Legal information

Privacy Policy

Update date : 02/07/2026

Version : 1.1

Introduction

Le LAB places the greatest importance on protecting your privacy and your personal data.

This privacy policy informs you transparently about how we collect, use, share and protect your personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who is responsible for your data?

Data controller

  • Name : Le LAB
  • Address : 104 route du Col de Richemont, 01260 Champagne-en-Valromey
  • Email : [email protected]
  • Phone : 04 58 11 03 35

2. What personal data do we collect?

2.1 Data collected during registration

Mandatory information :

  • Last name, first name
  • Email address
  • Phone number
  • Date of birth

Optional information :

  • Personal notes (allergies, specific needs)
  • Third-party learner information (if registering for a minor or a third party)

2.2 Data collected automatically

  • IP address : For security and proof-of-consent purposes
  • Cookies : See our cookie policy in the Legal notices
  • Connection logs : Date, time, pages visited (kept for 12 months max)

2.3 Audience measurement and acquisition source

We measure our site's audience with a privacy-friendly, self-hosted solution (Umami) that works without tracking cookies, collects no data that could identify you, and does not cross-reference your browsing with other sites.

When you reach our site from an external link (social media, newsletter, campaign) or a referring site, we record where you came from (UTM campaign parameters and the referring site's domain name — never the full address). If you complete a registration, this original source is kept with your registration in order to measure the effectiveness of our communication efforts.

Legal basis: our legitimate interest in understanding where our registrations come from and steering our communication. This (low-sensitivity) information is not used to profile you, nor shared with advertising third parties. You may object to this processing at any time by contacting us (see your rights below). The acquisition source is kept for the same duration as your registration.

3. Why do we collect your data?

We collect your data only for legitimate purposes:

Purpose Legal basis Examples
Registration management Performance of the contract Request processing, validation, follow-up
Course communication Performance of the contract Session reminders, schedule changes
Billing Contract performance + Legal obligation Issuing invoices, payments
Newsletter Consent Sending news, offers (if accepted)
Contact form Legitimate interest Reply to your requests (name, email sent by email, not stored in database)
Security Legitimate interest Fraud detection, data protection

4. With whom do we share your data?

Your data is shared only with:

4.1 Authorized staff

  • LAB administrators
  • Instructors involved in your classes
  • Customer support

4.2 Technical providers

Provider Service Location Safeguards
Mollie Online payments Netherlands (EU) PCI-DSS compliance
Cloudflare Anti-bot protection (Turnstile) USA / EU Standard contractual clauses (SCC), no tracking cookies
Railway Website hosting USA (data hosted in Amsterdam, EU) SOC 2 Type II, encryption at rest and in transit

We NEVER sell or rent your data to third parties.

5. How long do we keep your data?

Type of data Retention period Justification
Registration data 3 years after the end of the relationship Customer management, possible disputes
Billing data 10 years Legal accounting obligation (CGI)
Contact form No retention (email only) No storage in database, transmission by email
Connection logs 12 months Security, fraud detection
Cookies 13 months maximum CNIL regulation
Newsletter Until unsubscription or 3 years of inactivity Subscriber management

After these periods: Your data is permanently deleted or anonymized (statistics).

6. What are your rights?

In accordance with the GDPR, you have the following rights:

Right of access (Art. 15 GDPR)

You can obtain confirmation of the processing of your data and a copy of it.

Right of rectification (Art. 16 GDPR)

You can correct inaccurate or incomplete data.

Right to erasure (Art. 17 GDPR)

You can request the deletion of your data (except legal obligation).

Right to object (Art. 21 GDPR)

You can object to processing for marketing purposes (newsletter).

Right to portability (Art. 20 GDPR)

You can retrieve your data in a structured format (JSON, CSV).

Right to withdraw your consent

You can withdraw your consent at any time (newsletter, cookies).

7. How to exercise your rights?

By email (recommended)

Information to provide :

  • Last name, first name
  • Email used during registration
  • Nature of the request
  • Proof of identity (to secure the request)

Response time

We respond within 1 month maximum.

In the event of a complex or multiple request, this period may be extended by an additional 2 months with justification.

8. How do we protect your data?

We implement robust technical and organizational measures:

Technical measures

  • HTTPS encryption : All communications are encrypted (SSL/TLS)
  • Strong authentication : 6-digit OTP, secure sessions
  • Firewall and anti-virus : Server protection
  • Daily backups : Recovery in case of incident
  • Security updates : Regular patches

Organizational measures

  • Restricted access : Authorized staff only
  • Confidentiality clauses : All employees and providers
  • GDPR training : Staff awareness

13. Complaint to the CNIL

If you believe that your rights are not respected or that our data processing is not compliant, you can file a complaint with the CNIL:

French Data Protection Authority (CNIL)

Note : We encourage you to contact us first before any complaint, in order to resolve the issue amicably.

14. Contact

For any question regarding this privacy policy or the exercise of your rights:

  • Email : [email protected]
  • Postal address : 104 route du Col de Richemont, 01260 Champagne-en-Valromey
  • Phone : 04 58 11 03 35

Last updated : 07/03/2026

Version : 1.0

We remain at your disposal for any question regarding the protection of your personal data.

A question? Play with Labolo!

Labolo