Comment Privacy Notice
How Cert-IX processes the personal data you provide when you comment on this blog
Last updated: 10 July 2026
This notice explains, under Article 13 of the GDPR, how Cert-IX processes personal data when you submit a comment on the Cert-IX blog. Submitting a comment is never conditional on your consent to this processing.
1. Data controller
The data controller is Cert-IX SAS, 54 Avenue de la Motte-Picquet, 75015 Paris, France. For any question about this notice or your personal data, contact our Data Protection Officer (DPO) at [email protected].
2. What we collect
When you submit a comment we process the comment text and display name you provide, your email address, your IP address and your browser user-agent string.
3. Purposes
- →Publishing the comment you asked us to publish, in the language you selected.
- →Moderating comments — including automated review — to keep the discussion lawful and on-topic.
- →Preventing spam, abuse and security incidents.
4. Legal basis
Publishing the comment you submitted relies on the performance of the service you requested (GDPR Art. 6(1)(b)) together with our legitimate interest (Art. 6(1)(f)). Storing your email address, IP address and user-agent for moderation and anti-spam relies on our legitimate interest in operating a safe and lawful comment section (Art. 6(1)(f)). We do not ask for your consent to submit a comment, and you are never required to consent in order to obtain the service.
5. Who receives the data
Comments are reviewed by Cert-IX's internal moderation team and by an automated moderation pipeline: an n8n workflow streams comments over our Kafka message bus to a large-language-model (LLM) provider that classifies them. Where that LLM provider is hosted outside the European Economic Area (for example, in the United States), the transfer is governed by appropriate safeguards such as the European Commission's Standard Contractual Clauses. We do not sell your data or use it for advertising.
6. How long we keep it
- →Rejected or spam comments and their associated personal data (email, IP address, user-agent) are deleted within 30 days of moderation.
- →For approved comments, your email address is retained for up to 12 months.
- →Your IP address and user-agent are retained for up to 90 days, after which only your display name remains attached to the published comment.
7. Your rights
You have the right to access, rectify, erase and restrict the processing of your personal data, to data portability, and to object at any time to processing based on our legitimate interest. To exercise these rights, contact [email protected].
You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).