Privacy policy

3BeeStudio places the utmost importance on protecting your personal data. This policy explains what data we collect, why, how long we keep it and what your rights are.

1. Data controller

2. Data collected

When placing an order

• Identity and contact details: first name, last name, company where applicable, email address, phone number
• Delivery address, or the pickup point you select. No address is requested for studio collection, nor for an order made up solely of digital files
• Order contents, amounts paid, history and shipping status
• Payment data: entered directly with Stripe, it never passes through our servers and is not stored by 3BeeStudio

Depending on the type of order

• NFC keyrings: the logo you upload and the web address the chip should point to
• Custom projects: your project description, your indicative budget and deadline, and any reference file you attach
• Downloadable 3D files: the date and time you waived your right of withdrawal, which the law requires us to collect before any download

While browsing

• Cookieless audience measurement: pages viewed, duration, referrer, device type. No persistent identifier is placed in your browser (see section 7)
• Product page views: counted behind a hashed technical fingerprint that is rotated every night, used solely to avoid counting the same visit twice and unable to recognise you from one day to the next

Cart left awaiting payment

• When a payment is started then abandoned, your email address and the cart contents are kept so that you can find it again

Newsletter and messages

• Email address, and the content of your message where applicable

3. Purposes and legal bases

• Order processing (management, production, shipping, invoicing, after-sales service): performance of the contract
• Invoicing and accounting: legal obligation
• Newsletter: your consent, which you may withdraw at any time
• Reminder for a cart left awaiting payment: legitimate interest. A single email is sent, between 1 and 48 hours after abandonment, and never if you have asked not to receive them or have ordered in the meantime
• Site audience measurement: legitimate interest. Measurement is strictly internal, cookieless, never cross-referenced with other sites and never shared with advertisers
• Site security and fraud prevention: legitimate interest

4. Retention periods

• Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code)
• Order and delivery data: 5 years from the end of the commercial relationship
• Cart left awaiting payment: 90 days, then automatically deleted
• Newsletter subscription: until you unsubscribe, and at most 3 years after your last contact with us
• Audience statistics: 13 months. The technical fingerprint used to deduplicate visits is erased after 45 days
• Messages you send us: 3 years after the last exchange, unless they relate to an order

5. Recipients and processors

Your data is never sold, rented or transferred for advertising purposes. It is accessible to 3BeeStudio and only to the providers necessary to run the service:

• Stripe: payment processing (Stripe policy)
• Supabase: database and file storage (Supabase policy)
• Vercel: site hosting and cookieless audience measurement (Vercel policy)
• Resend: email delivery and newsletter list management (Resend policy)
• Boxtal and carriers: label generation and parcel delivery (name, address, phone)

6. Transfers outside the European Union

Stripe, Vercel and Resend are companies established in the United States. Transfers of data to these providers are governed by the European Commission's standard contractual clauses and, where applicable, by their certification under the EU-US Data Privacy Framework.

7. Cookies and trackers

This site displays no consent banner, because it places nothing that would require one. No advertising cookie, no social network pixel and no third-party measurement tool is installed on your device. The only information stored in your browser is essential to the service you request:

• Cart: kept in your browser's local storage so you find it again from page to page. It leaves your device only when you place the order
• Display language: a cookie remembers whether you browse the site in French or English
• Admin session: a cookie reserved for the site operator, never placed on visitors' devices

These fall under the consent exemption provided by article 82 of the French Data Protection Act, as interpreted by the CNIL.

Audience measurement. We measure site traffic without cookies and without any persistent identifier: nothing is written to or read from your device for this purpose. It serves only to improve the site, is never cross-referenced with other sites and is never shared with advertisers.

TikTok videos. Some pages offer videos hosted by TikTok. The player loads only after an explicit click from you: until you request the video, no connection to TikTok is made and no tracker is placed. By starting playback, you accept that TikTok places its own trackers, governed by its privacy policy.

Should we ever introduce online advertising or a third-party measurement tool, a consent banner would be shown beforehand and those tools would load only after your agreement.

8. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure: delete your data, subject to our accounting obligations
• Right to restriction: freeze a processing operation while a claim is examined
• Right to portability: receive your data in a machine-readable format
• Right to object: object to processing based on our legitimate interest
• Right to withdraw consent: at any time for the newsletter
• Post-mortem directives: set out what happens to your data after your death

Every cart reminder email carries a link to refuse any further reminder, in one click and without justification. Every newsletter carries an unsubscribe link.

To exercise these rights: contact@3beestudio.fr. We respond within one month. You may also lodge a complaint with the CNIL (French data protection authority).

9. Automated decision-making and profiling

No decision producing legal effects concerning you is taken by automated means, and no advertising profiling is carried out.

10. Security

We implement technical and organisational measures to protect your data: encrypted HTTPS connection, restricted and authenticated admin access, secure hosting. Payment data is processed directly by Stripe and never passes through our servers. Commercial documents (quotes, invoices) and the 3D files sold are kept in private storage, reachable only through time-limited signed links.

11. Contact

Given its size and the nature of its processing, 3BeeStudio is not required to appoint a data protection officer. For any question regarding your personal data:
contact@3beestudio.fr