Privacy Policy

Why this policy applies

Panache is incorporated in Hong Kong and operates with a team based in Paris, France. Because we have an establishment in the European Union and offer services to persons located in the EU, EU Regulation 2016/679 (GDPR) applies to our processing of personal data.

Data controller

The controller of personal data collected on this website is:

Jurisdiction

Hong Kong Special Administrative Region, China

Operational base

Paris, France

Contact email

[email protected]

Data collected

When you submit the contact form, we collect the following information:

• Name — required, to identify you in our exchange.
• Company — optional, to understand your project context.
• Email address — required, to reply to you.
• Phone number — required, to reach you if needed.
• Budget range — optional, selected from a list, to guide our first response.
• Campaign parameters (UTM) — collected automatically from the landing URL if present, to measure the effectiveness of our outreach (legal basis: legitimate interest, Art. 6.1.f GDPR).

No other data is collected via the form. An invisible honeypot field detects automated submissions; it contains no information about you.

Purposes and legal bases

Responding to your enquiry

Processing your name, email, phone and company to conduct the conversation about your project.
Legal basis: performance of pre-contractual measures at your request (Art. 6.1.b GDPR).

Attribution measurement

Processing UTM parameters to understand which communication led to your enquiry and improve our outreach.
Legal basis: legitimate interest of Panache in measuring the effectiveness of its commercial activities (Art. 6.1.f GDPR), with no significant impact on your privacy.

Retention

Your data is kept for 24 months from your last interaction with us. This period reflects our commercial cycle and does not exceed what is necessary for the purposes described above.

After this period, your data is deleted or anonymised.

Where your data is stored and who processes it

Your data is never sold or shared with third parties for their own purposes.

Form submissions are forwarded to OpenLabor, where they are recorded so we can follow up on your enquiry, and a notification email is sent via AgentMail. Both act as data processors on our behalf within the meaning of Art. 28 GDPR. Data is accessible only to authorised Panache personnel handling your enquiry.

Sub-processors

Cloudflare, Inc.

Website hosting, serverless functions, web analytics.
101 Townsend Street, San Francisco, CA 94107, United States.

OpenLabor

Storage of enquiries submitted through the contact form.
openlabor.ai

AgentMail

Transactional email delivery (notification and acknowledgement).
United States

International transfers

Cloudflare, OpenLabor and AgentMail may process data outside the European Economic Area, including in the United States. These transfers are covered by the Standard Contractual Clauses adopted by the European Commission (Art. 46.2.c GDPR). For Cloudflare, see cloudflare.com/privacypolicy.

Panache is incorporated in Hong Kong, which does not benefit from an EU adequacy decision (Art. 45 GDPR). Data may be accessed from Hong Kong for business management purposes. Such transfers rely on Standard Contractual Clauses or, where the transfer is necessary to take steps prior to entering into a contract with you, on Art. 49.1.b GDPR.

Analytics

This website uses Cloudflare Web Analytics, whichsets no cookies and collects no personally identifiable data (no full IP address, no device fingerprint). No consent banner is required for this purpose alone.

Your rights

Under the GDPR, you have the following rights regarding your data:

• Right of access (Art. 15) — obtain confirmation that data about you is processed and receive a copy.
• Right to rectification (Art. 16) — have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17) — request deletion of your data, subject to applicable conditions.
• Right to restriction (Art. 18) — have processing frozen while a dispute is pending.
• Right to object (Art. 21) — object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Right to portability (Art. 20) — receive your data in a structured, machine-readable format, for processing based on contract or consent.

To exercise any of these rights, write to [email protected] stating the nature of your request. We will respond within one month (Art. 12 GDPR).

Complaint to a supervisory authority

If you believe that the processing of your data infringes your rights, you may lodge a complaint with the French data protection authority (CNIL), competent for our Paris establishment:

You may also contact the supervisory authority of your EU country of residence.

Security

Panache implements appropriate technical and organisational measures to protect your data against unauthorised access, loss or accidental disclosure. All communications between your browser and this website are encrypted by TLS.

Policy updates

Panache reserves the right to update this Privacy Policy to reflect regulatory changes or changes in our practices. The date at the bottom of this page shows the latest revision. In the event of a material change, we will notify you by email if you are in active correspondence with us.