Last update : 20 May 2026

Privacy Policy & GDPR

Ateliers 360 protects data collected for workshops, contact requests, bookings and Passerelle Jeunesse missions in accordance with GDPR and French law.

1. Data controller

Ateliers 360 — Micro-enterprise | Legal representative: Nathan Imogo Imogo | DPO email: rgpd@ateliers360.fr

2. Data collected and purposes

We collect only the data that is strictly necessary (data minimization principle):

Contact forms

Name, email, message — Legal basis: Legitimate interest — Retention: 3 years

Workshop booking

Name, email, institution, date — Legal basis: Contract performance — Retention: 5 years (accounting obligation)

Billing

Name, address, email, client SIRET — Legal basis: Legal obligation — Retention: 10 years

Workshop facilitation

Participant first name, level, creations — Legal basis: Contract performance — Retention: 1 school year then anonymized

Photos / videos

Participant image — Legal basis: Explicit written consent — Retention: Until consent withdrawal

Newsletter

Email, first name — Legal basis: Consent — Retention: Until unsubscribed

Passerelle Jeunesse mission requests

Young person's identity, age, legal guardians, route, dates, emergency contacts, useful instructions — Legal basis: Pre-contractual or contractual performance and legitimate safety interest — Retention: relationship duration then limited archiving

Website statistics

Anonymized IP, navigation — Legal basis: Consent — Retention: 13 months

4. Data recipients

Your data is processed by: Ateliers 360 internal team | partner schools (pedagogical reports) | technical service providers (host, Stripe, Resend) bound by GDPR-compliant Data Processing Agreements | competent authorities (legal obligation).

Your data is NEVER sold, rented, or disclosed to third parties for commercial purposes.

6. Your GDPR rights

Under GDPR, you have the following rights:

Obtain confirmation of data processing and receive a copy.
Correct inaccurate or incomplete data.
Request deletion ('right to be forgotten'), unless legal retention obligations apply.
Temporarily suspend processing.
Object to processing based on legitimate interest.
Receive your data in a structured format (when processing is based on consent or contract).
Withdraw consent at any time, without retroactive effect.
File a complaint with the CNIL if your rights are not respected — www.cnil.fr

To exercise your rights: rgpd@ateliers360.fr — Response within 30 calendar days (extendable to 3 months for complex requests).

7. Data security

Ateliers 360 implements the following measures: encryption in transit (HTTPS / TLS 1.2+) | bcrypt password hashing | access by named authorization | secure hosting with regular backups | GDPR-compliant DPAs with all providers | two-factor authentication for administration.