Privacy policy

Data controller

TOM³ — To complete: identity of the controller (name or company name) and address. Contact: tom3.studio@gmail.com.

Information collected

• Brief form: name or first name (optional), chosen contact method and the related detail (phone number or Instagram account), information about your project (type of ad, description, goal, package, budget, timeline, reference links) and any files you attach.
• Call-back request: name or first name (optional), phone number, availability and project description (optional).
• Direct contact by email, phone or Instagram: the information you choose to send us.
• Technical data: the website host records connection logs (IP address, date, requested page, browser) needed to keep the service secure. To limit abuse, the website computes a non-reversible fingerprint of your IP address, kept in memory for ten minutes at most.

The form does not ask for your email address. If you choose the “Email” option, your email app opens and you write to us directly: your address then reaches us through your own message.

Purposes

Your information is used to answer your request, discuss your project, prepare a quote and, if you wish, carry out the work. It is not used for marketing and is never sold or rented.

Legal bases

• Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR): handling your requests and quotes.
• Legitimate interest (Article 6(1)(f) GDPR): website security and abuse prevention.
• Legal obligation (Article 6(1)(c) GDPR): keeping accounting records if you place an order.

Recipients

Your information is intended for TOM³ only. It passes through technical providers acting on our behalf:

• the website host, Netlify, Inc. (United States), which serves the pages and runs the form processing;
• the email delivery service Resend (Resend, Inc., United States), which carries the form content to our inbox;
• Google (Gmail), which hosts the tom3.studio@gmail.com inbox;
• if the Cloudflare Turnstile anti-bot check is enabled, Cloudflare, which analyses technical data from your browser to tell humans from bots.

Transfers outside the European Union

Some of these providers may process data outside the European Union, notably in the United States. These transfers rely on the safeguards provided by the GDPR (EU-US Data Privacy Framework adequacy decision for certified companies, or standard contractual clauses). Netlify, Inc. states that it adheres to the EU-US Data Privacy Framework. To verify: safeguards used by Resend and Google

Retention periods

• Requests that don't lead to an order: To complete: for example 3 years after the last contact, the CNIL reference period for prospects.
• Clients: for the duration of the contract, then according to legal periods (10 years for accounting records).
• Attachments: To complete: retention period in the inbox.
• Technical logs: according to Netlify's privacy policy.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death. To exercise these rights, write to tom3.studio@gmail.com. You can also lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.

Cookies and trackers

This website uses no advertising cookies, no audience measurement tools and no third-party trackers, so no consent banner is shown. If an analytics tool or third-party content requiring consent is added, this policy will be updated and your prior consent will be requested, with refusing made as easy as accepting.

The book-a-call button may lead to a third-party online calendar: that service's own policy applies when you open it.

Security

Communication with the website is encrypted (HTTPS). Form data is checked by the server and then sent by email; the website does not store it in any database.