your death.

To exercise these rights, write to info@thinkz.ai or to THINKZ IOT FRANCE, 40 rue du Japon, 31400 Toulouse, France. We respond within one month of receipt, extendable by two months for complex requests — in which case we tell you. We will ask for proof of identity only where there is reasonable doubt about who you are, and will destroy it once verified.

If you believe the processing does not comply with the law, you may lodge a complaint with the French data protection authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr — or with the supervisory authority of the country where you live, and you may also seek a judicial remedy.

10Children

This website is intended for an adult audience. We do not knowingly collect data about anyone under 15, the age set by Article 45 of the French Data Protection Act under Article 8 GDPR. Access to the alpha programme is limited to adults on the terms set out in the application's own terms of use. If you hold parental responsibility and find that a child has given us data, write to us and it will be deleted without delay.

11External links and social media

The site links out to third-party services — notably our LinkedIn page, a WhatsApp community and the SPORA application. These are plain hyperlinks: no third-party content loads inside our pages unless you click. Once you are on those services, their own providers' privacy policies apply, over which we have no control.

12Automated decisions and artificial intelligence

This marketing website carries out no automated individual decision-making producing legal effects or similarly significantly affecting you within the meaning of Article 22 GDPR, and operates no AI system that interacts with you within the meaning of Article 50 of Regulation (EU) 2024/1689 (the "AI Act"), applicable since 2 August 2026. The eligibility check and the SPORA conversational assistant are features of the application and are described in its own documentation. We do not use data collected on this website to train artificial-intelligence models.

13Changes to this policy

This policy will change as the site, our tools and the regulatory framework change. The version in force is the one published on this page, identified by its version number and date. Any material change — a new purpose, a new recipient, a new legal basis — will be flagged in a visible notice on the site and, if you subscribe to our communications, by email. Previous versions are archived and available on request.