Privacy policy

Data controller

Oppenheimer Lab, established in Ben Arous, Tunisia. Contact: hello@oppenheimerlab.com.

Data collected

We only collect the data you voluntarily send us through our forms:

• Quote request and contact: name, company, email, phone, country, project type, product categories, intended quantities and message.
• Supplier application: company, email, raw material category and message.

With each quote request or supplier application, we also record the language of the page from which you sent it (French or English), so that we can reply to you in that language.

We also record the source of your first visit: the campaign you came from (utm_source, utm_medium and utm_campaign parameters of a link), the name of the site that referred you to us (for example linkedin.com) and the first page you viewed. This tells us how you found us; it is kept with your request.

No sensitive data is requested. During each visit, our host also records technical connection data (IP address, browser, page requested, date and time) needed for the security and proper functioning of the site.

Purposes and legal basis

This data is used exclusively to respond to your request, draw up a quote, send you the commercial information you asked for or review your application. The processing is based on your consent, given through the checkbox of each form, and on the pre-contractual measures taken at your request. Your data is never sold or transferred for commercial purposes.

Service providers and third-party services

We use the following technical service providers, which process data on our behalf and only for the needs of the service:

• Vercel Inc. — website hosting and server execution. Location: European Union (server execution: Dublin, Ireland, region dub1); pages and static files delivered by Vercel’s global network. Technical connection data and forms pass through its servers.
• Supabase, Inc. — database where your requests are stored, back-office authentication and image storage. Location: European Union (Ireland, region eu-west-1).
• Google (Google Maps) — map on the Contact page. It is only loaded if you click “Show the map” or accept external content. Google then receives your IP address and may set its own cookies, in accordance with its own privacy policy.
• Google (Google Analytics) — audience measurement, only if you accept the “Audience measurement” category. Google receives the pages viewed, where the visit came from, technical information about your device and browser, and the actions measured (quote request or application sent, click on an email or phone link, language change). It never receives your name, email, phone number or the content of your messages.
• Cloudflare (Turnstile) — anti-spam protection for the quote, contact and supplier application forms. It is only loaded when you start filling in a form: Cloudflare then receives your IP address and technical information about your browser, in order to distinguish a human visitor from a bot. It is used neither for advertising nor for tracking browsing.
• Resend — sending our team an alert email containing the content of your request, as soon as it is recorded.

The site’s fonts and images are hosted on our own servers: no data is sent to Google Fonts or to an image bank. No advertising tool is used.

Transfers outside Tunisia

Your requests are stored in the European Union, in Ireland (Supabase). The site runs in the European Union, in Dublin (Ireland): this is where pages are generated and forms are processed. Pages and files already generated are delivered by Vercel’s global network from the point of presence closest to the visitor. As Vercel Inc. and Supabase, Inc. are companies established outside the European Union, access to some data from their country of establishment remains possible, for example for technical support; it is governed by their contractual safeguards (data processing agreements).

With your consent, audience measurement data is sent to Google, including in the United States (Google LLC); this transfer is governed by the EU–US Data Privacy Framework, to which Google adheres, and by standard contractual clauses.

Retention period

Your data is kept for a maximum of 3 years from the last contact, in accordance with Tunisian Organic Law No. 2004-63 on the protection of personal data.

Google Analytics statistics are kept for 14 months, then deleted automatically. The source of your visit is kept with your request, for as long as the request itself.

To limit abusive submissions (5 submissions per hour at most), we keep an encrypted fingerprint of your IP address for 24 hours, which does not allow it to be retrieved directly.

Your rights

You have the right to access, rectify, object to and delete your data, as well as the right to withdraw your consent at any time. To exercise these rights, write to us at hello@oppenheimerlab.com. You may also refer the matter to the Instance Nationale de Protection des Données Personnelles (INPDP).

You can withdraw your consent to audience measurement at any time with the “Manage cookies” link: measurement stops immediately and the Google Analytics cookies are deleted from your browser.

Cookies and local storage

The site sets no advertising cookies. It uses:

• your browser’s local storage (“ol-consent”) to remember your consent choices for 180 days;
• with your consent to audience measurement: the Google Analytics cookies (_ga and _ga_D6PM60KNYQ), which tell visitors apart pseudonymously, for 13 months at most, and local storage (“ol-lead-source”) to remember the source of your first visit for 90 days; without your consent, this source is only kept for the duration of the visit, with nothing saved on your device;
• the back-office login session, reserved for our team;
• Google cookies, only if you display the Google Maps map or accept external content.

You can change your choice at any time: manage my cookie preferences.

Security

Exchanges with the site are encrypted (HTTPS). Access to the stored requests is limited to our authenticated team and protected by access rules at database level.