Privacy policy

Last updated: 19 October 2026

1. Data Controller

The data controller responsible for the processing of personal data on this website is:

Call Track Co.
15 Rue de la Paix, 75002 Paris, France
Email: contact@calirail.xyz · Telephone: +33 6 74 67 78 98

2. Information we collect

We process personal data only when strictly necessary to provide our digital marketing services, operate a secure website, and respond to commercial inquiries:

• Inquiry and audit form data: Full name, business email address, company name, telephone number, website URL, monthly marketing budget, and message details submitted voluntarily through our contact forms.
• Technical browsing data: IP address (anonymized prior to storage where analytics consent is not granted), browser type, operating system, referrer URL, pages visited, and timestamp of access.
• Consent records: Cryptographic timestamps and category selections stored locally in your browser (calltrack_consent_v1) to prove compliance with Art. 7 GDPR.

3. Call tracking & telephony data handling

As part of our call tracking and marketing attribution services, we may assign dynamic trackable telephone numbers to measure advertising effectiveness:

• Caller Identification: When you call a trackable phone number on our website, telephony metadata (caller number, call time, duration, and call status) is logged to attribute the call to the marketing source.
• Call Recording & Consent: If call recording is enabled for quality or training purposes, callers are notified via an automated pre-call whisper or voice announcement prior to the call connecting, ensuring compliance with Art. 6(1)(a) and French / EU telecommunications privacy laws. Callers may decline recording by requesting an alternative channel.
• Data Minimization: Call logs are retained only as long as necessary to complete commercial attribution and are anonymized or deleted upon request.

4. Purposes and legal bases for processing

Processing purpose	Personal data	Legal basis (GDPR Art. 6)
Responding to contact and audit inquiries	Name, email, phone, company, message	Art. 6(1)(b) — steps prior to entering into a contract
Website security and server integrity	IP address, server logs, user-agent	Art. 6(1)(f) — legitimate interest in site security
Attribution and marketing analytics	Anonymous click identifiers, aggregated traffic	Art. 6(1)(a) — explicit consent via cookie banner
Google Ads conversion tracking	Hashed conversion events, consent signals	Art. 6(1)(a) — explicit consent (Consent Mode v2)

5. Cookies & Google Consent Mode v2

We operate an opt-in model compliant with the ePrivacy Directive and Google EU user consent policy. Strictly necessary technical cookies load automatically. Analytics and advertising technologies (including Google Analytics 4 and Google Ads conversion tracking) load only after you grant explicit consent.

We implement Google Consent Mode v2, transmitting standardized consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) to Google. Review our full Cookie policy to inspect individual cookies and modify preferences at any time.

6. Third-party recipients & international transfers

We do not sell, rent, or trade your personal data. We disclose information only to vetted service providers operating under Data Processing Agreements consistent with Art. 28 GDPR:

• Hosting & Infrastructure: Cloudflare / Netlify / Vercel (content delivery, DNS, security).
• Analytics & Tag Management: Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). Standard Contractual Clauses (SCCs) apply for any transfers outside the EEA.
• Telephony Carriers: Licensed telecom providers for virtual number routing and dynamic call attribution.

7. Retention periods

• Inquiry data: Stored for up to 3 years from the date of last active communication.
• Call tracking metadata: Retained for 12 months for seasonal attribution analysis, then purged or anonymized.
• Cookie consent records: Maintained in local storage for 180 days before re-prompting.
• Server access logs: Deleted automatically after 30 days.

8. Your rights under GDPR

Under Chapter III of the GDPR, you have the following enforceable rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time without affecting prior lawful processing.

9. Contact & supervisory authority

To exercise any data protection rights, email our privacy team at contact@calirail.xyz. We respond to all requests within 30 days as mandated by the GDPR.

If you believe our processing violates data protection law, you have the right to lodge a formal complaint with your competent supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.