Privacy and cookie policy

Data controller

The data controller is NOP AGENCY, a French SASU with share capital of €100.00, 20 rue des Vergetiers, 76000 Rouen, France. RCS Rouen 940 034 572. SIRET 940 034 572 00021. VAT FR30940034572.

Managing director: Nicolas Papin, president, freelance 3D artist in Rouen.

Contact for any question about your data: 3d@nicolaspapin.fr. Nicolas Papin handles requests himself.

In short

• Your name, email and message are used to answer your quote request, then to contact you again about your 3D projects.
• Your data is never sold.
• It is kept for 3 years after our last exchange.
• Google Analytics loads only after you click "Allow analytics".
• Before you choose, or after you decline, no analytics cookie is set and no request is sent to Google.
• Video players load only on click, and the anti-bot check only around the form.
• No advertising, no resale, no automated decisions.

Quote requests (form, email, WhatsApp)

Purpose: to answer your request, prepare a quote, then contact you again about your 3D projects.

Form data: name, email, need, message (optional) and the page of the site the request comes from. By email or WhatsApp: whatever information you choose to send.

Your name, email and need are required to answer you. Without them, the request cannot be handled. The message is optional.

Legal bases: steps taken at your request before entering into a contract (GDPR, Art. 6(1)(b)) for the reply and the quote. The legitimate interest of NOP AGENCY (Art. 6(1)(f)) for follow-ups. Follow-ups concern requests sent in a professional capacity and relate to your business. The form is for business requests only: a request sent by a private individual is not handled, and its data is not reused.

Right to object: you can ask not to be contacted again at any time, without giving a reason, by writing to 3d@nicolaspapin.fr.

How it works: the form sends an email to 3d@nicolaspapin.fr through the mail service of the host, Hostinger. The site does not save the message on its server: it is kept in the 3d@nicolaspapin.fr inbox.

Retention: 3 years after our last exchange. If a contract is signed, this data is processed to perform the contract (Art. 6(1)(b)) and to meet accounting and tax obligations (Art. 6(1)(c)). Accounting and contract records are then kept for the periods required by law.

Recipients: see "Who receives your data" below. If you write via WhatsApp, the exchange also goes through that service, under its own terms.

Form security (Cloudflare Turnstile)

Purpose: to protect the form from automated submissions by bots.

Legal basis: the legitimate interest of NOP AGENCY in securing its form (GDPR, Art. 6(1)(f)). This check is used only to secure the sending of the message.

How it works: the Cloudflare script (challenges.cloudflare.com) loads only when you approach the form on the home page or open the quote panel. The check stays invisible unless Cloudflare has a doubt; it then asks you for an action.

Data: Cloudflare analyses technical signals from your browser to tell a human from a bot. The website server sends Cloudflare the verification token and your IP address to confirm the result.

Recipient: Cloudflare, provider of the check.

Submission rate limiting

Purpose: to prevent repeated bursts of submissions.

Legal basis: legitimate interest in protecting the service (GDPR, Art. 6(1)(f)).

How it works: the server does not keep your IP address in clear. It computes a fingerprint (SHA-256, with a secret key held by the server), used as the name of a temporary file. That file contains only the time of the last submission. A new submission from the same address is refused for 45 seconds. This fingerprint is still personal data, in pseudonymised form.

Retention: the file is deleted at the next submission made more than one hour later. If no one submits the form again, it stays until the host cleans the server's temporary space.

Recipient: none. The file stays in the server's temporary space, at the host.

Audience statistics (Google Analytics 4)

Purpose: to measure page traffic and count quote requests sent, in order to improve the site.

Legal basis: your consent (GDPR, Art. 6(1)(a); French Data Protection Act, Art. 82). Without consent, Google Analytics is not loaded.

Data: pages viewed, browsing events, technical information about the device and browser, a random identifier stored in a cookie. When the form is sent successfully, a "generate_lead" event only signals that a request was sent, without its content.

Cookies: _ga and _ga_ followed by the measurement ID, set only after your consent, for 13 months at most.

Settings: only audience measurement is allowed. Advertising permissions (ad_storage, ad_user_data, ad_personalization) remain denied. Google signals and user-provided data collection are not enabled.

Retention at Google: 2 months for event data, 14 months for user-level data.

Recipient: Google, audience measurement provider.

Videos (Vimeo, Adobe Behance)

Some projects are shown in a Vimeo player. The player loads only when you click to start the video. Before that click, nothing is requested from Vimeo.

The Vimeo player is called with the dnt=1 parameter, which asks Vimeo not to track your viewing.

One project uses Adobe's Behance video player, which also loads only on click.

Once the video starts, Vimeo or Adobe processes the data needed to stream it, under its own privacy policy.

Storage in your browser

The site itself sets no cookie. It uses your browser's local storage for a few strictly necessary or preference features, which do not require consent. This information stays on your device and is not sent to us.

• Your analytics choice (np-analytics-consent-v1): kept for 6 months, then asked again.
• Your chosen language and sound setting (on or off).
• For the visit only (sessionStorage): navigation between pages, including the return to the projects, the answers given in the estimate tool, and the quote form draft (name, email, message), cleared once sent.

You can clear this information at any time in your browser settings.

Hosting and technical logs

The site is hosted by Hostinger International Ltd, 61 Lordou Vironos, 6023 Larnaca, Cyprus.

The host, Hostinger, may record technical connection logs (for example the IP address and the page requested) to run and secure the service. Legal basis: legitimate interest (GDPR, Art. 6(1)(f)). Their retention period is set by the host.

Who receives your data

Your data is never sold or rented. Only Nicolas Papin and the necessary technical providers can access it, each for its own task only:

• Hostinger: website hosting and sending form emails.
• Cloudflare: anti-bot check on the form.
• Google: analytics, only if you allow it.
• Vimeo and Adobe: video playback, only if you start a video.

Transfers outside the European Union

Hostinger International Ltd is based in Cyprus, in the European Union.

The involvement of Google, Cloudflare, Vimeo and Adobe may lead to data being transferred outside the European Union, in particular to the United States. Such transfers must rely on a safeguard provided by the GDPR: the EU-US Data Privacy Framework adequacy decision for companies that participate in it, or the European Commission's standard contractual clauses. To learn more about these safeguards, write to 3d@nicolaspapin.fr.

For analytics and videos, these transfers only happen if you allow analytics or start a video.

Managing your consent

On your first visit, a banner offers two buttons of equal weight: "Essential only" and "Allow analytics". Declining is as easy as accepting.

Until you choose, Google Analytics is not loaded and no analytics cookie is set.

You can change your mind at any time with the "Analytics settings" button at the bottom of every page. "Withdraw consent" deletes the _ga cookies and reloads the page.

Your choice is kept for 6 months. You are then asked again.

Your rights

You have the following rights over your data:

• access;
• rectification;
• erasure;
• restriction of processing;
• objection, in particular to follow-ups, with no reason required;
• portability, where processing is based on your consent or on pre-contractual steps;
• withdrawal of consent at any time, without affecting what was done before;
• instructions on what happens to your data after your death.

To exercise them, write to 3d@nicolaspapin.fr. You will receive an answer within one month. This period may be extended by two months for complex requests; you will be told if so. Proof of identity may be requested in case of reasonable doubt.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr (new tab).

No automated decisions

No decision with legal effects on you is made by automated means. No profiling is carried out. Every request received is read and handled by Nicolas Papin.

The anti-bot filter or the rate limit may block a submission. If so, write directly to 3d@nicolaspapin.fr.

Other documents

Sales terms are in the terms of sale, site use in the terms of use, and content protection on the copyright page.

This policy may change with the site. The update date is shown at the top of the page.