Privacy & GDPR

01 - Preamble

Preamble

Thomax Studio attaches particular importance to protection of your personal data. This privacy policy describes what data is collected through thomax-studio.fr, how it is used, and the rights you may exercise.

It complies with the General Data Protection Regulation (GDPR - EU 2016/679) and with applicable French data protection law.

02 - Identity

Data controller

Controller: Thomax Studio
SIRET: 991 991 282 00013
Registered office: 60 rue François Ier, 75008 Paris, France
GDPR contact: hello@thomax-studio.fr

03 - Collection

Personal data collected

We collect only the data strictly necessary for the purposes described below:

Through the contact form

First and last name.
Business email address.
Company name (optional).
Indicative budget range.
Project description (free text).

Through browsing

IP address (anonymised), browser type, pages viewed, session duration.
Theme preference (dark/light) stored in localStorage.

04 - Purposes

Purposes of processing

Responding to your requests for quotations or information sent through the contact form.
Managing the business relationship with our prospects and clients (quotations, contracts, invoicing).
Improving the site through anonymised analysis of traffic and browsing behaviour.
Remembering your preferences display preference (theme).

No data is used for third-party marketing or resold.

05 - Legal basis

Legal basis for processing

Legitimate interest of the controller (article 6.1.f GDPR), in particular for following up prospects and improving the site.
Consent (article 6.1.a GDPR) for cookies that are not strictly necessary.
Performance of the contract (article 6.1.b GDPR) for data processed as part of active engagements.
Legal obligation (article 6.1.c GDPR) for the retention of accounting records.

06 - Retention

Retention periods

Contact requests: 3 years after the last exchange if it does not lead to a client relationship.
Client data: 10 years after the end of the contractual relationship (statutory accounting obligation).
Analytics cookies: 13 months at most.
Server logs: 12 months (security and anonymous statistics).
Theme preference: Stored locally on your device - removed by clearing the cache.

07 - Recipients

Recipients of the data

Your data is accessible only to:

Authorised Thomax Studio staff (for commercial and operational follow-up).
The strictly necessary technical processors: hosting provider (Vercel), transactional email (Resend), video conferencing (Google Meet).

No transfer outside the EU takes place without appropriate safeguards (European Commission standard contractual clauses).

08 - Cookies

Cookies and audience measurement

On your first visit, a banner asks for your choice. “Accept all” and “Reject all” carry exactly the same weight, and you can change your mind at any time: manage cookies (the link is also at the bottom of every page).

Without consent: anonymous statistics

What is measured - page views, clicks, form steps and submissions, screen type (desktop, tablet, mobile) and referring page.
How - with our own tool, using a random session identifier kept for 24 hours in your browser's local storage. No third-party cookie, no IP address recorded, no country, no cross-referencing with other sites.
Why without consent - this measurement is limited to anonymous traffic statistics, under the exemption the CNIL (French data protection authority) provides for audience measurement. You can object to it: “Customise”, then switch off “Anonymous statistics”.
Where - a Supabase database hosted in the European Union. Retention: 25 months maximum.

With your consent

Advanced audience measurement & location: The country and region of your visit (for example France, Île-de-France), inferred from your connection by our host Vercel at the time of the visit. We neither receive nor keep your IP address or your city. These two details are added to the statistics above and follow the same retention period.
Microsoft Clarity: Session recordings and heatmaps, to see where browsing gets stuck; input fields are masked. Provider: Microsoft Corporation, data that may be processed outside the European Union under standard contractual clauses. Cookies _clck (12 months) and _clsk (24 hours). The script only loads after you consent.

What stays on your device

Your choice: Kept for 6 months in local storage, after which the banner is shown to you again.
Session: Anonymous identifier, 24 hours.
Preferences: Display language and theme, until the site's data is cleared.

Withdrawing your consent

Click “Manage cookies” at the bottom of any page, then “Reject all”, or switch off a category. Withdrawal takes effect immediately: location stops, Clarity stops and its cookies are deleted. You can also clear the site's data in your browser settings.

No advertising or profiling cookies are set. No data is shared with advertising platforms.

09 - Your rights

Your GDPR rights

Under the regulations, you have the following rights over your data:

Right of access - find out whether we process data about you and obtain a copy of it.
Right to rectification - correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) - request the deletion of your data under the conditions laid down by law.
Right to restriction of the processing.
Right to object to the processing, in particular for marketing purposes.
Right to data portability - receive your data in a structured format.
Right to give directions on what happens to your data after your death.

10 - Exercising your rights

How to exercise your rights

To exercise one of these rights, write to us at hello@thomax-studio.fr stating the subject of your request and enclosing, if necessary, a copy of an identity document (to prevent impersonation).

We undertake to reply within one month at most, extendable by two months for complex requests.

If, having contacted us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority).

11 - Security

Data security

We implement appropriate technical and organisational measures to protect your data against loss, alteration, unauthorised access or disclosure:

Encrypted transfers (HTTPS/TLS across the whole site).
Hosting on secure infrastructure (Vercel, SOC 2 Type II certified).
Data access restricted to authorised staff.
Strong passwords and two-factor authentication on all internal tools.
Documented backups and disaster recovery plan.

12 - Updates

Changes to this policy

This policy may be updated at any time, in particular if the regulations or the technology change. The date of last update appears at the top of this page. We encourage you to check it regularly.