Privacy policy

Last updated: 2 October 2026

Introduction

Active in the energy and climate transition, HEXANA recognises the protection of personal data as a core responsibility. In accordance with the General Data Protection Regulation (GDPR) and the French law No. 78-17 of 6 January 1978, the purpose of this policy is to provide you with transparent, concise and accessible information on:

• The personal data we collect,
• The purposes for which it is processed,
• Your rights and how to exercise them,
• The measures put in place to ensure its security.

This policy governs the processing of personal data of any natural person (‘User’) when they interact with HEXANA, in particular:

• via the website www.hexana.fr,
• at business and commercial events,
• or by any other means of communication.

We invite you to check this page regularly for any updates.

I. About HEXANA

HEXANA is a simplified joint-stock company (SAS) developing an innovative energy solution. Our technology combines sodium-cooled fast neutron reactors with a thermal storage system, providing carbon-free, flexible, competitive and independent energy tailored to industrial needs.

Building on the legacy of the Phénix, Superphénix and ASTRID projects, we are transforming nuclear energy into a key driver of the energy transition.

To find out more about our activities, please visit our About Us page.

II. How to contact the Data Protection Officer (DPO)?

The data controller is HEXANA, with its registered office at the following address:

HEXANA
135 rue Emilien Gautier
ZAC de l’Enfant, Building C
13290 Aix-en-Provence
France

If you have any questions regarding this policy, the exercise of your rights, or the processing of your personal data, please contact our Data Protection Officer (DPO):

• By email: dpo@hexana.fr
• By post: To the postal address given above.

We undertake to respond to your request within a maximum of 30 days, in accordance with Article 12 of the GDPR.

III. Details of the data processing

HEXANA processes your personal data lawfully, fairly, and transparently, in accordance with the principles of data minimisation and purpose limitation. Here is the key information regarding the processing activities we carry out:

Further details:

• Legitimate interest: For processing based on article 6.1(f), HEXANA relies on its legitimate interest in maintaining a professional relationship with you. You have the right to object to this data processing at any time (see Section VI: Your Rights).
• Sensitive data: HEXANA does not process any sensitive data (e.g. ethnic origin, political opinions etc.) within the meaning of article 9 GDPR.
• Automated decision-making: No decisions based solely on automated processing (including profiling) are made using your personal data.
• Transfers outside the EU: No personal data is directly transferred outside the European Union.

IV. Our partners and recipients

Your personal data is accessible only to the following persons and entities, acting strictly within the scope of their duties:

• Authorised HEXANA employees:
  • IT department: For system maintenance and security.
  • Marketing department: For the management of business events and communications.
  • DPO: To answer any data subject requests.
  • Sales department: For handling business enquiries.
• Our subcontractors:
  • O2switch: Hosting and backup of the website www.hexana.fr

V. Cookie policy

1. What is a cookie?

A cookie is a small text file stored on your device (computer, smartphone, tablet) when you visit a website, to remember your preferences (e.g., language, display settings); analyse your browsing behaviour to improve the user experience; or personalise the content or adverts displayed.

2. Categories of cookies

HEXANA uses both first-party cookies (set directly by our website to ensure technical performance and remember your preferences) and third-party cookies (set by trusted external partners, such as analytics or audience measurement providers, to help us understand how visitors interact with our platform).

Below is the detailed inventory of the cookies currently used on www.hexana.fr, including their specific purposes, legal bases, and retention periods:

Functional and technical cookies:

Targeting cookies

3. Consent collection

On your first visit to www.hexana.fr, a consent banner is displayed to inform you of:

• The categories of cookies used;
• Their purpose;
• Your right to reject or accept all or some of the cookies.

Your consent is:

• ✅ Voluntary: You may accept or reject without this affecting your access to the website.
• ✅ Specific: You can tick or untick each category of cookies.
• ✅ Informed: The banner clearly explains the purposes.
• ✅ Revocable: You can withdraw your consent at any time (see Section VI).

4. How can you manage cookies?

You have several options for managing cookies:

• Via our consent banner: Click on “Manage preferences” to enable or disable each category.
• Via your browser:
  • Delete cookies: See the “Help” section of your browser (Chrome, Firefox, Safari, Edge, etc.).
  • Block cookies: You can configure your browser to reject all or some of cookies. Please note: Essential website features may not operate correctly if technical cookies are disabled.
• Via third-party tools: Use dedicated browser extensions to block tracking cookies.

For more information, read the CNIL guide on cookies.

VI. Your rights

In accordance with articles 12 to 22 GDPR, you have the following rights regarding your personal data. To exercise these rights, please submit your request:

• By email: dpo@hexana.fr
• By post:
  HEXANA,
  To the attention of the DPO,
  135 rue Emilien Gautier, ZAC de l’Enfant, Building C, 13290 Aix-en-Provence, France.
• Or by clicking here.

HEXANA undertakes to respond to your request within a maximum of 30 calendar days (subject to extension under exceptional circumstances).

1. Right of access (Art. 15 GDPR)

You may:

• Obtain confirmation as to whether your data is being processed;
• Access all your personal data;
• Find out more about the purposes of the processing, and the recipients.

2. Right to rectification (Art. 16 GDPR)

You may request that your personal data be amended or supplemented if it is inaccurate or incomplete.

3. Right to erasure (“right to be forgotten”) (Art. 17 GDPR)

You may request the erasure of your personal data in the following cases:

• Your data is no longer necessary for the purposes for which it was collected;
• You withdraw your consent (for processing based on Article 6.1(a));
• You object to the processing (see Section VI.5);
• Your data has been processed unlawfully.

Exceptions: HEXANA may need to retain certain personal data in order to comply with legal obligations or to establish, exercise, or defend legal claims.

4. Right to restriction of processing (Art. 18 GDPR)

You may request that the processing of your personal data be suspended in the following cases:

• You contest the accuracy of your personal data (pending verification);
• The processing is unlawful, but you object to the erasure of your data;
• HEXANA no longer needs your personal data, but you require it to establish, exercise, or defend legal rights.

5. Right to object (Art. 21 GDPR)

You may object at any time to the processing of your personal data on the following grounds:

• Reasons relating to your particular situation (for processing based on Article 6.1(f));
• Direct marketing (including profiling for marketing purposes).

6. Right to data portability (Art. 20 GDPR)

You may receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV) in order to:

• Transfer it to another data controller;
• Reuse it for your own purposes.

Note: This right applies only to automated processing based on your consent or a contract.

7. Right to withdraw consent (Art. 7 GDPR)

For processing based on your consent (e.g., marketing cookies), you may withdraw your consent at any time:

• Via the cookie management banner;
• By contacting the DPO at dpo@hexana.fr.

8. Right not to be subject to automated decision-making (Art. 22 GDPR)

HEXANA does not use any fully automated decision-making processes (including profiling) that produce legal effects or similarly significantly affect you.

VII. Data security

HEXANA implements appropriate technical and organisational measures to ensure the security and confidentiality of your personal data, in particular:

• Restricted access to personal data (principle of least privilege);
• Regular backups and recovery tests;
• Staff training on data protection;
• Auditing procedures for data processors.

In the event of a personal data breach, HEXANA undertakes to:

• Notify the CNIL within 72 hours if there is a risk to your rights and freedoms;
• Inform you without undue delay if the breach creates a high risk to your rights and freedoms.

VIII. Data retention

Retention periods are determined according to the purposes of the processing and legal obligations. The main rules applied by HEXANA are summarised below:

IX. Useful links and contact details

• To exercise your rights: dpo@hexana.fr or by clicking here
• To find out more about the GDPR: Official EU website
• To report a data breach or file a complaint: CNIL – Report a problem