Privacy policy

Last updated: 12 September 2026

This is a courtesy translation. In the event of any discrepancy, the French version prevails.

This policy describes how the personal data of visitors and clients of babarstudio.fr is collected and processed, in accordance with Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended.

1. Data controller

Given the nature and volume of the processing carried out, appointing a data protection officer (DPO) is not required.

2. Data collected

2.1 Contact form

When you use the contact form, the following data is collected:

• Name (required);
• Email address (required);
• Industry (optional);
• Message content (required).

2.2 Connection data

The site's hosting provider records technical logs (IP address, date and time of access, pages visited, browser type) for security and service continuity purposes.

2.3 Contractual relationship

Where a service is provided, the data required to perform it and to issue invoices is also processed: postal address, phone number, company name, business registration number and billing details.

No special category data within the meaning of Article 9 of the GDPR is collected. The site carries out no profiling and no automated decision-making.

3. Purposes and legal bases

• Responding to enquiries and preparing quotes — steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
• Performing the service and managing the client relationship — performance of a contract (Article 6(1)(b)).
• Issuing and retaining invoices — compliance with accounting and tax obligations (Article 6(1)(c)).
• Ensuring the security and proper operation of the site — legitimate interests of the controller (Article 6(1)(f)).

4. Recipients and processors

Your data is never sold, rented or transferred to third parties for commercial purposes.

It is processed by the controller and by the following technical providers, acting either as processors or as controllers for their own purposes:

• Formspree, Inc. (United States) — delivery of messages sent via the contact form.
• GitHub, Inc. (United States) — site hosting via GitHub Pages and the associated technical logs.
• Google Ireland Limited / Google LLC — playback of embedded videos (YouTube), only if you start a video.

Transfers outside the European Union. Some of these providers are established in the United States. Such transfers are covered by the appropriate safeguards set out in Chapter V of the GDPR, in particular the European Commission's standard contractual clauses and, where applicable, certification under the EU–US Data Privacy Framework.

5. Retention periods

• Enquiries and prospects: 3 years from the last contact.
• Client data: for the duration of the contractual relationship, then 3 years for prospecting purposes.
• Accounting records and supporting documents: 10 years, in accordance with Article L.123-22 of the French Commercial Code.
• Connection logs: as determined by the hosting provider, generally no more than 12 months.

6. Cookies and trackers

This site sets no cookies for analytics, advertising or behavioural tracking. No consent banner is therefore required simply to browse the site.

However, playing a portfolio video loads the YouTube player, which may set cookies and collect browsing data governed by Google's privacy policy. No video loads until you click to play it.

Typefaces are hosted on this site: displaying them involves no request to, and no transmission of your IP address to, any third-party service.

Find out more: Google's privacy policy.

7. Security

The site is served entirely over HTTPS and enforces a Content Security Policy restricting permitted resources to those strictly necessary, limiting the risk of code injection. The controller implements appropriate technical and organisational measures to protect data against loss, unauthorised access or disclosure. Access to mailboxes and management tools is protected by personal credentials.

8. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: to confirm whether your data is being processed and obtain a copy.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to request deletion of your data, subject to statutory retention obligations.
• Right to restriction of processing.
• Right to object, in particular to direct marketing.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to give directions regarding the fate of your data after your death.

To exercise these rights, send your request to nicolas.babarstudio@gmail.com or by post to the address given in section 1. You will receive a response within one month. Proof of identity may be requested in the event of reasonable doubt as to your identity.

9. Lodging a complaint with the CNIL

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority:

10. Changes to this policy

This policy may be updated to reflect legal or technical developments. The date of the latest update appears at the top of this page.