How this research form handles your information

Who is responsible

The operator and controller of the information collected through this form is Clayton LHONI, France. Orkesa is the name of the research project and is not presented as a separate legal entity.

For any privacy question or request, email privacy@orkesa.co.

Information collected

When you submit the form, the following may be stored:

• your answers about the software-spend issue, including the type of problem, vendor (unless you prefer not to say), approximate amount, payment or commitment status, your account of what happened, any recovery attempt and its outcome;
• your role and company-size range;
• whether you agree to be contacted for an optional interview and, only if you opt in, your email address; and
• the submission date, a randomly generated submission identifier, campaign attribution information, and limited anti-abuse data as described below.

Free-text answers can contain information about you, another person, or a company. Please avoid including personal or sensitive information that is not needed to describe the software-spend issue.

The form identifies required questions as you proceed. Those answers are necessary to submit a research response; if you do not provide them, the response cannot be submitted. The final interview choice and email address are optional. An email address is stored only when you expressly opt in to interview contact.

Campaign and URL attribution

The form preserves all query-string keys and values supplied in the page URL, including repeated and unrecognized parameters. It also maps commonly used attribution fields separately: source, campaign or campaign_name, adset or adset_name, ad or ad_name, utm_source, utm_medium, utm_campaign, utm_content, utm_term, and fbclid.

If Meta's _fbp or _fbc cookie is already present in the browser request, its value may be stored with the submission. Campaign names are not inferred from fbclid.

Why the information is used

The information is used to:

• run the questionnaire and save completed responses;
• conduct internal research into software-spend problems and produce aggregated findings;
• understand the source and performance of research outreach and campaign traffic;
• secure the form, enforce rate limits, and prevent spam or abuse; and
• contact you about a research interview only when you have expressly opted in.

The legal basis for operating the questionnaire, conducting the research, protecting the service, preventing abuse, and recording source attribution is the controller's legitimate interests in carrying out and evaluating this research safely. The legal basis for using your email to invite you to an optional interview is your consent.

Research outputs and disclosure

Research may be shared as aggregated findings. No quotation or account attributable to a person or company will be published or shared without separate permission.

Service providers

The form uses Vercel for application hosting, routing, and server-side processing, and Neon for managed PostgreSQL database hosting. They process information on the controller's behalf to provide and secure these services, subject to their applicable terms and data-protection commitments.

Meta is not currently receiving Pixel events from this form: the Meta Pixel is inactive. If it is enabled later, Meta and the relevant Meta affiliate will be identified as an advertising measurement provider, and the notice will be updated if needed to reflect the enabled configuration.

GoDaddy Email & Office is used to manage the privacy email alias and route messages sent to the contact address above to the existing Orkesa mailbox.

International processing

Vercel, Neon, GoDaddy, and their subprocessors operate internationally. Information may therefore be processed outside France and outside the country where a participant is located, including in the United States. Their applicable service and data-protection terms describe the transfer mechanisms available for their services, which may include approved standard contractual clauses where relevant.

Contact privacy@orkesa.co to request current information about processing locations and the safeguards relevant to this research setup.

Meta Pixel and tracking consent

The current form does not load the Meta Pixel. If the Pixel is activated later, a page-view event and a lead event after a successful submission may be used for advertising measurement. The lead event will not include your form answers or email address.

Meta tracking is non-essential. It will not be enabled for visitors subject to UK or EEA tracking rules unless a consent mechanism is in place, and it will not load for those visitors before their consent. The same consent control must prevent the form from accessing or storing Meta _fbp and _fbc cookie values before consent. Declining or withdrawing that tracking consent will not prevent use of the research form.

Security and abuse prevention

The server processes the connection IP address from request headers to enforce a limit of five valid submission attempts per ten-minute window. Before the rate-limit record is written to Neon, the application transforms the IP address with a secret-keyed HMAC-SHA-256 function. Only that keyed digest, rather than the raw IP address, is written to the application's Neon rate-limit table. This digest is pseudonymous security data, not anonymous data.

The raw IP address is therefore processed transiently by the application and may also be processed by Vercel as part of normal network hosting and security. The application does not write the raw IP address to its research or rate-limit tables in Neon.

Retention

Personal information collected for this research is retained for a maximum of 12 months from collection. It is then deleted or anonymized. Aggregated or genuinely anonymized findings may be kept because they no longer identify a person. Operational rate-limit records are used only for security and abuse prevention, are pruned more frequently as part of normal operation and maintenance, and remain subject to the same 12-month maximum.

Your choices and rights

Depending on the law that applies to you and your request, you may ask to access, correct, or delete your personal information; restrict its use; receive a portable copy where that right applies; or object to processing based on legitimate interests. You may withdraw your consent to interview contact at any time. Withdrawal does not affect processing that occurred before it, and you can still participate in the questionnaire without agreeing to an interview.

Send a request to privacy@orkesa.co. Include enough information to locate the relevant submission; additional information may be requested when reasonably necessary to verify the request. Requests will be handled under the applicable privacy law.

You may also lodge a complaint with the French data-protection authority, the CNIL, or another competent supervisory or privacy authority where applicable.

Automated decisions

The information is not used to make decisions about you based solely on automated processing, and no profiling produces legal or similarly significant effects for you.