Privacy Policy

1. Data Controller

The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is:

Cedric Mangen, byCedric Studio, Luxembourg. Email: hello@bycedric.pro. Phone: +352 621 132 256.

2. Legal Basis for Processing

We process personal data based on Article 6(1) of the GDPR. Specifically:

a) Consent (Art. 6(1)(a) GDPR): When you contact us through the contact form, we process your data based on your voluntary consent.

b) Performance of a contract (Art. 6(1)(b) GDPR): When you request or commission a service, we process your data for the preparation and performance of the contract.

c) Legitimate interest (Art. 6(1)(f) GDPR): Technical data is processed based on our legitimate interest in providing and securing the website.

3. Data We Collect

Contact form: When you use the contact or booking form, we collect your name, email address, phone number (optional), preferred language, and your message. This data is used solely to respond to your inquiry.

Technical data: When you visit this website, technical data is automatically collected by the hosting provider: IP address, browser type and version, operating system, referrer URL, access time, and requested page. This data is technically necessary for operating the website.

4. Cookies

This website uses the following cookies:

a) Technically necessary cookies: Session cookies for form processing and authentication in the admin area (admin_session). These cookies are required for the website to function and are deleted after the session ends or after a maximum of 7 days.

b) Analytics cookies: Via Google Tag Manager, analytics cookies may be set to help us understand and improve website usage. These cookies are set on the basis of your consent (Art. 6(1)(a) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR) in analysing website usage.

Vercel Analytics is also used but does not use cookies and only collects anonymised usage data.

You can disable or delete cookies in your browser settings at any time. Please note that disabling technically necessary cookies may limit the functionality of the website.

5. Third-Party Processors

To provide our services, we use the following third-party providers:

a) Vercel Inc. (San Francisco, USA): Website hosting and web analytics (Vercel Analytics). Vercel processes technical access data (IP address, request timestamp) and anonymised usage data. Vercel Analytics is privacy-friendly and does not use cookies. Privacy policy: https://vercel.com/legal/privacy-policy. Data transfer to the USA is conducted on the basis of EU Standard Contractual Clauses.

b) Google LLC (Mountain View, USA): Google Tag Manager for managing website tags and analytics services. Google may set cookies and collect usage data. Privacy policy: https://policies.google.com/privacy. Data transfer to the USA is conducted on the basis of EU Standard Contractual Clauses.

c) Supabase Inc. (San Francisco, USA): Database for contact inquiries and bookings. Stores data submitted through forms. Privacy policy: https://supabase.com/privacy. Data transfer to the USA is conducted on the basis of EU Standard Contractual Clauses.

6. Data Retention

Contact form data: Your inquiries are stored for a maximum of 12 months, unless a contractual relationship is established. In the case of a business relationship, statutory retention periods apply (up to 10 years under commercial and tax law).

Technical access data: Server logs are retained by the hosting provider for a maximum of 30 days and then automatically deleted.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You have the right to know what data we have stored about you.

• Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate data.

• Right to erasure (Art. 17 GDPR): You can request the deletion of your data, provided no legal retention obligations apply.

• Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you can request the restriction of processing.

• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used format.

• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw your consent at any time with effect for the future.

To exercise your rights, contact us at: hello@bycedric.pro.

8. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33 GDPR). If a high risk exists, we will also inform you without undue delay (Art. 34 GDPR).

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority. The authority responsible for Luxembourg is:

Commission Nationale pour la Protection des Données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg. Website: https://cnpd.public.lu.