Privacy Policy

Last updated: October 26, 2026

This policy explains how Ballpoint collects, uses and protects personal data when you visit https://trapster.cloud and when you use the Trapster platform, including subscriptions purchased through the Microsoft Azure Marketplace. It is written to comply with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Who we are

The data controller is Ballpoint SAS, share capital of 2,000 euros, registered with the Colmar Trade and Companies Register under number 919 130 534, France.

For any question about this policy or your personal data, contact us at contact@ballpoint.fr.

2. Data we collect

  • Contact and trial requests: name, business email address, phone number, organization and the content of your message.
  • Customer accounts: name, business email address, organization, user role, authentication and audit logs.
  • Azure Marketplace subscriptions: information shared by Microsoft when you purchase or manage an offer, such as purchaser name and email, Microsoft Entra tenant ID, subscription ID and the selected plan.
  • Billing: billing contact and invoicing details. Payments made through the Azure Marketplace are handled by Microsoft; we never receive your card details.
  • Technical data: IP address, browser type and request logs, used to operate and secure the website and the platform.

3. Data processed on behalf of our customers

Trapster decoys record the interactions they receive (source IP addresses, credentials attempted, commands and requests sent). For this data, the customer is the data controller and Ballpoint acts as a processor under Article 28 GDPR. We only process it on the customer's documented instructions, to provide the service, and under the terms of our contract or data processing agreement.

4. Why we use your data and on what legal basis

  • Answering contact and trial requests, and following up commercially with business contacts: our legitimate interest, or pre-contractual steps you requested.
  • Providing, supporting and billing the Trapster service, including Marketplace subscription management: performance of the contract.
  • Securing our website and platform and preventing abuse: our legitimate interest.
  • Measuring website audience with anonymous, aggregated statistics: our legitimate interest.
  • Keeping accounting and tax records: legal obligation.

We do not sell your personal data, and we do not use it for advertising profiling.

5. How long we keep it

  • Prospect data: 3 years after our last contact with you.
  • Customer account data: for the duration of the contract, then deleted or anonymized, except where retention is required by law.
  • Customer event data: for the duration of the subscription, then deleted after termination.
  • Invoices and accounting records: 10 years, as required by French commercial law.
  • Technical and security logs: up to 1 year.

6. Who receives your data

Your data is only accessed by authorized Ballpoint staff who need it for their work. We rely on the following subprocessors:

  • OVHcloud (France): hosting, including our self-hosted audience measurement tool.
  • Brevo (France): transactional email delivery.
  • hCaptcha, Intuitive Machines Inc. (United States): spam protection on our forms.
  • Microsoft (Azure Marketplace): purchase, billing and subscription management for Marketplace customers.

When data is transferred outside the European Economic Area, the transfer is covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

7. How we protect it

Ballpoint operates an information security management system certified ISO/IEC 27001 by BSI Group. Measures include encryption in transit, access control based on least privilege, multi-factor authentication for administrative access, logging and monitoring, regular security testing, and confidentiality commitments from all staff.

In the event of a personal data breach, we notify the CNIL within 72 hours where required, and we inform affected customers without undue delay.

8. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to define instructions regarding your data after your death. To exercise these rights, email contact@ballpoint.fr. We answer within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the supervisory authority of your country.

9. Cookies

We only use cookies that are strictly necessary for the website to work (session, language preference and form protection). hCaptcha may set its own cookies on pages with a form, to detect bots. To measure audience, we use a self-hosted analytics tool that sets no cookies and produces only anonymous, aggregated statistics. This data is not shared with third parties. We do not use advertising cookies.

10. Changes to this policy

We may update this policy. The date at the top of this page shows the latest version. Significant changes affecting customers will be communicated to them directly.