01 Data controller
- Controller
- DMA Digital
- Address
- 5 rue Claude Bernard, 77000 Melun, France
- Personal data contact
- hello@dmadigital.fr
02 Processing, purposes and retention
Data is collected directly from you, and only where necessary. No so-called “sensitive” data is processed, and no decision based solely on automated processing is made on the basis of your data.
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Call requests and project briefs | Identity, contact details, project details (type, budget, timescale) | Pre-contractual measures (Art. 6(1)(b)) | 3 years after the last contact |
| Online website audit | URL of the website analysed, email address | Pre-contractual measures (Art. 6(1)(b)) | 12 months |
| Job applications | CV, cover letter, portfolio, contact details | Pre-contractual measures (Art. 6(1)(b)) | 12 months after the last exchange |
| Partner programme (applications, opening alert) | Identity, contact details, answers to the form | Pre-contractual measures (Art. 6(1)(b)) | 12 months |
| Client area | Identity, login credentials, project data (documents, messages, invoices) | Performance of the contract (Art. 6(1)(b)) | Term of the contract + 5 years (limitation period) |
| Invoicing | Identity, address, payment references | Legal obligation (Art. 6(1)(c)) | 10 years (Art. L.123-22 of the French Commercial Code) |
| Transactional emails | Email address, content of notifications | Performance of the contract (Art. 6(1)(b)) | 12 months |
| Audience measurement | Pseudonymised browsing data (pages viewed, duration, device, country and city), without cookies | Legitimate interest, with the option to object from the cookie banner (Art. 6(1)(f)) | 14 months |
| Advertising | Conversion tracking for our Google Ads campaigns | Consent (Art. 6(1)(a)) | 13 months max. |
| Security logs | IP address (hashed and salted), timestamp, user agent | Legitimate interest (Art. 6(1)(f)), security | 12 months |
03 Recipients and processors
The data is accessible only to authorised persons at DMA Digital. For the provision of the services, it may be processed by the following processors, which are bound by commitments that comply with Article 28 of the GDPR:
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting (Cloudflare Pages) | European Union / United States |
| Supabase Pte. Ltd. | Database and authentication | European Union / Singapore |
| Resend | Sending transactional emails | European Union |
| Cloudflare | Bot protection (Turnstile) | European Union / United Kingdom |
| Advertising conversion tracking, Google Ads (with consent) | United States |
If you choose to write to us on WhatsApp, your messages, your number and your profile name pass through that service, operated by WhatsApp Ireland Limited (Meta group), which processes them under its own terms and its own privacy policy. To contact us without using it, write to hello@dmadigital.fr.
No data is sold, rented or transferred to third parties for commercial purposes.
04 Transfers outside the European Union
Some processors are established outside the European Union. In that case, transfers are subject to appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR: standard contractual clauses of the European Commission and, where applicable, an adequacy decision (in particular the EU-US Data Privacy Framework for certified providers). Details of these safeguards are available on request from hello@dmadigital.fr.
05 Your rights
Under the conditions laid down in Articles 15 to 22 of the GDPR, you have the following rights:
- Access: to obtain confirmation that your data is being processed and to receive a copy of it;
- Rectification: to have inaccurate or incomplete data corrected;
- Erasure: to request the deletion of your data, within the limits set by law;
- Restriction: to request that processing be temporarily suspended;
- Portability: to receive your data in a structured, readable format;
- Objection: to object to processing based on legitimate interest;
- Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- Instructions after death (directives post mortem): to decide what happens to your data after your death.
How to exercise your rights. Send your request to hello@dmadigital.fr, stating which right you wish to exercise. You will receive a reply within one month, which may be extended by two months for complex requests. If there is reasonable doubt about your identity, proof of identity may be requested.
If you believe that your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).
07 Security
DMA Digital implements technical and organisational measures appropriate to the risk: encryption of data in transit (HTTPS/HSTS), a content security policy (CSP), hashing and salting of IP addresses, role-based access control on the client area, rate limiting, bot verification and regular code reviews. In the event of a personal data breach likely to result in a risk to your rights, the CNIL and, where applicable, the data subjects are informed under the conditions set out in Articles 33 and 34 of the GDPR.
08 Changes to this policy
This policy may change, in particular if we change providers or if the regulations change. The applicable version is the one published on this page, identified by its effective date and its version number. Any substantial change will be clearly announced on the Site.