Privacy Policy

Data Controller

The Citadel — ÉPOPÉE Group

66 Rue du Lieutenant Ricard, 78400 Chatou, France

Email : contact@citadel-epopee.com

SIREN 999 058 829 — RCS Versailles

Data Collected

We collect the following data only when you voluntarily submit it: name, email address, project description, payment information (via our subprocessor Stripe). No data is passively collected for advertising tracking.

Purpose of Processing

Data collected is used to: (i) respond to your contact request, (ii) process your order and collect your deposit, (iii) perform the ordered service, (iv) ensure site security (anti-bot protection), (v) measure audience anonymously.

Legal Basis

The processing of your data is based on: your consent (contact form), contract execution (payment and service), and our legitimate interest in securing the site and measuring its audience.

Subprocessors

To operate, we rely on the following subprocessors, each GDPR-compliant:

• Vercel Inc. (United States) — Website hosting and anonymous analytics.
• Stripe Payments Europe Ltd. (Ireland) — Secure online payment processing. No banking data transits through or is stored on our servers.
• Resend Inc. (United States) — Transactional email delivery.
• Cloudflare Inc. (United States) — Anti-bot protection (Turnstile) on our forms.
• Google LLC. (United States) — Web fonts delivery (Google Fonts).

Data transfers outside the European Union are governed by the European Commission's Standard Contractual Clauses.

Retention Period

Your personal data is retained for a maximum period of 12 months from your last contact with us, unless a legal or accounting obligation requires otherwise (10 years for accounting documents).

Your Rights

In accordance with the GDPR, you have the following rights: access, rectification, deletion, processing restriction, portability, objection. To exercise these rights, write to contact@citadel-epopee.com. We respond within 30 days maximum.

Cookies

Our site only uses cookies strictly necessary for technical operation and security (Cloudflare anti-bot protection). Vercel Analytics uses an anonymised audience measurement system (no individual tracking cookies). No advertising cookies, no third-party trackers.

Security

We implement appropriate technical and organisational measures to protect your data: TLS encryption, input sanitisation, anti-bot protection, access limitation.

Complaint

If you believe that the processing of your data does not comply with regulations, you may file a complaint with the CNIL (French Data Protection Authority) — cnil.fr.