Protocol 01 · Handling of Personal Data
Privacy Policy (GDPR)
Safety checklist — confirm each item
§ 1.1 — Data controller
ThemeBuildNet is the controller of the personal data described in this protocol. Our registered bench is 68 RUE GAMBETTA, 33000 BORDEAUX, FRANCE. All privacy correspondence is handled at [email protected], answered within 30 days.
§ 1.2 — Data we collect
(a) Identity and contact details you enter on the requisition voucher (name, company, email, telephone). (b) The content of your project brief and any files you send. (c) Billing records processed through our payment provider. (d) Technical logs: IP address, user agent, pages viewed, and consent preferences — collected only where you have accepted the relevant cookies.
§ 1.3 — Purposes and legal bases
We process your data to (i) respond to your requisition and prepare a scoped protocol — steps prior to a contract at your request (Art. 6(1)(b)); (ii) deliver the engagement and invoice it — performance of contract (Art. 6(1)(b)); (iii) secure our website and prevent abuse — legitimate interest (Art. 6(1)(f)); (iv) remember your cookie choice — consent (Art. 6(1)(a)); (v) meet French bookkeeping and tax obligations — legal obligation (Art. 6(1)(c)).
§ 1.4 — Recipients and transfers
Data is accessible only to ThemeBuildNet staff and vetted processors hosting within the European Union: our cloud infrastructure provider, our payment processor (Stripe), and our email provider. We do not sell, rent, or broker personal data. Any transfer outside the EEA relies on Standard Contractual Clauses or an adequacy decision.
§ 1.5 — Retention
Requisitions and briefs: 24 months from last contact. Contracts and invoices: 10 years (French commercial code). Technical logs: 12 months. Consent preference: stored in your browser until you clear it.
§ 1.6 — Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing, and you may withdraw consent at any time without affecting prior lawful processing. Write to [email protected] with the subject line “Data subject request”. You may also lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, paris.cnil.fr).
§ 1.7 — Security
Briefs travel over TLS 1.3. Records rest encrypted on EU-hosted infrastructure with role-based access, versioned backups, and quarterly credential rotation — controls aligned with ISO/IEC 27001. Any personal-data breach is assessed within 72 hours and notified to the CNIL where the law requires it.