Last updated: 16 May 2026

Privacy policy.

Riyata Studio is committed to protecting the privacy of its site's visitors and the confidentiality of the personal data collected. This policy describes, transparently, what data is processed, why, for how long, and what your rights are, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

The controller of the personal data collected on riyatastudio.com is:

No data protection officer (DPO) is appointed to date, as the processing does not make it mandatory within the meaning of article 37 of the GDPR. Any request relating to your data should be sent to the email above.

2. Data collected

We collect only the data that is strictly necessary:

Via the contact form

  • Full name
  • Email address
  • Company (optional)
  • Phone (optional)
  • Project type
  • The content of your message

Technical data

  • IP address, user agent (browser, operating system), kept temporarily at the application server level (Cloudflare Workers) solely for anti-spam protection and rate-limiting.
  • Anonymised visit statistics via Cloudflare Web Analytics when enabled: no cookie, no unique identifier, no browser fingerprint.

No sensitive data within the meaning of article 9 of the GDPR (racial origin, political opinions, health, etc.) is requested or collected.

3. Purposes & legal basis

  • Responding to your quote or contact request: legal basis: pre-contractual measures taken at your request (art. 6.1.b GDPR).
  • Handling the commercial follow-up of the project and the client relationship: legal basis: performance of a contract (art. 6.1.b) or legitimate interest (art. 6.1.f) for prospects, within reasonable outreach.
  • Ensuring the security of the site, preventing spam and abuse: legal basis: legitimate interest (art. 6.1.f).
  • Meeting our legal obligations (accounting, taxation, retention of contractual documents): legal basis: legal obligation (art. 6.1.c).

Your data is subject to no unsolicited marketing, no resale, and no advertising targeting.

4. Recipients & processors

Your data is shared only with the following providers:

  • Cloudflare, Inc.: hosting of the site and the Worker, anti-spam protection (Turnstile), inbound email routing, anonymous statistics (Web Analytics). Data processed in the EU for European visitors via the network's European points of presence. Cloudflare policy.
  • Resend, Inc.: transactional delivery of the quote-request notification email. Configured sending region: eu-west-1 (Ireland). Resend policy.

These processors provide sufficient guarantees within the meaning of article 28 of the GDPR. No other third party has access to your data. No transfer of data outside the European Economic Area is carried out for European visitors, except with equivalent contractual safeguards (standard contractual clauses, certification).

5. Retention period

  • Quote requests that don't go ahead: 12 months from the last exchange, then automatic deletion.
  • Contractual data (signed clients): 10 years from the end of the contract, in accordance with French accounting and tax obligations (art. L.123-22 of the Commercial Code).
  • Technical logs (IP, anti-spam): less than 24 hours at the Worker's rate-limit level, then automatic deletion.
  • Anonymous statistics: aggregated and kept indefinitely, without allowing re-identification.

6. Your rights

In accordance with articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights over your data at any time:

  • Right of access: obtain a copy of the data concerning you.
  • Right to rectification: correct inaccurate or incomplete data.
  • Right to erasure: request the deletion of your data.
  • Right to restriction: temporarily restrict processing.
  • Right to object: object to processing based on legitimate interest.
  • Right to portability: retrieve your data in a structured, reusable format.
  • Post-mortem directives: define what happens to your data after your death.

To exercise these rights, write to contactus@riyatastudio.com stating the purpose of your request. A reply will be provided within a maximum of one month, in accordance with article 12 of the GDPR.

7. Cookies & trackers

The site uses no advertising tracking cookies or behavioural analytics, and performs no browser fingerprinting.

Only the Cloudflare Turnstile anti-spam service, present on the contact form, may set a strictly functional cookie to verify that you are not a robot. This cookie is exempt from prior consent under article 82 of the French Data Protection Act and the CNIL's guidelines (cookies strictly necessary for providing the service).

The theme preferences (light / dark) you choose are stored locally in your browser (localStorage). This information never leaves your device and is not sent to the server.

8. Security

The data exchanged with the site is encrypted end to end via HTTPS (TLS 1.3). The contact form is protected against automated attacks by Cloudflare Turnstile and per-IP rate-limiting. Emails are routed through Resend, which applies opportunistic TLS and signs every send via DKIM, SPF and DMARC from the riyatastudio.com domain.

In the event of a personal data breach, Riyata Studio undertakes to notify the CNIL within 72 hours and to inform the individuals concerned directly if the risk is high, in accordance with articles 33 and 34 of the GDPR.

9. Minors

The site and the services offered are aimed at an adult professional audience. No data is knowingly collected from minors. If you believe that a minor has submitted personal data via the site, please report it to the address above so that we can delete it.

10. Changes to this policy

This policy may evolve to reflect technical, legal or organisational changes. The date of the last update is shown at the top of the page. In the event of a substantial change, the individuals concerned will be informed by email where possible.

11. Complaint to the CNIL

If, after contacting us, you believe that your rights are not being respected, you may lodge a complaint with the French supervisory authority, the Commission nationale de l'informatique et des libertés (CNIL):