Privacy Policy
We collect as little personal data as we can get away with. This page explains what that is, why we hold it, and what you can ask us to do about it.
Who is responsible
The data controller is Rania Randa Mmadi, 24 Chemin du Fort de Bregille, 25000 Besançon, France, VAT FR68103449872. Privacy questions go to info@raniaranda.com — we handle them ourselves, so there is no separate data protection officer.
What we collect
- Details you send us — your name, email address, company, budget range and the message you type into the contact form.
- Project information — briefs, files and feedback you share while we work together.
- Billing details — invoicing address and VAT number, which we need to issue a valid invoice.
- Basic server logs — the usual technical records our hosting keeps for security. We don't build visitor profiles from them.
Why we use it
Under the GDPR we rely on three bases, and only these:
- Contract (Art. 6(1)(b)) — to reply to your enquiry, prepare a proposal and deliver the work you hired us for.
- Consent (Art. 6(1)(a)) — the tick box on the contact form, which lets us store your message and get back to you. Withdraw it any time by emailing us.
- Legal obligation (Art. 6(1)(c)) — invoicing and tax records we are required to keep.
We don't sell your data, we don't run newsletters, and we don't make automated decisions about you.
Who else sees it
A small number of trusted providers help us run the studio: hosting and database, email, file storage, accounting software and our tax advisor. Each one processes data only on our instructions under a written data processing agreement (Art. 28).
Where it is stored
Inside the European Union. If a provider ever had to move data outside the EU, we would put standard contractual clauses in place first and tell you.
How long we keep it
Enquiry messages that never became a project: 12 months. Project correspondence: three years after the project ends. Invoices and accounting records: ten years, because French tax law requires it. After those periods the data is deleted or anonymised.
Your rights
You can ask to access, correct, export or delete your data, restrict how we use it, or object to processing based on legitimate interest. Email info@raniaranda.com and we will answer within one month, as Article 12 requires. If you are in France, you may also lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL); in another EU country, with your own supervisory authority.
Security
Access is limited to the people who need it, connections are encrypted, and the database sits behind row-level security so anonymous visitors cannot read submissions. No system is perfect — if something ever goes wrong and it affects you, we will tell you within 72 hours as Article 33 requires.
Changes
If this page changes in a way that matters to you, we'll say so here and update the date at the top.