Privacy policy

Data controller

The data controller is Ondina Studio, a SASU whose registered office is at 60 rue François 1er, 75008 Paris, email: info@ondinastudio.com. No data protection officer (DPO) has been appointed, as Ondina Studio is not required to designate one under the GDPR.

Data collected

The website collects personal data in the following situations:

• Contact form : first name, last name, email address, subject and message; phone number (with country code) and organisation if you provide them; page language. A summary of your message is emailed to the address you provide.
• Newsletter : email address and page language at the time of sign-up. Every newsletter email contains an unsubscribe link.
• Bot protection : when you submit the contact form or subscribe to or unsubscribe from the newsletter, the Cloudflare Turnstile service analyses technical browser signals and your IP address to tell a person from an automated program.
• Writing directly to Ondina Studio : email address, message content and any identity details you include.
• Technical logs : IP address, date, requested page and browser, recorded by the host for the operation and security of the website.

Purposes

This data is used to answer your requests and follow up on correspondence, to send you the Ondina Studio newsletter (releases, premieres, events) if you have subscribed, and to protect the website against automated submissions and abuse. It is neither sold nor transferred to third parties for commercial purposes.

Legal bases

Contact requests: pre-contractual steps taken at your request (Article 6(1)(b) GDPR) or Ondina Studio's legitimate interest in answering professional enquiries (Article 6(1)(f)). Newsletter: your consent, given when you subscribe (Article 6(1)(a)), which you may withdraw at any time. Bot protection, operation and security of the website: legitimate interest (Article 6(1)(f)).

Recipients and processors

The data is intended for authorised Ondina Studio staff, who read requests and manage the newsletter from the website's administration area. It is processed on our behalf by the following providers:

• Majoli : technical platform of the website: storage of contact requests and newsletter subscriptions, sending of emails.
• Twilio SendGrid (Twilio Inc.) : delivery of emails sent by the website (contact notification, summary, newsletter).
• Cloudflare, Inc. : Turnstile anti-robot check on the contact, newsletter sign-up and unsubscribe forms.
• Amazon Web Services EMEA SARL : website hosting.
• Google Ireland Limited : Ondina Studio's email service (Google Workspace) and the YouTube video player: it only loads when you start a video (a film's trailer or an article's video). It may then store information in your browser, under Google's policy.
• Vimeo.com, Inc. : Vimeo video player, loaded when a trailer hosted on Vimeo plays in the background of the home page or a film page, or when you start a video hosted on Vimeo.
• Upstash, Inc. : limiting how often forms can be sent and logins attempted: the IP address is kept for 15 minutes at most.

Transfers outside the European Union

Some of these providers may transfer data outside the European Union, in particular to the United States. Such transfers are governed by the adequacy decision for the EU–US Data Privacy Framework where the provider is certified and, failing that or in addition, by the European Commission's standard contractual clauses (Article 46 GDPR).

Retention periods

• Contact requests and correspondence: 3 years from the last exchange.
• Newsletter: until you unsubscribe, using the link in every email or on request. The address is then kept, marked as unsubscribed, for the sole purpose of not writing to you again; it is deleted on request.
• Bot-protection data: processed for the duration of the check, under Cloudflare's policy.
• Technical logs: 12 months.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection and portability, as well as the right to withdraw your consent at any time (in particular for the newsletter), without affecting the lawfulness of prior processing. You can exercise these rights by writing to info@ondinastudio.com. We reply within one month of receiving the request, extendable by two months in the case of a complex request, in accordance with Article 12 GDPR.

Right to lodge a complaint

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL). www.cnil.fr

Cookies

As stated in the legal notice, this website only sets technical cookies required for it to work: for authorised staff only, the administration area session. No advertising, tracking or audience-measurement cookie is set by the website. The YouTube player only loads if you start a video. The Cloudflare Turnstile check is used solely to secure the forms and not for advertising purposes.

Automated decisions and security

No automated decision producing legal effects, and no profiling, is carried out. Ondina Studio implements appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration.