Last updated: July 2026
1. Who we are
This website is operated by Katitart Studio, a web design and branding service based in France, owned and managed by Katherine Famiglietti.
Business name: Katitart Studio
Location: France
Contact: katherine@katitart.com
Website: katitart.com
As a service provider established in France and operating within the European Union, Katitart Studio is subject to the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and the French Data Protection Act (Loi Informatique et Libertés).Dos notas importantes antes de entregarte el documento:
Google Analytics: Te recomiendo activar la anonimización de IP en GA4 antes de publicar el sitio — es un requisito de la CNIL francesa. En GA4 ve a Admin → Data Settings → Data Collection y activa IP anonymization. Si no lo haces, técnicamente estás transfiriendo datos personales a Google sin la protección adecuada.
Cookie banner: Con GA4 activo necesitas un cookie banner que solicite consentimiento antes de cargar Analytics. Sin él, la política que firmas a continuación no se cumple en la práctica. Te recomiendo el plugin Complianz o Cookie Yes para WordPress.
2. What data we collect and why
We only collect personal data that is strictly necessary for the purposes described below. We do not collect data speculatively or for purposes beyond what is stated here.
2.1 Contact form (WP Simple Forms)
When you submit the contact form on this website, we collect:
- Your name
- Your email address
- Your type of business (if provided)
- The service you are interested in (if provided)
- Any information you voluntarily include in the project description field
This form is powered by WP Simple Forms, a WordPress plugin that processes form submissions on our server.
Purpose: To respond to your enquiry and assess whether we are a good fit to work together.
Legal basis: Legitimate interest (Article 6.1.f GDPR).
Retention period: Contact form submissions are retained for a maximum of 2 years, after which they are permanently deleted.
2.2 Discovery call booking (Brevo)
When you book a discovery call, your data is processed through Brevo (formerly Sendinblue), a French email and CRM platform. The information collected may include your name, email address and any details you provide during the booking process.
Purpose: To schedule and manage the discovery call.
Legal basis: Pre-contractual measures (Article 6.1.b GDPR).
Retention period: Booking data is retained for the duration of our potential or active business relationship, plus 1 year.
2.3 Email newsletter (Brevo)
If you subscribe to our newsletter, we collect your name and email address through an opt-in form on this website. Subscription is always voluntary and requires your explicit consent.
Purpose: To send you updates, resources and insights relevant to wellness brands and web design.
Legal basis: Consent (Article 6.1.a GDPR).
Retention period: Subscriber data is retained for as long as you remain subscribed. You may unsubscribe at any time via the link included in every email, after which your data will be deleted within 30 days.
2.4 Website analytics (Google Analytics 4)
This website uses Google Analytics 4 to understand how visitors interact with our content. Google Analytics collects data such as pages visited, time spent on site, device type, browser type and approximate geographic location. IP addresses are anonymised before processing.
Purpose: To improve the website experience and understand which content is most useful to visitors.
Legal basis: Consent (Article 6.1.a GDPR) — analytics cookies are only placed after you have given explicit consent via our cookie banner.
Retention period: Analytics data is retained for 14 months, after which it is automatically deleted by Google.
Data transfer: Google Analytics may transfer data to servers outside the EEA. Google LLC is certified under the EU-U.S. Data Privacy Framework, which provides adequate safeguards for such transfers.
Google Privacy Policy
Google Analytics Data Processing Terms
2.5 Website technical data
Like all websites, this site automatically collects certain technical data when you visit, including your IP address, browser type, pages visited and time of visit. This data is processed by our hosting provider.
Purpose: To ensure the website functions correctly and securely.
Legal basis: Legitimate interest (Article 6.1.f GDPR).
Retention period: Server logs are retained for a maximum of 12 months.
3. Cookies
This website uses both essential cookies and, with your consent, analytics cookies.
Essential cookies — always active
These cookies are necessary for the website to function and cannot be disabled:
- WordPress session cookies
- Elementor cookies
- WP Simple Forms cookies
Analytics cookies — only with your consent
These cookies are placed only after you have given explicit consent via our cookie banner:
- Google Analytics 4 cookies (_ga, ga*, _gid) — used to collect anonymised usage statistics
You can manage your cookie preferences at any time by clicking the cookie settings link in the footer of this website. You can also control cookies through your browser settings, though disabling essential cookies may affect website functionality.
4. Third-party services
We use the following third-party services that may process your personal data:
WordPress — website platform
Privacy Policy
Elementor — page builder plugin
Privacy Policy
WP Simple Forms — contact form plugin
Privacy Policy
Rank Math — SEO plugin
Privacy Policy
Brevo (formerly Sendinblue) — email, CRM and booking management. A French company subject to GDPR.
Privacy Policy
Google Analytics 4 — website analytics, provided by Google LLC
Privacy Policy
We do not sell, rent or trade your personal data to any third party beyond the services listed above.
5. International data transfers
Most of our data processing takes place within the European Economic Area (EEA). The following exceptions apply:
Google Analytics 4 — Google LLC is based in the United States. Data transfers are covered by the EU-U.S. Data Privacy Framework and Google’s Standard Contractual Clauses, which provide adequate safeguards under GDPR Article 46.
Brevo — a French company with servers located within the EEA. No international transfer applies.
For all other services listed in this policy, data is processed on our hosting server within the EU.
6. Your rights under the GDPR
As a data subject under the GDPR, you have the following rights:
Right of access — Request a copy of the personal data we hold about you.
Right to rectification — Request correction of inaccurate or incomplete data.
Right to erasure — Request deletion of your personal data, subject to certain legal exceptions.
Right to restriction of processing — Request that we limit processing of your data in certain circumstances.
Right to data portability — Receive your data in a structured, machine-readable format.
Right to object — Object to processing based on legitimate interest at any time.
Right to withdraw consent — Where processing is based on consent (analytics, newsletter), withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, contact us at katherine@katitart.com. We will respond within 30 days in accordance with GDPR Article 12.
7. Right to lodge a complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority.
In France:
CNIL — Commission Nationale de l’Informatique et des Libertés
Website: www.cnil.fr
Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
8. Data security
We implement appropriate technical and organisational measures to protect your personal data, including:
- SSL/TLS encryption on all pages of this website
- Restricted access to personal data
- Regular security updates for all plugins and software
- Secure hosting infrastructure within the EU
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the CNIL within 72 hours and affected individuals without undue delay, in accordance with GDPR Articles 33 and 34.
9. Children’s privacy
This website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at katherine@katitart.com and we will delete it promptly.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, tools or legal requirements. The date at the top of this page indicates when it was last updated.
If we make significant changes that affect your rights, we will notify newsletter subscribers by email where possible. We encourage all visitors to review this policy periodically.
11. Contact
For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data:
Katitart Studio
katherine@katitart.com
France