Business and contact information
Article 13(1)(e) of the GDPR requires that you are told who receives your personal data. Most privacy notices satisfy that by listing categories — “hosting providers”, “payment processors”. This page names them instead, because a category tells you nothing you can act on.
| Recipient | What it handles | Where | Role |
|---|---|---|---|
| Hostinger International Ltd | Website hosting, the database, server logs, form submissions in transit | Cyprus / EEA | Processor |
| Payment service provider | Card details, the transaction, fraud checks. Card numbers never reach Tomas Strigac. | EEA | Independent controller |
| Email provider | Correspondence, briefs you send, finished work returned to you | EEA | Processor |
| Accountant | Invoices and accounting records | France | Processor |
| Tax authorities | Statutory reporting | France | Own legal basis |
Where a specific provider is not yet named above, its identity is available on request from info@tomasstrigac.com and this page is updated when it changes.
This list is short and it is exhaustive:
The text you send is the most sensitive thing handled here, so it is worth being precise about what happens to it.
If your text contains special category data under Article 9 GDPR — health, ethnicity, political or religious views, trade union membership, sexual orientation — tell us when you order, so the additional care it requires can be applied from the start.
Processing takes place inside the European Economic Area wherever possible. Where a provider processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission, or by Standard Contractual Clauses adopted under Article 46 GDPR with the additional safeguards required. A copy of the safeguards in place is available on request from info@tomasstrigac.com.
| Data | Kept for | Why |
|---|---|---|
| Documents you send | 12 months, or less on request | So revisions and queries remain possible |
| Enquiries with no order | 12 months from last contact | So a later enquiry has context |
| Order and client records | 3 years after the last order | Contractual and dispute period |
| Invoices and accounts | 10 years | Art. L123-22 French Commercial Code |
| Server logs | 12 months | Security and diagnostics |
| Cookie consent records | 6 months | Proof of consent under CNIL guidance |
You can ask at any time for your data to be deleted, corrected, restricted, or sent to you in a portable format. Write to info@tomasstrigac.com. A response is provided within one month and there is no charge.
Where a legal retention period applies — invoices, principally — that specific record cannot be deleted before the period ends. You will be told exactly which record and exactly when it expires, rather than being given a general refusal.
In the event of a personal data breach likely to result in a risk to your rights, the CNIL is notified within 72 hours as Article 33 GDPR requires, and you are told directly where the risk is high. You will be told what happened, what data was involved and what is being done — not a generic notice.
Any question about data: info@tomasstrigac.com. Questions about this page are answered within 2 business days, like everything else.