Privacy Policy
Atelier Manoa
This policy explains how Atelier Manoa uses your personal data when you browse the website, communicate with our team, make bookings and make purchases. It also sets out your rights and how to exercise them.
1. Data controller
The Atelier Manoa website, available at https://ateliermanoa.fr, is operated by MANOA, a French simplified joint-stock company (société par actions simplifiée) with share capital of €20,000, registered under SIREN number 104 365 978, with its registered office at 140 route de la Reine, 92100 Boulogne-Billancourt, France.
MANOA is the controller for the processing described in this policy. If you have any questions about your data or wish to exercise your rights, you can write to contact@ateliermanoa.fr, or to our registered office, marking your correspondence “Personal data protection”.
2. Data collected and how it is used
We collect the information you provide to us and the technical data needed for the website to function. How we use it depends on the service requested.
- Contact enquiries and quotations. Your identity, contact details and message content allow us to respond to your requests. This processing is based on steps taken at your request before a booking or purchase, or on our legitimate interest in responding to other enquiries.
- Orders and bookings. We use your contact details, billing and delivery information, selected services or products, dates, participants and order references to perform the contract and manage follow-up. Data needed to handle requests after the service has been provided is used on the basis of our legitimate interest in maintaining the customer relationship.
- Participants registered by another person. We receive their identity and information relevant to their participation from the organiser. We use this information on the basis of our legitimate interest in preparing to welcome the group. Health information is subject to the specific rules in section 3.
- Customer account. If you create an account, we use your login details and associated information to provide this service, on the basis of the contract.
- Payments and accounting. Transaction data is used to process payments and refunds, on the basis of the contract. Invoices and supporting documents are retained to comply with our legal obligations.
- Newsletter. With your consent, we use your email address to send you our news and offers. Every message includes an option to unsubscribe.
- Security. Connection information, including IP addresses, dates, technical events and browser characteristics, is used to protect the website and handle incidents. This processing is based on our legitimate interest in ensuring the security of the service.
- Audience measurement. With your consent, Google Analytics helps us understand website traffic and usage, as described in section 9.
Mandatory fields are indicated in the forms. Without this information, we cannot process the request or provide the relevant service. All other information is optional.
When a third party registers you for a workshop, we provide you with this policy when we first communicate with you and, at the latest, within one month of receiving your data. The organiser is also asked to share it with you.
3. Information needed to accommodate your needs
You may tell us about any specific needs so that we can prepare for and adapt your visit. This information is optional and limited to what is necessary for your participation in the workshop.
Where this information reveals a disability, pregnancy or other health information, we use it with your explicit consent, in accordance with Articles 6 and 9 of the GDPR. This consent is separate from acceptance of the terms and conditions of sale. For a participant who is a minor, consent is obtained from their legal representative. Registering another adult does not remove the requirement to obtain that person’s consent.
This information is accessible only to the people who need it to arrange your visit. It is deleted after the workshop has taken place or the booking has been definitively cancelled. It is not used for marketing or audience measurement.
You may withdraw your consent by writing to us at the address given in section 1. Withdrawal does not affect processing carried out previously. We will explain any consequences this may have for the arrangements made to accommodate your needs.
4. Payments through Stripe
Online payments are processed by Stripe. The information required for the transaction is sent to Stripe to enable payment, payment follow-up and any refunds.
Stripe also processes certain data to prevent fraud and comply with its own legal obligations. Details of this processing are set out in its privacy policy.
Information about any specific arrangements you need for your visit is not sent to Stripe with payment data.
5. Recipients of the data
Your data is accessible to authorised members of the MANOA team, within the scope of their duties, and to the providers needed to deliver our services:
- Stripe, for payments and related services;
- Hetzner Online GmbH, for website hosting;
- Google, for audience measurement with Analytics via Google Tag Manager, after you have given your consent;
- our booking, email, maintenance and accounting providers, and carriers where your order requires delivery.
We limit the information shared to what is necessary for each task. Providers acting on our behalf are subject to confidentiality, security and data protection obligations.
Data may also be disclosed to authorities where required by law, or to our advisers to defend our rights. We do not sell your personal data.
6. Retention periods
We retain your data for the following periods, depending on how it is used:
| Data concerned | Retention period |
|---|---|
| Contact enquiries that do not lead to an order | Six months after the enquiry is closed. |
| Data needed for order and booking follow-up | During performance of the contract, then for three years after the workshop, delivery or definitive cancellation, to respond to requests relating to the order. |
| Information about arrangements for your visit that reveals health information | Until the workshop has taken place or the booking has been definitively cancelled. |
| Inactive customer account | Three years after the last login, with notice before the account is deleted. |
| Newsletter and marketing | For customers: for the duration of the business relationship, then for three years after it ends. For prospective customers: three years after collection or the last contact initiated by them. Messages stop as soon as consent is withdrawn. |
| Minimum data needed to honour an objection to marketing | Three years from the objection, solely to prevent further messages from being sent. |
| Invoices and supporting accounting documents | Ten years from the end of the relevant financial year. |
| Electronic contracts worth €120 or more | Ten years after conclusion if performance is immediate; otherwise, from conclusion until performance, then for ten years after performance. |
| Website security logs | Six months from recording, unless information needed to handle an incident is extracted. |
The retention periods specific to Google Analytics and cookies are set out in section 9.
Once these periods have expired, data is deleted or irreversibly anonymised. Only supporting records needed to comply with a legal obligation or defend legal claims are retained in restricted-access archives for the applicable statutory periods. This retention does not extend the use of the data for marketing.
If an incident occurs during a workshop, only the information needed to establish, exercise or defend legal claims is retained in the corresponding file. It does not remain accessible in day-to-day booking management.
7. Hosting and international transfers
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers used for the website are located in Germany, and backups are located in France, Germany and Switzerland. Stripe and Google services involve international processing, including in the United States. Depending on the recipient and service, these transfers are governed by a European Commission adequacy decision, including the EU–US Data Privacy Framework for the organisations and processing it covers, or by standard contractual clauses and the necessary supplementary measures.
You can consult Stripe’s data protection information and Google’s safeguards for international transfers. To find out which safeguards apply to your data or to obtain a copy, contact us at the address given in section 1.
8. Exercising your rights
Under the conditions set out in the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability.
You may object to processing based on our legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. Where processing is based on your consent, you may withdraw it at any time. You may also give instructions about what should happen to your data after your death.
To exercise your rights, write to the email or postal address given in section 1. We normally respond within one month. This period may be extended by two months if justified by the complexity or number of requests; in that case, we will inform you within the first month.
We only request additional information to verify your identity where there is reasonable doubt, and in a proportionate manner. A copy of an identity document is not systematically required.
You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority.
9. Cookies and audience measurement
Cookies are small files stored on your device when you visit a website. Some are strictly necessary to provide the service requested, for example for the shopping basket, login or payment security. They do not require your prior consent where they meet the statutory conditions for exemption.
We use Google Analytics via Google Tag Manager to measure website traffic and improve its content. This measurement is based on your consent. It covers, in particular, cookie identifiers, pages viewed, browsing events, the sources of visits, and technical characteristics of your device and browser.
Analytics measurement is activated only after you have given your consent. Refusing is as easy as accepting and does not prevent bookings or purchases. You can change your choice at any time using the cookie settings icon. Your acceptance or refusal is stored for six months.
The Analytics cookies _ga and _ga_<identifier>, used to distinguish visitors and maintain session state, expire no later than six months after they are set, without automatic renewal on each visit. Their lifespan may be shortened by your browser or by manual deletion.
Detailed Google Analytics user and event data is subject to a retention period of two months, without resetting user data retention when new activity occurs. Deletions take place according to Google Analytics’ monthly cycle. This setting does not apply to standard aggregated statistical reports.
We do not send Analytics your names or email addresses, text entered in forms, or information about participants’ health. Tracking is limited to audience measurement.
The names, providers, purposes and lifespans of other cookies used to operate the website can be found in the cookie manager.
10. Updates to this policy
This policy is updated when our services or data processing activities change. Changes requiring specific information to be provided or fresh consent to be obtained are accompanied by the corresponding measures.
Last updated: 15 September 2026.