Privacy Policy

1. Data controller

The controller of the personal data collected through the website is Kompa.

Company name

Kompa

Legal form

Simplified joint-stock company with a sole shareholder (SASU)

Share capital

EUR 1,000.00

Registered office

11 route de la Faisanderie, 78110 Le Vésinet, France

Registration

Versailles Trade and Companies Register 106 806 268 (registered on 26/06/2026) — SIREN 106 806 268

Intra-Community VAT number

FR74 106 806 268

Legal representative

Benoit Roubaud, President

Contact (personal data)

hello@kompa.studio

For any question regarding this policy or the exercise of your rights, you may write to hello@kompa.studio.

2. Data collected

Kompa only collects data that is strictly necessary for the purposes set out below. Two categories of data are concerned.

Data submitted through the contact form. When you complete the contact form, the following data is collected:

• your name;
• your e-mail address;
• the type of project envisaged;
• the estimated budget;
• the free-text message you send us.

Technical data and logs. As part of the operation and security of the website, strictly necessary technical data may be processed on a temporary basis by our host (for example IP address, browser type, request timestamps, server logs). The website is static: it uses no audience-measurement tool, no advertising cookie and no third-party tracker. Fonts are self-hosted (Fontsource) and trigger no calls to third-party servers such as Google Fonts. Any storage in your browser is strictly technical.

3. Purposes of processing

The data collected is processed for the following purposes:

• responding to your contact requests and preparing quotes tailored to your project;
• managing the commercial relationship, following up on exchanges and, where applicable, entering into and performing a contract;
• ensuring the proper operation, security and technical maintenance of the website.

Your data is never resold to third parties and is not subject to any profiling or automated decision-making.

4. Legal bases

In accordance with Article 6 of the GDPR, each processing operation is based on an appropriate legal basis:

• Pre-contractual steps (Article 6(1)(b)): processing the contact-form data is necessary to take steps at your request prior to entering into a possible contract (responding to a quote or information request);
• Legitimate interest (Article 6(1)(f)): following up on the commercial relationship as well as the operation, security and technical maintenance of the website are based on Kompa's legitimate interest in managing its business and protecting its website;
• Consent (Article 6(1)(a)), where applicable: where a given processing operation requires it (for example sending marketing communications beyond the scope of your initial request), it is carried out only with your consent, which you may withdraw at any time.

5. Recipients and processors

The data is intended solely for authorised members of the Kompa team, strictly within the scope of their duties. To provide the service, Kompa relies on the following processors, which act on instructions and provide sufficient guarantees under the GDPR:

• Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, United States — vercel.com): hosting of the website and execution of the serverless function that processes the contact form;
• Resend, Inc. (United States — resend.com): delivery to Kompa, by e-mail, of the messages submitted through the contact form.

No data is transferred, rented or sold to third parties for commercial purposes.

6. Transfers outside the European Union

The processors Vercel and Resend are established in the United States. Processing your data may therefore involve a transfer outside the European Union.

These transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR, in particular the standard contractual clauses adopted by the European Commission and/or the relevant providers' certification under the EU–US Data Privacy Framework. You may obtain a copy of the safeguards in place by writing to hello@kompa.studio.

7. Data retention

Your data is kept only for the time necessary to fulfil the purposes for which it was collected:

• Contact and quote requests: kept for the time needed to handle your request and the resulting exchanges, then archived for the management of the commercial relationship and for prospecting purposes for a maximum period of three (3) years from our last contact, unless you request their deletion before that date;
• Technical data and logs: kept for a limited period not exceeding what is strictly necessary for the security and proper operation of the website;
• Contractual and accounting data: where a contractual relationship is entered into, the corresponding documents are kept for the applicable statutory retention periods.

Upon expiry of these periods, the data is deleted or anonymised.

8. Cookies

The website uses no tracking, analytics or advertising cookies and no third-party trackers. Only strictly technical cookies or storage items, essential to the operation of the website, may be used. As these items are strictly necessary, they require neither your prior consent nor the display of a banner, in line with the recommendations of the French data protection authority (CNIL).

9. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object, in particular to processing based on legitimate interest and to direct marketing;
• right to data portability.

You may exercise these rights, or withdraw any consent previously given, by writing to hello@kompa.studio. Proof of identity may be requested in the event of reasonable doubt about the identity of the requester.

If, after contacting us, you consider that your rights are not being respected, you have the right to lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

10. Security

Kompa implements appropriate technical and organisational measures to protect your data against unauthorised destruction, loss, alteration, disclosure or access. Exchanges with the website are encrypted (HTTPS) and access to data is restricted to authorised personnel only. Our hosting and message-delivery providers are selected for the security guarantees they offer. As no system can offer absolute security, we undertake, in the event of an incident likely to give rise to a risk to your rights and freedoms, to take the measures required by the applicable regulations.

11. Changes to this policy

Kompa reserves the right to amend this privacy policy at any time, in particular to adapt it to legal, regulatory or technical developments. The applicable version is the one published on the website on the date of your consultation. The date of the last update appears at the top of this document. We invite you to review it regularly.