Privacy policy

Who is responsible

The controller of your data is Freddy Duarte Zeballos, trading as Duarte Groupe. Address 25 boulevard Joffre, 54000 Nancy, France. Email freddy@duartegroupe.eu.

What data is collected

Only what you give me. In the contact form, your name, your business if you add it, your WhatsApp number or email, the service you're interested in, your message if you write one, the record that you agreed, and the language of the page.

If you write to me by email or WhatsApp, also whatever you include in that message.

When the form arrives, Netlify also records the IP address it was sent from.

This website uses no cookies, no analytics and no advertising pixels. The hosting provider generates technical connection logs, such as IP address and browser, to serve and protect the website. I don't use them to measure visits.

Why, and on what legal basis

I use your data to reply to your enquiry and, if you ask, to prepare a proposal. The legal basis is your consent, given by ticking the box on the form, and the steps you request before a contract. These are the bases set out in article 6(1)(a) and (b) of the General Data Protection Regulation.

The hosting provider's technical logs rely on the legitimate interest of keeping the website secure, set out in point (f) of the same article.

You can withdraw your consent at any time by writing to freddy@duartegroupe.eu. This doesn't affect anything done before.

For how long

If the enquiry doesn't lead to a project, I delete your data twelve months after our last contact.

If we work together, I keep it for as long as the relationship lasts, and afterwards for the periods the law requires for invoicing and accounting.

Who receives the data

I don't sell or pass your data to anyone. It only goes through the technical services that run the website and email.

Netlify, Inc., which hosts the website and receives the form submissions.

Namecheap, Inc., which forwards email sent to freddy@duartegroupe.eu to my Gmail mailbox.

Google, which provides the Gmail service where that email ends up. In Europe it is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

WhatsApp, if you choose to write to me there. In Europe the service is provided by WhatsApp Ireland Limited and elsewhere by WhatsApp LLC, each under its own terms.

Transfers outside the European Union

Netlify and Namecheap are based in the United States. Netlify participates in the EU-US Data Privacy Framework, recognised by European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, and also uses the Commission's standard contractual clauses. Namecheap safeguards transfers with standard contractual clauses, according to its privacy policy.

Google may process that email on servers outside the European Union. Google LLC participates in the same EU-US Data Privacy Framework, and Google also uses standard contractual clauses where they are required, according to its page on data transfer frameworks.

These are the safeguards provided for in articles 45 and 46 of the General Data Protection Regulation.

If you write to me on WhatsApp, that service may process your data outside the European Union under the safeguards described in its own privacy policy.

Your rights

You can ask me to access your data, correct it, erase it, object to its use, restrict it, or receive it in a format you can take elsewhere. These are the rights in articles 15 to 18, 20 and 21 of the General Data Protection Regulation, and I grant them to anyone, wherever they live.

Write to freddy@duartegroupe.eu. I'll reply within one month at the latest.

Where to complain

If you think I haven't handled your data properly, you can complain to the French data protection authority, CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr, under article 77 of the General Data Protection Regulation.

In Paraguay, Law no. 7593/2025 on personal data protection, enacted on 27 November 2025, creates the National Personal Data Protection Agency. Under its article 57, the law comes into force twenty-four months after its official publication. From then on you will also be able to complain to that Agency.

Automated decisions

I don't make automated decisions about you and I don't build profiles from your data.

Your business data during a project

If we work together and you give me access to data about your business, your customers or your staff, I use it only for the project and according to your instructions. I don't share it, I don't use it for anything else, and I limit access to what's strictly necessary.

When the project ends, I return or delete it, as we agree in writing. In that case I act as a processor and the contract governs it, as provided for in article 28 of the General Data Protection Regulation.

Security

The website is always served over an encrypted connection. Only I access the messages that come in.

Changes to this policy

If this policy changes, the date at the top is updated.