Informative translation. The French version is the only legally binding one. Read the French version
Privacy policy
What data Soul Design collects, why, how long it is kept and how to exercise your rights.
Last updated: 20 October 2026.
SOUL DESIGN collects only the data needed for your request or order, keeps it only as long as necessary and entrusts it only to service providers bound by contract. This page explains what data we process, why, for how long and how to exercise your rights.
01 — Data controller
SOUL DESIGN, SAS, 33 rue Louise Michel, 3rd floor left, 92300 Levallois-Perret, France, RCS Nanterre 937 517 746, represented by its President, JOM TALENTS RECRUTEMENT LTD SARL (Mauritius), Mr Paul Guez being the person with authority to direct, manage or bind on a regular basis. Contact for any question about your data: paul@maisonsouldesign.fr.
SOUL DESIGN is not required to appoint a data protection officer (Article 37 GDPR): it is not a public body and its core activities consist neither of regular and systematic monitoring of individuals on a large scale nor of large-scale processing of sensitive data. Mr Paul Guez is the internal point of contact for data protection.
02 — Processing, purposes, legal bases and retention periods
| Purpose | Legal basis (Art. 6 GDPR) | Data | Retention period | Recipients |
|---|---|---|---|---|
| Operation and security of the website (technical logs, abuse prevention) | Legitimate interest: ensuring the security of the service | IP address, date and time, pages requested, browser | 6 months, then deletion | Technical team; hosting provider (Google Cloud / Firebase) |
| Creation and management of client and trade accounts | Performance of a contract (account terms of use) | Title, surname, first name, e-mail, telephone, addresses, hashed password (never stored in plain text), company and SIREN number for professionals | Until the account is deleted; accounts inactive for 2 years are deleted after notice | Soul Design team; Google (Firebase Authentication, Firestore) |
| Orders, payment, delivery, installation, take-back of used furniture, after-sales service | Performance of a contract | Identity, contact details, delivery address and access conditions, order contents, history, after-sales exchanges, photographs of defects you send us | Duration of the relationship, then archived for 5 years (limitation period, Art. 2224 French Civil Code and L. 110-4 French Commercial Code); contracts concluded online for €120 or more: 10 years from delivery (Art. L. 213-1 and D. 213-2 French Consumer Code); invoices: 10 years; access codes and door codes: deleted 3 months after delivery | Team; makers (name and delivery address only, when they ship directly); carriers and installers; compliance scheme for take-back; Stripe |
| Online withdrawal (“Withdraw from the contract here”) | Legal obligation (Art. L. 221-21 and D. 221-5 French Consumer Code) | Full name, e-mail, order number, items concerned, any details given, date and time of the declaration, acknowledgement sent, non-reversible hash of the IP address (security) | 5 years after the order (limitation period) | Team; Brevo (sending the acknowledgement); Google Cloud (hosting) |
| Online payment and payment fraud prevention | Performance of a contract; legitimate interest (fraud prevention) | Transaction data; card details are entered and stored exclusively by Stripe; the security code is never stored | Duration of the transaction; evidence kept for 13 months after debit (dispute period); Stripe’s own retention periods as payment service provider | Stripe Payments Europe Ltd (Ireland); banks |
| Project requests, briefs, appointments and quotes | Pre-contractual measures taken at your request (no consent box is required; the information appears under each form); legitimate interest for the source of the request | Contact details, type of space, floor areas, plans and photographs of the spaces, indicative budget, preferences, correspondence; source of the visit (campaign or referring website) where it appears in the address of the landing page or you have accepted audience measurement | 3 years from the last contact if no order is placed; otherwise as for orders | Team; makers consulted (without your contact details unless you agree); design partners appointed on the project |
| Space configurator and AI renderings (photo of your room, plan) | Consent (Art. 6(1)(a) GDPR), collected through an unticked box before anything is sent; can be withdrawn at any time | Photos and plans of the spaces you send, instructions entered, pieces chosen, renderings generated; IP address and technical log (non-reversible hash) | Photos and renderings: 30 days, then automatic deletion; attached to a project request: as for the request; technical log: 1 year | Google Cloud (Vertex AI, Paris and Belgium regions of the European Union); Black Forest Labs GmbH (Germany, European endpoint), as a fallback only. No transfer outside the European Union without your express consent. We do not use your photos to train models. |
| Project and client relationship management (internal tool “L’Atelier”: quotes, purchasing, logistics, invoicing, reporting) | Performance of a contract; legitimate interest (business management); legal obligation for invoicing | Identification and contact data, professional contacts, quotes, orders, invoices, notes of business exchanges | Duration of the relationship + 3 years for commercial management; accounting records 10 years | Team members authorised according to their role; chartered accountant; Google Cloud (hosting) |
| Client portal (project tracking, documents, plan approvals, delivery notes) | Performance of a contract | Login details, project documents, time-stamped approvals, messages | Duration of the project + 5 years (evidence) | Team; Google Cloud |
| “Soul Design Pro” team app: receipt, delivery and installation (photos, delivery note signature, reservations) | Performance of a contract (proof of delivery); legitimate interest (organising site work) | Name of the recipient, digitised handwritten signature, date and time, photographs of products and premises (without identifiable people as far as possible), reservations; for employees: identity, work carried out | Duration of the project + 5 years; employee data: duration of employment + 5 years | Team; Google Cloud |
| Newsletter and e-mail marketing to consumers | Consent (Art. L. 34-5 French Postal and Electronic Communications Code, CPCE), or legitimate interest for our customers regarding similar products, with the option to refuse at the point of collection | E-mail, first name, stated interests, open and click statistics | 3 years after your last contact with us; immediate unsubscription; address kept on a suppression list for 3 years | Team; Brevo (Sendinblue SAS, France) |
| Marketing to professionals (architects, interior designers, hoteliers, companies) | Legitimate interest; message related to the profession, with information and a right to object in every mailing (Art. L. 34-5 CPCE) | Name, position, company, business contact details, history of exchanges | 3 years after the prospect’s last contact with us | Team; Brevo; Google Workspace |
| Sales calls to consumers | Prior, free, specific and revocable consent (Art. L. 223-1 French Consumer Code) | Name, telephone, proof and date of consent | Period of validity of the consent; proof kept for 5 years | Team |
| Website audience measurement | Consent (Art. 82 of the French Data Protection Act; Art. 6(1)(a) GDPR); the website uses no consent-exempt measurement tool | Source of the visit (campaign, referring website, ad click identifier), version A or B of a campaign page, purchases already counted; with Google Analytics: tracker identifier, pages viewed, device, approximate location | Soul Design storage (sd_attribution, sd_ab_<page>): 90 days maximum, deleted as soon as you withdraw consent; Google Analytics trackers: 13 months maximum; audience data: 14 months | Soul Design team; Google Ireland Ltd / Google LLC (Google Analytics 4, planned, not installed at present), only if you consent |
| Advertising and campaign measurement (Google Ads, Meta, Pinterest, LinkedIn) | Consent (Art. 82 French Data Protection Act; Art. 6(1)(a) GDPR) | Tracker identifiers, browsing and purchase events, hashed e-mail or telephone sent at conversion, only if you have consented | Trackers 13 months maximum; consent choice kept for 6 months | Google Ireland Ltd; Meta Platforms Ireland Ltd; Pinterest Europe Ltd; LinkedIn Ireland Unlimited Company — each a joint controller for the collection. None of these tags is installed at present: they will only be installed after the cookie policy has been updated, and only with your consent. |
| Trade programme and trade account requests (architects, interior designers, companies) | Pre-contractual steps taken at your request; legitimate interest (checking the applicant’s professional status) | Name, position, company, SIREN, Order registration number for architects, business contact details, project references, agreed terms | 3 years after the last contact if nothing follows; otherwise duration of the relationship + 3 years; prescription agreement: 5 years after it ends (evidence) | Team; Google Cloud (hosting); Brevo (e-mails) |
| Maintenance, furniture take-back (“Second life”) and sample box requests | Pre-contractual steps taken at your request; performance of the contract | Contact details, address of the premises, inventory and photographs of the furniture concerned, preferred materials, sample box number | 3 years after the last contact if nothing follows; otherwise as for orders | Team; partner installers and upholsterers; reuse or donation organisations and the furniture take-back scheme (collection address and time slot only); Google Cloud |
| Financial lease application (companies) | Pre-contractual steps taken at the company’s request | Company name, SIREN, Kbis extract, latest accounts, name, contact details and identity document of the director, amount and term requested | Duration of the review, then 3 years if nothing follows; supporting documents deleted from our tools once sent to the lessor, at the latest 3 months after the request | Team; partner financing company, named in the lease offer, which decides on the financing as a separate controller (its own privacy policy applies) |
| Messages received via WhatsApp, the website contact button and advertising lead forms (Google, Meta, LinkedIn) | Pre-contractual steps taken at your request; legitimate interest (answering the person who writes to us) | Name, telephone or e-mail, message, website page you write from (without its parameters), channel used | 3 years after the last contact if nothing follows | Team; Meta Platforms Ireland Ltd (WhatsApp Business, Facebook and Instagram forms); Google Ireland Ltd and LinkedIn Ireland Unlimited Company (their forms); Make (European Union) or Zapier (United States) when used as a gateway; Google Cloud |
| Electronic signature of quotes | Performance of the contract and pre-contractual steps | Name, e-mail, telephone (verification code), signed quote, signature evidence file | Duration of the contract + 5 years; 10 years for a contract of at least €120 concluded online with a consumer (Art. L. 213-1 French Consumer Code) | Team; Youtrust (signature product: Yousign, France), once electronic signature is activated |
| AI-assisted drafting and analysis of requests (team tools) | Legitimate interest (preparing an answer, a quote or a layout faster, always reviewed by the team) | Content of requests, project notes, lists of pieces; never your full contact details when not needed | No retention by the providers beyond processing; technical log: 1 year | Google Cloud Vertex AI (Google’s Gemini and Anthropic’s Claude models, served by Google in the European Union); OpenAI Ireland Ltd as a fallback for text only, never for a photo or a plan |
| Internal team alerts (Telegram messaging) | Legitimate interest (handling a request quickly) | By default, no data that identifies you: type of event, channel, city or district, nature and size of the project, link to our internal tool | Not applicable by default (no personal data) | Team; Telegram (team messaging) |
| Handling requests to exercise rights | Legal obligation (Art. 12 to 22 GDPR) | Identity, request, reply; proof of identity only in case of reasonable doubt, deleted after verification | Time needed to handle the request, then 5 years as evidence | Data protection contact |
| Accounting and tax obligations (including e-invoicing) | Legal obligation | Invoices, payments, identity and SIREN number of business customers | 10 years (Art. L. 123-22 French Commercial Code) | Chartered accountant; approved e-invoicing platform; tax authorities |
Mandatory form fields are marked with an asterisk; without them we cannot process your request. We make no decision based solely on automated processing that produces legal effects concerning you. The website is not intended for children under 15.
Where we do not collect data from you directly, it comes from advertising forms you completed (Meta, Google, LinkedIn) or from public professional sources (your company website, directories, the trade register) (Article 14 GDPR).
03 — Service providers and transfers outside the European Union
Our service providers act as processors, on our instructions and under a contract compliant with Article 28 GDPR:
- Hosting and team tools: Google Cloud and Firebase (website hosting, databases, authentication, file storage), Google Workspace (team e-mail, documents and appointment calendar), OVHcloud (domain name registrar).
- Form protection: Google reCAPTCHA Enterprise via Firebase App Check (against automated submissions, no advertising use).
- Artificial intelligence: Google Cloud Vertex AI (configurator renderings and plan analysis, assisted drafting; Google’s Gemini and Anthropic’s Claude models, served by Google in the European Union), Black Forest Labs GmbH (Germany, configurator renderings as a fallback), OpenAI Ireland Ltd (text fallback, never a photo or a plan).
- Payment, accounting: Stripe (payment), Qonto (banking, invoicing and e-invoicing, approved platform, France).
- Communicating with you: Brevo (e-mail delivery, France), Youtrust (Yousign electronic signature product, quotes, France, planned), Meta Platforms Ireland Ltd (WhatsApp Business and advertising lead forms, if you contact us through these channels), Zernio (publishing and messages on our social networks, planned), Make (European Union) and Zapier (United States), gateways between advertising lead forms and our tools, if used.
- Internal alerts: Telegram (team messaging), which by default receives no data that identifies you.
- Maintenance: WEBAMMS (technical maintenance of the website and tools, France), which accesses data only for that maintenance.
The databases are hosted in the European Union, europe-west9 (Paris) region. Manufacturers, carriers, installers, the furniture take-back scheme and, for a financial lease, the partner financing company receive only the data they need, as separate controllers.
Some providers, and the advertising networks once their tags are installed, belong to groups established in the United States (Google LLC, Stripe Inc., Meta Platforms Inc., Pinterest Inc., LinkedIn Corporation, OpenAI, Zapier Inc.) and may access data from that country. These transfers rely on the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework for certified companies and, failing that, on the Commission’s standard contractual clauses (Article 46 GDPR), supplemented by security measures (encryption in transit and at rest).
Telegram is operated from a country that does not benefit from an adequacy decision. This is why our Telegram alerts contain, by default, no personal data. Should we decide to include your first name and the initial of your surname, we would first update this page and frame that transfer in accordance with Articles 44 to 49 GDPR.
04 — Security
Access to our tools is personal, protected by strong authentication for the team and restricted according to role; exchanges are encrypted (HTTPS); databases are backed up regularly; database access rules prevent one client from viewing another’s data. In the event of a data breach posing a risk to your rights, we notify the CNIL (the French data protection authority) within 72 hours and, if the risk is high, we inform you (Articles 33 and 34 GDPR).
05 — Your rights
You have the right to access, rectify, erase, restrict and port your data and to object to its processing, in particular an unconditional right to object to direct marketing. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of prior processing. You may also set out instructions regarding what happens to your data after your death (Article 85 of the French Act of 6 January 1978).
To exercise your rights, write to paul@maisonsouldesign.fr or to SOUL DESIGN, 33 rue Louise Michel, 3rd floor left, 92300 Levallois-Perret, France. We reply within one month, which may be extended by two months for complex requests; we would then let you know within the first month. Every marketing e-mail contains an unsubscribe link.
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
06 — Cookies and trackers
The use of cookies and other trackers, and how to change your choices, are set out in our cookie policy. Audience measurement and advertising trackers, including Soul Design’s own storage that remembers the source of your visit or the version of a campaign page, are only placed with your consent.
07 — Changes to this policy
We may update this policy, in particular when adding a tool or service. The date of the latest update appears at the top of the page; in the event of a significant change, we will inform you by e-mail or by a message on the website.