Privacy policy
Last updated: 23 September 2026
This policy explains what data we process, why, for how long and how to exercise your rights. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
English translation. Biohackademia is a domain owned and operated by LOUNIZ, a company registered in France. This page is an English translation of the French original, provided so that you can read it in your own language. The relationship between you and LOUNIZ is governed by French law, and the French version of these terms is the one that prevails should the two ever differ. Nothing here removes the protections you enjoy under the mandatory consumer law of your own country of residence.
1. Data controller
The data controller is LOUNIZ, a SAS with a share capital of 400 000 euros, whose registered office is at 4 avenue Gourgaud, 75017 Paris, France, registered under number RCS Paris 797 439 031, which operates the Biohackademia site. For any question about your data: contact@biohackademia.com.
LOUNIZ is not required to appoint a data protection officer within the meaning of article 37 of the GDPR. Requests to exercise rights are handled directly at the address above.
2. General principle
We apply the principle of minimisation: we collect only what is needed to sell you a course, give you access to it and answer your requests. We do not sell any data and we do not use advertising tracking.
3. Data collected and purposes
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, first name, email address | Creating the account, sending access, customer service | Performance of the contract | 3 years after the last contact |
| Billing address | Issuing the invoice, tax obligations | Legal obligation | 10 years (French Commercial Code) |
| Order history | Managing access, the guarantee, accounting | Performance of the contract / legal obligation | 10 years |
| Payment data | Processing the transaction | Performance of the contract | Held by Stripe, never by us |
| Messages sent to support | Handling the request | Legitimate interest | 3 years |
| Audience measurement data | None to date. No analytics tool is installed on the site. | Not applicable | Not applicable |
4. What we do not collect
- No card data is stored on our servers.
- No health data. The figures you enter in our free tools (calorie calculator, reading speed test, breathing guide) are computed in your browser and are never sent to us.
- No advertising profiling, no resale to third parties.
5. Recipients and processors
Your data may be passed to the strictly necessary providers:
- Stripe Payments Europe, Ltd., payment processing and invoice issuing (Ireland).
- OVH SAS, hosting of the site and its content (France).
- OVH SAS, SMTP service for sending transactional emails: order confirmation, password creation link (France).
We use no audience measurement tool, no advertising pixel and no third-party tracker. This list is exhaustive.
Each of these providers is bound by a processing agreement compliant with article 28 of the GDPR. Where a transfer outside the European Union takes place, it is framed by standard contractual clauses or an adequacy decision.
6. Your rights
You have the following rights:
- Access, to obtain a copy of the data concerning you.
- Rectification, to have inaccurate data corrected.
- Erasure, to request deletion, subject to legal retention obligations.
- Restriction, to request that processing be frozen.
- Portability, to receive your data in a structured format.
- Objection, to object to processing based on legitimate interest.
- Withdrawal of consent, at any time, for the processing that depends on it.
To exercise these rights: contact@biohackademia.com. We answer within one month. Proof of identity may be requested where there is reasonable doubt.
You may also lodge a complaint with the CNIL, the French data protection authority, www.cnil.fr. If you are resident in another country, you may instead lodge a complaint with your own national supervisory authority where one exists.
7. Security
Exchanges are encrypted (HTTPS). Access to data is restricted to the people who need it. Passwords are stored as hashes. In the event of a data breach presenting a risk, we notify the CNIL within 72 hours and inform you if the risk is high.
8. Emails
Transactional emails (confirmation, access, invoice) are necessary for the performance of the contract. Informational emails are sent only with your consent and carry an unsubscribe link in every message.
9. Minors
Our courses are aimed at adults. We do not knowingly collect data concerning minors under the age of 15.
10. Changes
This policy may change. The date it was last updated appears at the top of the page. Where a change is substantial, Customers are informed by email.
Note to the site operator. The bracketed entries must be completed with the real details of the operating entity before going live. This document is a template consistent with the usual obligations of French and European law; it does not replace review by a legal adviser.