Privacy notice
How we use information you share with the studio.
Information status · 5 November 2026
Who is responsible
ESTIENNE is the brand used for this website. The legal identity of the controller remains to be supplied. For privacy enquiries, contact support@estienne.co.
- Legal name / legal form
- To be supplied
- Postal address
- To be supplied
- Authorised representative, if applicable
- To be supplied
- Data protection officer, if applicable
- To be supplied
Enquiries, files and updates
We use enquiry details to understand your project, reply and prepare a quotation. Depending on the form, these include your name, email address, optional telephone number, product and quantity, message, selected language, submission time, processing and delivery status, an identifier and file hash where relevant, and the recorded privacy acknowledgement with notice version and time. A submission is an enquiry; it does not create an order or a payment obligation.
Files you choose to send are stored privately in Base44 and made available to authorised staff handling your enquiry. Accepted formats are PDF, PNG, JPG/JPEG and TIFF, with a limit of 20,000,000 bytes per file (20 MB). The enquiry upload does not render, modify or convert your artwork. Please send only material needed for your request.
We store submissions in Base44. We send a confirmation to the email address you provide, in your selected language, and notify the studio through support@estienne.co. Authorised support staff can read the details needed to answer you. Notifications contain attachment names and sizes, but no private download link. Customer confirmations do not repeat your message or attachments. Email delivery is handled through Base44’s email integration.
For product waitlists, including Herbier, we record your email, the relevant product and selected language, together with submission and consent records. A waitlist is voluntary and has no purchase obligation. Any newsletter or marketing updates require a separate choice; sending an enquiry does not subscribe you.
Why we use your data
For steps you request before a possible contract, the intended basis is Article 6(1)(b) GDPR. Other correspondence may rely on Article 6(1)(f), where our legitimate interest in answering and organising enquiries outweighs your interests. Protecting the service against abuse may also rely on that balancing test. The operator must confirm the final purposes and assessment as part of completing this notice.
Optional product updates and marketing rely on your consent under Article 6(1)(a). You can withdraw it at any time by writing to support@estienne.co; withdrawal does not affect earlier lawful processing. The required privacy acknowledgement records that the notice was presented. It does not make consent the sole basis for all enquiry processing.
Required contact and project fields are needed to answer or assess your request. Without them we cannot process that form. Optional telephone numbers and attachments are not required to browse the website. Legal obligations, if applicable, may require particular records under Article 6(1)(c).
Your account and saved work
The account form uses your email address and password for Base44 authentication, plus first and last name and optional company and title for the customer profile. Email verification, sign-in and password reset use the authentication service. Passwords are not part of enquiry records or support notification emails; never send a password in a message or attachment.
If you use the account and designer, profile preferences, saved designs, private artwork and selections may be associated with your account so you can return to your work. The account may show existing request or order records. These functions are separate from a product waitlist. We use the data necessary to provide the account and the services you request; the final account and provider arrangements require operator confirmation.
Service providers and transfers
Base44 provides the application database, authentication, private file storage and email integration used by these functions. Authorised studio personnel and service providers involved in hosting, security, storage and email delivery may receive the data required for their work.
The legal names of the providers, their processing locations, sub-processors and the applicable data-processing agreements must be verified. This notice makes no promise that all data remains in the EU or EEA. Any transfer outside the EEA requires a verified legal mechanism and the information needed to obtain the applicable safeguards.
- Provider legal entities and roles
- To be supplied
- Hosting / email processing locations
- To be supplied
- International transfers and safeguards
- To be supplied
- How to obtain a copy of safeguards
- To be supplied
Cookies, local storage and security
The website uses browser storage for language and appearance preferences, sign-in sessions, returning to a page after sign-in, pending email verification, selected products and quantities, request summaries and saved designs. A pending registration can temporarily store email and profile details until verification, but not the password. Selected designs or artwork may remain in browser storage until cleared. This website update adds no advertising or analytics. Verification of every signed-in and design workflow remains pending; the final cookie and storage inventory remains to be approved.
Each storage access and third-party request must be assessed as part of the continuing review. Non-essential access must be removed or held until valid consent. A privacy acknowledgement on a form is not cookie consent. Technical service and security records may include request metadata and abuse-prevention identifiers; the final fields and handling must match the verified implementation.
- Verified cookie / storage inventory
- To be supplied
- Third parties, purposes and lifetimes
- To be supplied
- Consent controls required after audit
- To be supplied
How long we keep information
Retention must depend on the enquiry’s progress, whether further contact is reasonably needed, account use, withdrawn consent, applicable record-keeping duties and the need to establish or defend legal claims. Data that is no longer needed should be deleted or anonymised, unless a valid obligation or exception applies.
The reviewed application does not currently configure fixed automatic cleanup periods for enquiries, waitlists or their attachments. Deletion is manual; deleting a database record does not itself erase the underlying uploaded file, which needs a separate deletion process. This notice does not promise deletion after a specific number of days or months. The operator must approve a retention and deletion policy and the practical process as part of completing this notice.
- Approved retention policy and review intervals
- To be supplied
- Attachment, email and backup deletion process
- To be supplied
Your choices and rights
Subject to the applicable legal conditions, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests, and you may object to direct marketing at any time. You can withdraw consent at any time without changing the lawfulness of processing before withdrawal.
Send requests to support@estienne.co. We may need proportionate information to verify your identity. You may lodge a complaint with a competent supervisory authority, in particular where you live, work or believe an infringement occurred. The operator’s competent authority must be confirmed once the operator and location are known.
- Operator’s competent supervisory authority
- To be supplied
The reviewed enquiry and waitlist flow does not make decisions with legal or similarly significant effects solely by automated means. Any future change must be reflected in this notice before the new processing begins.