Privacy policy.
Version v5-prestataires
Data controller
STUDIO CAFFÉ SAS (Caffé Club brand), 1348 avenue de la Mer-Raymond Dugrand, 34000 Montpellier, France, is the controller of the data collected on the website and in the member account. Contact: hello@caffeclub.fr.
Data collected and legal bases
The forms collect the following data:
| Form | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact | Subject, full name, email, message; phone and company if you provide them | Replying to your request | Pre-contractual steps taken at your request, or legitimate interest in replying to messages received |
| Partnership (schools, brands, artists, press) | Subject, full name, email, message; phone and organisation if you provide them | Considering your proposal and replying to you | Pre-contractual steps taken at your request, or legitimate interest in replying to messages received |
| Coworking pre-registration | Full name, email, intended package, profession; phone, activity, website or portfolio, preferred start month and message if you provide them | Considering your pre-registration and offering you a meeting | Consent |
| Notification of the coffee launch | Writing to you when the club’s coffee comes out | Consent | |
| Club newsletter | Sending you the club newsletter | Consent |
Each submission also records the language and address of the page it was sent from and, if any, the campaign parameters of that address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), so that we know how you found us.
For a sign-up based on consent, the exact text of the ticked box, its version and the date of your agreement are kept: this is the proof of what you accepted. You can withdraw your agreement at any time by writing to hello@caffeclub.fr.
A contact or partnership request does not sign you up to the club newsletter: no box is ticked on your behalf.
Online studio booking
To book the studio, we record your full name, email, phone number, the number of people, the type of project, the time slot and options chosen and the language of the page. For a business booking: the company name, and the SIREN and purchase order if you provide them. If you tick the “film crew” box, your message is passed to our team once the booking is paid.
The billing address and the intra-Community VAT number are requested by Stripe on the payment page, then copied into your booking and your invoice.
Purposes and legal bases: performing your booking (time slot, payment, invoice, any refund) under the contract, and keeping accounting records under a legal obligation.
Proof of your acceptances: for each box of the terms, we keep the exact text accepted and its version, the date, a pseudonymised value of your IP address (the same keyed hash function as above, the address itself is never stored) and your browser, truncated. These items are archived for 10 years with the contract (article 25.2 of the terms).
Payment is processed by Stripe, which acts as payment service provider. We never see or keep your card number. We keep the references of the session and of the payment and the events Stripe sends us (payment status, refunds), for as long as needed to follow your booking. With your express agreement (second box), the card used is saved with Stripe for the sole fees provided for in article 10 of the terms.
Messages after your session
After your session, we send you a thank-you message, which may invite you once to share your opinion. If you have booked, we may also email you to suggest another studio session, a service similar to the one you bought. If you book as a business and do not complete your booking, a reminder may be sent to you; no such reminder is sent to an individual.
Legal basis: our legitimate interest in making our offers known to our customers. You can object at any time and at no cost, with the link in each message or by writing to hello@caffeclub.fr. This data is used for this purpose for 3 years after your last booking or last contact.
Member account and subscriptions
Your account uses your email address, your name if provided, your language, bookings, subscriptions, invoices and studio-hour transactions. It lets you view and manage these services. Payment and subscription references are kept to administer them; card details remain with Stripe.
You sign in using an emailed link: a requested link expires after 20 minutes; a link included in a transactional email lasts 7 days. Each link can be used once. We store its fingerprint, dates and destination, together with session creation, last-activity and revocation dates and truncated browser information. Administration of your services is based on performance of the contract; access protection is based on our legitimate interest in securing your data.
Login links, member sessions and session-specific access records are deleted from the database 30 days after expiry; for member sessions and session-specific access revoked earlier, that period starts at revocation. The last sign-in date remains on the account after this cleanup.
After at least 3 years without activity, the account is pseudonymised: its name and customer-record link are removed, its email is replaced with a protected fingerprint and access is revoked. This is deferred while a subscription, booking, usable hours, sign-in or pending operation requires the account to remain active. Contractual and accounting documents and the hours ledger retain their own retention periods: this does not erase all personal data.
This 3-year period matches the length of our business relationship with you: your account gives access to your invoices, bookings and hours.
Protection against abusive submissions
To limit abusive submissions (bots, bursts), the IP address of each submission is transformed by a hash function with a secret key. The IP address itself is never stored: only this pseudonymised value is, and it is used for this protection only.
Hourly submission counters are deleted after 48 hours. The pseudonymised value stored with a request or a sign-up is kept for 90 days, then erased.
Recipients
Your data is read by the STUDIO CAFFÉ SAS team and stored in its request tracking tool. It is never sold. It is hosted by technical providers acting on our instructions:
- Vercel Inc. (website hosting; servers in Dublin, Ireland; company established in the United States);
- Supabase (database hosted in the European Union; possible access from abroad for technical support);
- Cloudflare (encrypted database backups, stored in the European Union; company established in the United States);
- Resend (sending of e-mails: confirmation, reminders, newsletter), United States;
- Brevo (sending of the reminder text message the day before the session), a company established in France;
- Stripe (online payment of bookings), which also processes some data as controller of its own processing (fraud prevention, banking obligations);
- Google, if you choose “Sign in with Google”: Google identifies you and only sends us your verified email address; Google also provides the team calendar;
- Google (Ireland; possible transfer to the United States, Data Privacy Framework), for audience measurement and advertising, only if you accepted it in the cookie banner;
- Meta Platforms Ireland Limited (Ireland; possible transfer to the United States), for advertising, once the service is activated and only if you accepted it in the cookie banner.
Some providers are established in the United States or may access data from abroad. These transfers rely on the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) for US providers certified under it and, in other cases, on the European Commission standard contractual clauses. You can obtain a copy of these safeguards by writing to hello@caffeclub.fr.
Retention periods
- Contact and partnership requests: 3 years after the last contact;
- Unaccepted coworking applications: 12 months after the last activity;
- Coffee list: until the opening concerned, then 1 year;
- Club newsletter: until you unsubscribe;
- Bookings, proof of acceptance and accounting records: 10 years, in a restricted-access archive;
- Customer data used to suggest new sessions: 3 years after your last booking or last contact;
- Studio check-in and check-out photos: 6 months after the booking; if fees were charged, 13 months after they were debited; in the event of a dispute, until it is resolved;
- Encrypted database backups: 90 days at most; erased data may remain in them until then;
- Messages sent (e-mails and text messages): the content is erased after 90 days, then the address, phone number and subject are erased after 365 days; technical sending events (delivery, bounce) are deleted after 90 days; the information about any fees remains stored with the file;
- Pseudonymised value of the IP address: 90 days; submission counters: 48 hours;
- Cookie choices (proof of your consent or refusal): 13 months;
- Campaign attribution attached to an application or contact/partnership request, without advertising identifiers: 13 months;
- Source of your visit and Google click or session identifiers attached to a booking: 90 days (the acquisition channel is kept without these identifiers).
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time and the right to give instructions on what happens to your data after your death. Write to hello@caffeclub.fr or to STUDIO CAFFÉ SAS, 1348 avenue de la Mer-Raymond Dugrand, 34000 Montpellier, France. We reply within one month, which may be extended by two months for a complex request; you are then informed within the first month.
You can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.