Data controller

Step By Step, 20 rue du Dr. Del Pellegrino, 20090 Ajaccio, France (SIRET 954 037 404 00017). You can reach us through the contact form, by phone on +33 9 73 41 09 73 or by post at this address.

Contact form data

When you write to us through the contact form, we receive:

your full name, your email address and, if you provide them, your company name and phone number;
the topic and content of your message;
the date sent, the originating page and the sender’s IP address, used to prevent abuse.

Purpose: to answer your request and, where relevant, send you a proposal. Legal basis: steps taken at your request prior to entering into a contract, and our legitimate interest in answering messages received. Retention period: three years from the last exchange, after which the data is deleted.

Your message is stored on our server and forwarded by email to the studio team; an acknowledgement is sent to you. This data is never sold, transferred or used for advertising.

Visit log and traffic measurement

To measure traffic and protect the website, our server records for each page viewed: the date, the page, the IP address, the declared browser and the referring page. Country and city are derived from the IP address using a database installed on our own server, with no call to a third-party service.

No cookie is set for this measurement, and no third-party analytics tool is used.
IP addresses are anonymised (truncated) after 30 days.
Log entries are deleted after 13 months.

Legal basis: our legitimate interest in measuring the website’s audience and keeping it secure.

Cookies

The public website sets no advertising, analytics or social media cookies. Only the administration area, reserved for the studio team, uses a session cookie that is strictly necessary for signing in.

Recipients and hosting

Data is accessible only to the Step By Step team. It is hosted in France on a server provided by OVH SAS (Roubaix, France). Emails are delivered through our business email provider. No data is transferred outside the European Union in connection with this website.

Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise these rights, contact us through the contact form choosing the “Other request” topic, or by post at the address above. We will reply within one month.

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL).

Security

The website is served over HTTPS only. Access to the administration area is protected by a password and two-factor authentication, with limited sign-in attempts. Server access goes through an encrypted private network.

Last updated: October 2026.

Privacy policy