Personal data

Privacy policy

Last updated: August 25, 2026.

Data controller

The controller responsible for the processing described below is Donar, a French sole proprietorship with SIRET number 108 070 475 00018, established at 1 rue de la Montagne, 67130 Wisches, France. To exercise your rights or ask a question, email contact@donar.fr.

Data processed

When you use the contact form, Donar receives the information you provide voluntarily: first and last name, email address, company or business, optional telephone number, project type, any plan you may have selected, the optional address of your current website and the content of your message.

Technical data may be processed to operate and protect the service: IP address, date and time of the request, browser and language information, referring page, approximate geographic location inferred by the hosting provider, request identifier and details of the anti-abuse checks. Relevant details are compiled into a traceability record attached only to the internal notification received by Donar. Cookies, authentication data and headers unrelated to security are not copied into this record.

Please do not send sensitive data or information unrelated to your project.

Purposes and legal bases

Responding to your enquiry

Steps taken at your request before entering into a contract and the legitimate interest in handling enquiries received.

Preparing a quotation and carrying out the work

Pre-contractual steps followed by performance of the contract once it has been entered into.

Managing the relationship and legal obligations

Performance of the contract and compliance with accounting, tax and evidential obligations.

Securing the website and preventing abuse

The legitimate interest in protecting the form, systems and users.

Recipients and service providers

Enquiries are reviewed by Donar. Vercel provides hosting, HTTPS delivery and technical logs; Resend delivers the message and the acknowledgement of receipt; and OVHcloud hosts the destination mailbox. These providers process the data required for their role in accordance with their own contractual safeguards.

Data is not sold, rented or disclosed to third parties for advertising purposes. It is not used for unsolicited marketing.

Retention periods

• Enquiries that do not lead to a contract: no more than 3 years from the last contact.
• Project and client-relationship data: for the duration of the relationship, then for the periods required to establish evidence, defend rights and comply with legal obligations.
• Quotations, contracts, invoices and accounting records: 10 years where their retention is legally required.
• Contact-form traceability records and anti-abuse data: a rolling 12-month period. If abuse, an incident or a dispute is identified, strictly necessary information may be isolated and retained for as long as required for the investigation or defence of rights, then deleted.
• Other technical logs held by service providers: according to their technical retention periods, with no commercial reuse by Donar.

Transfers outside the European Economic Area

Vercel Inc. and Resend, Inc. are established in the United States. Some technical data, metadata or message content may therefore be processed outside the European Economic Area. Transfers are governed by the mechanisms set out in their data processing addenda, including the Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Donar's Resend sending domain sends emails from the European region located in Ireland. This choice shortens the delivery path but does not mean that Resend account data, logs and metadata are stored exclusively in Europe.

Vercel privacy noticeVercel DPAResend privacy policyResend DPA

Security

The website uses HTTPS/TLS, stores keys and secrets on the server, controls and limits contact-form fields, verifies request origins, and combines a honeypot field, proof of work, submission rate limiting and Vercel's invisible BotID detection. Each traceability record receives a unique identifier and an integrity fingerprint. Security headers also restrict certain unnecessary browser features and the embedding of the website in third-party frames.

Donar applies measures proportionate to the risks. No connected system can, however, guarantee zero risk; the measures are reassessed as the service evolves technically.

Cookies and trackers

Donar currently installs no advertising trackers, profiling tools or audience-measurement tools requiring your consent. No consent banner is therefore displayed. The hosting provider may carry out technical operations strictly necessary to provide and secure the service. This policy will be updated before any non-essential tool is added.

Your rights

Depending on the circumstances, you may request access to, rectification or erasure of your data, restriction of processing or data portability, or object to certain processing. You may withdraw consent where processing is based on consent. Email contact@donar.fr and describe your request. Donar will respond within the statutory time limit; evidence of identity may be requested where there is reasonable doubt.

If you believe your rights have not been respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or visit cnil.fr .

Changes to this policy

This policy evolves with the tools used and the applicable obligations. The date at the top of the page identifies the version currently in force.