Last updated: 29 October 2026

This policy explains how Atelier Sourire processes personal data collected through this website, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi n° 78-17 of 6 January 1978, as amended). The French version is authoritative.

Controller

The controller is Yan-Eric Eber, sole proprietor (EI), trading as Atelier Sourire, 46 rue de la Grange Rouge, 11510 Caves, France (SIREN 801 390 535).

For any question about your personal data: labo.atelier.sourire@gmail.com. Given the size of the business, no data protection officer (DPO) has been appointed.

Data collected through the contact form

When you use the contact form, we collect:

your name, the name of your practice and your e-mail address;
your phone number (optional);
the subject of your request and the content of your message (optional);
technical information: originating page, site language, date and time of submission.

Fields marked with an asterisk are mandatory: without them we cannot process your request. If you write to us directly by e-mail or call us, we process the information you give us for the same purposes.

Please do not enter data about your patients (name, health condition, etc.) in the form or in a first e-mail: this is health data, which enjoys special protection.

Purposes and legal bases

Answering your request (feasibility of a job, lead time, professional price list, collaboration): pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) or, for a general question, our legitimate interest in answering requests from professionals (Art. 6(1)(f)).
Protecting the form against abuse: our legitimate interest (Art. 6(1)(f)).
Managing the relationship with practices, preparing quotes and invoices, meeting accounting obligations: performance of a contract and legal obligation (Art. 6(1)(b) and (c)).

We do not sell your data and carry out no profiling or automated decision-making.

Recipients and processors

Your data is intended for Atelier Sourire. It is processed on our behalf by the following providers, solely to deliver their service:

Hetzner Online GmbH (Germany): website hosting.
Form processing server (n8n tool): receives your request and forwards it by e-mail to the laboratory. This server does not retain the content of requests.
Google (Gmail): receipt and storage of e-mails.

No other disclosure to third parties takes place, except where required by law.

Transfers outside the European Union

Google may process data in the United States. This transfer relies on the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) for certified entities or, failing that, on the Commission’s standard contractual clauses.

Retention periods

Requests without follow-up: three years from our last contact with you.
If a collaboration follows: for the duration of the relationship, then for the statutory periods (for example ten years for accounting records, Art. L123-22 of the French Commercial Code).
Technical web server logs (IP address, date, page requested), used for security: twelve months at most.

After these periods, data is deleted or anonymised.

Data processed for the laboratory’s work

To carry out work on prescription, the laboratory may receive information about the patient (for example the patient’s identity or a reference on the prescription). This information is used only to carry out the dentist’s prescription, to ensure the traceability of the custom-made medical device (Regulation (EU) 2017/745) and to return the work to the practice.

It is passed on only to the prescribing practitioner, except where required by law, and kept for the periods set by the rules applicable to custom-made medical devices. Diagnosis, therapeutic indication and patient information are the dentist’s responsibility.

Cookies and trackers

This website sets no cookies or other trackers on your device, uses no audience measurement or advertising tools and loads no third-party content: fonts are hosted on the site itself. A consent banner is therefore not required (Art. 82 of the French Data Protection Act).

The map link opens Google Maps in a new tab: Google then applies its own privacy policy.

Security

Data is transmitted over an encrypted connection (HTTPS) and access to requests is limited to the person in charge of the laboratory.

Your rights

You have the rights of access, rectification, erasure, restriction of processing and objection (in particular where processing is based on legitimate interest) and, where applicable, the right to data portability. You may also give instructions on what happens to your data after your death.

To exercise your rights, write to labo.atelier.sourire@gmail.com. We reply within one month, extendable by two months for complex requests. If there is reasonable doubt, we may ask for proof of identity.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

Changes

This policy may be updated. The date of the last update is shown at the top of the page.