Privacy Policy

Last updated: March 15, 2026

This privacy policy describes how Ambriel (hereinafter "we", "our" or "Ambriel") collects, uses, stores and protects the personal data of users of its website ambriel.fr and its services. It is established in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the French Data Protection Act of January 6, 1978, as amended.

1. Data Controller

The data controller for personal data is:

Company name: Ambriel
Address: 460 Rue Croix Jean de France, 60650 Villers-Saint-Barthélémy, France
Email: contact@ambriel.fr
Phone: +33 6 65 93 50 95

2. Personal Data Collected

We collect different categories of personal data depending on your interactions with our website and services:

Identification data

Name, email address, phone number, company name, industry sector. This data is collected through our contact forms, quote request forms and account creation.

Connection and browsing data

IP address, browser type, operating system, pages visited, visit duration, language preference. This data is automatically collected during your browsing through essential technical cookies.

Financial data

We do not collect any financial data directly (credit card number, IBAN, etc.). All payments are processed by secure, PCI-DSS certified third-party providers. We accept bank transfers, cash and cryptocurrencies (BTC, ETH).

3. Processing Purposes and Legal Bases

Purpose	Legal basis (Art. 6 GDPR)	Retention period
Responding to your contact and quote requests	Pre-contractual measures (Art. 6.1.b)	3 years after last contact
Performing ordered services (website creation, design, marketing)	Contract performance (Art. 6.1.b)	Contract duration + 5 years (legal limitation)
Managing your user account	Contract performance (Art. 6.1.b)	Account duration + 3 years after deletion
Sending marketing communications and newsletters	Consent (Art. 6.1.a)	Until consent is withdrawn
Website improvement and browsing analysis	Legitimate interest (Art. 6.1.f)	13 months maximum (cookies)

4. Cookies

Our website uses cookies strictly necessary for the site to function:

NEXT_LOCALE: remembers your language preference (French/English). Duration: session.
Theme cookies: remembers your display preference (light/dark mode). Duration: 1 year.

We do not use advertising cookies or third-party trackers. No audience measurement cookies (Google Analytics, etc.) are installed. You can configure your browser to block cookies, but this may affect some website features.

5. Data Recipients

Your personal data may be shared with the following processors, strictly within the scope of the purposes described above:

Vercel Inc. (website hosting) — Headquarters: San Francisco, USA — Standard Contractual Clauses (SCCs) in place.
Google Firebase (user account authentication) — Google Ireland Ltd — Standard Contractual Clauses (SCCs) in place.
Email service provider (sending contact and quote forms) — SMTP server configured with TLS encryption.

We never sell, rent or share your personal data with third parties for commercial or advertising purposes.

6. International Data Transfers

Some of our processors (Vercel, Google Firebase) are located in the United States. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46.2.c of the GDPR, ensuring an adequate level of protection for your personal data.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration. These measures include: HTTPS (TLS) encryption of all communications, strict HTTP security headers (HSTS, CSP, X-Frame-Options), secure authentication via Firebase Auth, password storage with hashing, and access to data limited to authorized personnel only.

8. Your Rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): obtain confirmation that your data is being processed and receive a copy.
Right to rectification (Art. 16 GDPR): have your inaccurate or incomplete data corrected.
Right to erasure (Art. 17 GDPR): request deletion of your data, subject to legal retention obligations.
Right to data portability (Art. 20 GDPR): receive your data in a structured, commonly used and machine-readable format.
Right to object (Art. 21 GDPR): object to the processing of your data on legitimate grounds, or to processing for direct marketing purposes.
Right to restriction of processing (Art. 18 GDPR): request suspension of processing of your data in certain cases provided by law.

To exercise any of these rights, send us an email at contact@ambriel.fr specifying your request and attaching proof of identity. We commit to responding within 30 days.

If you believe that the processing of your data does not comply with applicable regulations, you may file a complaint with the French Data Protection Authority (CNIL): www.cnil.fr

9. Minors' Data

Our services are not intended for minors under 16 years of age. We do not knowingly collect personal data from minors. If we discover that we have collected data from a minor without the required parental consent, we will delete it as soon as possible.

10. Policy Changes

We reserve the right to modify this privacy policy at any time. In the event of a substantial change, we will notify you through a visible notification on our website. The date of the last update is indicated at the top of this page. We encourage you to review this policy regularly.

11. Contact

For any questions regarding this privacy policy or the protection of your personal data, you can contact us at:

contact@ambriel.fr