Privacy notice
Last updated: 2 October 2026This notice explains how ORAILIX processes personal data when you visit orailix.com. It applies to every page served from this domain. ORAILIX is a research group at the Computer Science Laboratory of École Polytechnique (LIX), part of the Institut Polytechnique de Paris.
In short. We run self-hosted audience measurement (Matomo) with cookies disabled, IPs anonymised, Do-Not-Track honoured, and a 13-month retention cap. Under French CNIL rules this configuration is exempt from the consent-banner requirement. We never share your data with third parties.
1. Who is the data controller
The controller for personal data processed on this website is:
- ORAILIX, c/o Laboratoire d'Informatique de l'École Polytechnique (LIX)
- 1 rue Honoré d'Estienne d'Orves, Bâtiment Alan Turing
- 91120 Palaiseau, France
- Scientific lead: Prof. Sonia Vanier
ORAILIX is embedded within École Polytechnique and inherits its institutional data-protection framework.
2. How to reach the Data Protection Officer
École Polytechnique's Data Protection Officer (DPO) handles data-protection enquiries for the lab:
- Email: dpo@polytechnique.edu
- Postal: DPO, École Polytechnique, Route de Saclay, 91128 Palaiseau Cedex, France
3. What we process, why, and how long we keep it
| Processing | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Audience measurement | Anonymised IP (last 2 bytes truncated), browser type, OS, screen size, requested URLs, referrer, pseudonymous visit identifier (not a cookie) | Measure which pages are read and how visitors arrive, to improve the site | Article 6(1)(f), legitimate interest. CNIL exemption for audience measurement | 13 months maximum (CNIL ceiling) |
| Web server logs | Client IP, timestamp, HTTP method, URL, status code, user-agent | Security, debugging, abuse protection | Article 6(1)(f), legitimate interest | Up to 12 months |
| Admin interface | Login name, password hash, session token | Operate the editorial back-office (restricted to the ORAILIX team) | Article 6(1)(f) and Article 6(1)(b) for ORAILIX members | For as long as the account is active |
4. Cookies
This site does not set any analytics cookie. The Matomo tracker runs in cookie-less mode (disableCookies), and the only cookies that may appear are strictly technical (admin session, if you log into the back-office).
5. Who sees your data
- The ORAILIX technical team, inside École Polytechnique's infrastructure.
- The Matomo instance is self-hosted on a server in Germany (Hetzner, Nuremberg); no analytics data is shared with any third-party processor.
- We do not sell, rent, or exchange personal data.
- We do not use advertising, retargeting, or cross-site tracking.
Pages that embed third-party content (for example, the Nexus meeting modal uses an iframe to rendez-vous.renater.fr; some news articles embed LinkedIn posts) only load that third-party resource when you click. Those third parties then process your data under their own privacy policies.
6. Transfers outside the EU
None by design. Our infrastructure sits inside the EU (France for orailix.com, Germany for Matomo). Click-through embeds (LinkedIn, YouTube) may transfer to third countries under the embedding provider's own safeguards; opening or not opening those is your choice.
7. Your rights
Under GDPR Articles 15 to 22 you may at any time:
- Request access to your data.
- Ask for inaccurate data to be rectified.
- Request erasure or restriction of processing.
- Object to processing based on legitimate interest.
- Receive your data in a portable format where applicable.
To exercise any of these rights, write to the DPO at dpo@polytechnique.edu. You will receive a reply within one month.
8. Opt out of audience measurement
If you prefer not to be counted at all, your browser's Do-Not-Track signal is enough. The Matomo tracker checks it on every page and refuses to record you when it is set. You can also use the opt-out below, which stores a technical cookie on your device indicating your choice:
9. Complaints
You have the right to lodge a complaint with the French data-protection authority (CNIL) if you consider your rights have not been respected:
- cnil.fr/en/plaintes
- CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
10. Changes
This notice is versioned in the ORAILIX site repository. Material changes (new processing, new third parties, retention changes) will be reflected here with the Last updated date at the top of the page.
← Back to ORAILIX