Privacy policy
What we collect when you use this site, why we hold it, who else touches it, and how to make us stop.
IN EFFECT 2026-08-28
Who holds your data
Two companies run Avenor together, and they decide jointly what happens to the personal data this site collects. Under Article 26 of the GDPR that makes them joint controllers.
- Avenor France SAS, a Société par actions simplifiée (SAS) registered in France. Registered office: 9 rue Adolphe Focillon, 75014 Paris, France.
- LBMGB LLC, trading as Avenor USA, a Limited liability company formed in North Carolina, United States.
What the two companies agreed
Article 26 requires us to publish the essence of the arrangement between us. It is this. Both companies use the same enquiry, booking, and mailing records to run the business, and both decide together what those records are for. Avenor France leads on responding to you: it maintains the records, answers requests about them, and is the point of contact whether you write to Paris or New York. Avenor USA holds the same records for the US side of a launch. Neither company sells data, and neither passes it to the other for any purpose beyond the ones set out below.
You can exercise every right in this policy against either company, and you can do it by writing to one address. You are not obliged to work out which of us holds what.
Separately, when we run a US launch for a client brand, we handle that brand’s data on its instructions. There we act as a processor and the brand is the controller. This policy does not cover that work; the engagement contract does.
What we collect, and why
We collect what you type into a form. There is no profiling, no data bought from third parties, and no attempt to identify you from your reading alone.
| When | What | Why | Legal basis |
|---|---|---|---|
| You subscribe to the newsletter | Email, first name, company | To send the briefings you asked for | Consent — Art. 6(1)(a) |
| You download a gated resource | Name, email, company, which resource | To send the file, and to email you related resources | Your request for the file — Art. 6(1)(b); consent for the emails |
| You book a call | Name, job title, email, company, country, timezone, your note, any calculator figures you chose to attach | To hold the meeting and prepare for it | Steps before a contract — Art. 6(1)(b) |
| You use the contact form | Name, job title, email, company, country, your message | To answer you | Steps before a contract, and our interest in replying — Art. 6(1)(b) and (f) |
| You use a calculator | Your figures, converted to coarse bands before they are stored, plus a random per-visit identifier | To build the anonymous benchmark the tools report against | Consent — Art. 6(1)(a) |
| You read a page, with analytics on | Pages viewed, how you arrived, approximate location | To see which writing is worth continuing | Consent — Art. 6(1)(a) |
The calculators are worth a note. Your raw inputs are sent to our server, banded into wide ranges there, and only the band is written down. The number you typed is never stored.
Who else handles it
These companies process data on our instructions, under contract, and for no purpose of their own. They are not permitted to sell it.
| Company | What it does | What it sees |
|---|---|---|
| Google Ireland / Google LLC | Analytics, calendar, and the mailbox the founders reply from | Page views; booking and enquiry details |
| Klaviyo | Sends resource follow-ups | Name, email, company, which resource |
| Resend | Sends the newsletter | Email, first name |
| Supabase | Stores the banded calculator benchmark and the consent log | Bands and consent records — no name, no email |
| Vercel | Serves the site | Request logs, briefly |
| Google Cloud Run | Runs our content system, in Oregon | Enquiry and subscriber records |
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we have never done either.
Data that leaves Europe
Avenor is a transatlantic business, so data collected in Europe reaches the United States. That happens for our US company, for our content system in Oregon, and for the processors above.
Those transfers rely on the European Commission’s Standard Contractual Clauses, and, where the recipient is certified, on the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that apply to a particular transfer.
How long we keep it
- Enquiries and bookings: three years from our last exchange, which follows CNIL guidance on prospect records.
- Newsletter and resource subscribers: until you unsubscribe, then three years for the record that you did.
- Consent records: three years, as evidence that a choice was made.
- Analytics: 13 months.
- Calculator bands: kept indefinitely, because they identify nobody.
Where a record is needed for accounting or to defend a claim, we keep it for as long as the relevant limitation period runs.
Your rights
If the GDPR applies to you, you can ask us to show you what we hold, correct it, delete it, limit what we do with it, or hand it over in a portable form. You can object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time, and withdrawing it does not undo what was lawful beforehand.
Write to privacy@avenor-na.com. We answer within one month. There is no charge, and we will not ask you to explain why.
If our answer does not satisfy you, you can complain to the CNIL in France, or to the supervisory authority where you live.
If you live in the United States
Several states give you the right to know what a business has collected about you, to have it deleted, to correct it, and not to be discriminated against for asking. You have those rights here regardless of which state you live in — we saw no reason to make them depend on your address.
The right to opt out of sale or of targeted advertising has nothing to bite on, because we do neither. That is also why this site carries no “Do Not Sell My Info” link: it would advertise a control that does nothing.
Keeping it safe
The site is served over HTTPS. Credentials for the systems above are held server-side and never exposed to your browser. Access is limited to the two founders and the systems that need it. No arrangement is perfect, and we will tell you promptly if something goes wrong in a way that affects you.
Children
This site sells nothing and is written for people who run beverage companies. It is not directed at children, and we do not knowingly collect their data. Our subject matter is the non-alcoholic drinks trade, which is a business audience.
Changes
When this policy changes materially we update the date at the top and, where the change affects what you consented to, we ask again. Your earlier answer does not carry over to terms you have not seen.
Contact
Questions about any of this go to privacy@avenor-na.com, or by post to 9 rue Adolphe Focillon, 75014 Paris, France.