Privacy policy
Last updated: 16 October 2026
Our commitment
Protecting your personal data is a priority. This policy clearly and transparently describes the data we collect, why we collect it, how long we retain it, and the rights you hold.
We comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
Data controller
The data controller is:
Rafael Janosevic
13 Quai de la Garonne, 75019 Paris
SIRET: 911 230 746 00016
Email: rafael@obv.studio
Data collected
The data we collect depends on how you interact with the Site.
At account creation
- Email address
During the welcome survey
- First name
- Date of birth
- Gender
- City (name, postcode, department, region)
- Professional situation and experience
- Level of education and perceived standard of living
- Family situation
- Main modes of transport
- Cultural interests
- Information sources
- How often you go out
- Profile photo (optional)
During surveys
- Your answers to questions (anonymised in published reports)
- Some answers complete your profile, for example your occupation or your parents' occupation
- If you choose to answer them, your answers to optional sensitive questions (see “Sensitive data”)
- Date and time of participation
- If you reach the end of a survey without creating an account, your answers are kept without name or email, separately from members' answers. They are not entered in the prize draw
Upon winning a prize draw
- Postal address (for delivery purposes only, deleted once the prize has been dispatched)
When downloading a white paper
- Email address
- Choice to receive or not receive marketing communications from obv.studio (explicit opt-in checkbox)
When making a purchase in the Shop
- First and last name
- Company and role (business buyers)
- Full postal address (street, postcode, city, country)
- Email address
- Phone number (optional)
- Payment data processed exclusively by Stripe — obv.studio does not store any card details
Technical data
- Session cookies (strictly necessary for the Site to function)
- Server logs (IP address, user agent, pages visited) for security purposes
Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Account creation and management | Performance of contract |
| Targeting surveys according to your profile | Performance of contract |
| Sending transactional emails (welcome, survey notification, winner) | Performance of contract |
| Producing anonymised cultural studies | Legitimate interest |
| Site security and fraud prevention | Legitimate interest |
| Compliance with legal obligations (tax, accounting) | Legal obligation |
| Purchase and delivery of digital study (Shop) | Performance of contract |
| Invoicing and accounting records (Shop) | Legal obligation |
| Sending the white paper after form submission | Legitimate interest |
| Invitation to a qualitative interview following a survey | Legitimate interest |
| Optional answers to sensitive questions (political opinions, sexual orientation) | Explicit consent (Article 9 GDPR) |
| Marketing communications (if consent given) | Consent |
About qualitative interviews. After a survey, we may invite a small number of Members to discuss it live, in a video call of around 45 minutes. This invitation goes to people already registered on our research panel, for the very activity they signed up for, which is what grounds the legitimate interest. It is a proposal, never an obligation: you may ignore it, decline it, or switch off this type of invitation for good from My account → Notifications. This right to decline is restated at the start of every survey and in every invitation we send.
Sensitive data
Some surveys ask optional questions that fall under the special categories of data defined in Article 9 GDPR, such as political opinions or sexual orientation.
These questions are always optional and always offer the choice not to answer. Answering them constitutes explicit consent to the processing of that answer, for the sole purpose of the study concerned. A notice under each of these questions says so.
These answers are only ever used in aggregated, anonymous form. They are never sold, never passed to a client or partner in a form that could identify a person, and never used to target an email or an advert.
You can withdraw your consent at any time by writing to rafael@obv.studio: the answer concerned is then deleted.
Recipients and sub-processors
Your personal data is never sold. It is only accessible to Rafael Janosevic (data controller) and a limited number of technical sub-processors who act on instructions and under GDPR-compliant contracts.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database hosting and authentication system | European Union (Frankfurt) |
| Vercel Inc. | Website hosting | United States (EU standard contractual clauses) |
| Brevo (Sendinblue SAS) | Sending transactional emails | France |
| Stripe Payments Europe, Ltd. | Secure payment processing (Shop) | European Union (Ireland) |
| Functional Software, Inc. (Sentry) | Monitoring of technical errors on the Site, without account data | European Union (Frankfurt) |
Transfers outside the European Union (Vercel) are governed by standard contractual clauses approved by the European Commission, ensuring a level of protection equivalent to the GDPR.
Retention periods
- Active account: your data is retained for as long as your account is active.
- Inactive account: after 24 months of inactivity, we will contact you before any potential deletion.
- Deleted account: your data is erased within 30 days.
- Survey responses: retained in anonymised form for study purposes, even after account deletion.
- Postal address (prize won): deleted within 30 days of dispatch.
- Purchase data and invoices (Shop): retained for 10 years from the transaction date, in accordance with legal accounting obligations.
- White paper leads: email retained until consent is withdrawn or 3 years of inactivity.
- Security logs: retained for 12 months.
Cookies
The Site uses only cookies that are strictly necessary for its operation (maintaining your authenticated session). These cookies do not require your prior consent.
No advertising or third-party tracking cookies are placed. If we add analytics or audience measurement cookies in the future, we will request your consent via a dedicated banner.
Your rights
Under the GDPR, you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct inaccurate data
- Right to erasure: delete your data (right to be forgotten)
- Right to restriction: limit the processing of your data
- Right to data portability: retrieve your data in a structured format
- Right to object: object to processing on legitimate grounds
- Right to withdraw consent: at any time, without retroactive effect
To exercise these rights, contact us at rafael@obv.studio. We undertake to respond within a maximum of one month.
If you believe the processing of your data does not comply with regulations, you may lodge a complaint with the CNIL: www.cnil.fr
Security
We implement appropriate technical and organisational measures to protect your data: encrypted transmissions (HTTPS), secure storage, strict access controls on databases, regular backups.
In the event of a data breach likely to create a risk to your rights and freedoms, you will be informed without delay, in accordance with Article 34 of the GDPR.
Policy updates
This policy may be updated to reflect changes to the Site or applicable regulations. The date of the last update appears at the top of this page. Material changes will be notified to you by email.
Contact
For any question about this policy or the processing of your data: rafael@obv.studio