Privacy policy
What data we process, why, for how long, and how to exercise your rights.
Key points
- Controller: Bentstarshift SASU, 27 Rue des Amidonniers, 31000 Toulouse, France.
- We use your data to answer your requests, deliver our services and meet our accounting obligations.
- Your recordings are archived for 12 months after delivery, then deleted.
- We never use your voice to train artificial intelligence without your separate written consent.
- No cookies, no analytics, no sale of data.
- The form goes through FormSubmit (formsubmit.co), a service located outside the European Union; you can avoid it by writing to us directly.
§01Controller
The controller is Bentstarshift SASU, 27 Rue des Amidonniers, 31000 Toulouse, France, RCS Toulouse 928 417 369, represented by Julien Carrère, President. Contact for any question about your data: [email protected] or by post to the registered office.
Given its size and the nature of its processing, the company has not appointed a data protection officer; its President is the contact for these matters.
This policy is issued under Articles 12 to 14 of Regulation (EU) 2016/679 (GDPR) and amended French Law No. 78-17 of 6 January 1978 (Loi Informatique et Libertés).
Back to contents§02Data we process
- Quote or booking request: name, e-mail, phone (optional), service, preferred dates, project description, any links to your demos.
- E-mail or phone exchanges: the content of our exchanges and your contact details.
- Delivering the services: recordings of your voice and playing, footage filmed for video podcasts, files you send us, session notes.
- Invoicing: identity, address, amounts, payment methods used (card numbers are not stored) and, for businesses, company name and VAT number.
- Minors: name and age of the minor student or artist, contact details and written consent of the legal guardian.
- Browsing: the host records technical logs (IP address, date, page requested, browser) for website security. Your choice on the information banner is stored only in your browser, under the key
bsft_consent_v1.
We collect no special-category data within the meaning of Article 9 GDPR. We do not use your voice as biometric data: it is never processed to identify you.
Back to contents§03Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Answering a request, preparing a quote | Pre-contractual steps at your request (6(1)(b)) |
| Running sessions and delivering files | Performance of the contract (6(1)(b)) |
| Invoicing and accounting | Legal obligation (6(1)(c)) |
| Archiving sessions for 12 months | Performance of the contract (6(1)(b)): allowing revisions and new exports |
| Handling complaints and disputes | Legitimate interest in defending our rights (6(1)(f)) |
| Website security (technical logs) | Legitimate interest in protecting the website (6(1)(f)) |
| Sharing an excerpt of your track to promote the studio | Written consent (6(1)(a)), withdrawable at any time |
We carry out no profiling and no automated decision-making producing legal effects concerning you (Article 22 GDPR).
Back to contents§04Retention periods
| Data | Period |
|---|---|
| Requests not followed up | 3 years after the last contact |
| Client file (quote, exchanges, contract) | 5 years after the end of the relationship (limitation period, Article 2224 of the French Civil Code) |
| Invoices and accounting records | 10 years (Article L.123-22 of the French Commercial Code) |
| Recordings and sessions | 12 months after delivery, then deleted unless you ask in writing for an extension |
| Video footage (video podcasts) | 12 months after delivery of the rushes |
| Host's technical logs | 12 months at most |
| Choice on the information banner | 6 months (182 days) in your browser |
| Requests to exercise rights | 1 year after our reply, to evidence how the request was handled |
§05Recipients
Your data is only accessible to the team members who need it: the President and the sound engineer in charge of your project. It may be shared, to the extent necessary, with:
- o2switch SAS, host of the website and our e-mail, in France;
- FormSubmit (formsubmit.co), which transmits the request form (see the next section);
- our chartered accountant and our bank, for invoicing and payments;
- the file transfer service agreed with you for delivering recordings;
- independent musicians or voice actors working on your project, with your agreement;
- administrative or judicial authorities, on lawful request.
We never sell, rent or exchange your data.
Back to contents§06Transfers outside the European Union
The FormSubmit (formsubmit.co) service, used to transmit the request form, is operated from outside the European Union. The data entered (name, e-mail, phone, service, dates, message) may therefore be processed in a third country, in particular the United States, before reaching us by e-mail.
We keep the fields to a strict minimum and have disabled service options that would involve additional third-party tools (captcha). You can obtain information about the safeguards covering this transfer (Article 46 GDPR) by writing to [email protected].
If you do not want your data to pass through this service, write to us directly at [email protected] or call +33 (0)5 61 42 87 30: these channels do not use FormSubmit (formsubmit.co).
Back to contents§07Recordings, voice and image
Your voice and your image are personal data. We process them only to deliver the service ordered and any follow-up revisions.
- No artificial intelligence without consent: we never use your recordings to train an artificial intelligence system, create a synthetic voice or clone a voice, except with the separate, explicit written consent of the person concerned.
- No publication without consent: we publish no excerpt, photo or video of a session without your written permission, in line with Article 9 of the French Civil Code (right to one's image and private life).
- Podcast guests: when you record guests, you are responsible for obtaining their permission to publish. We process their voices and images on your behalf.
When we record people on behalf of a business client (agency, producer), we act as a processor within the meaning of Article 28 GDPR; see the data processing agreement.
Back to contents§08Minors
Minors are welcome from the age of 12. Bookings, quotes and recording permissions are handled by a legal guardian. We do not collect data directly from minors through the form: if you are under 15, ask your parents to contact us (Article 45 of the Loi Informatique et Libertés).
Back to contents§09Security
We take appropriate measures to protect your data (Article 32 GDPR): website served over HTTPS, access to sessions limited to the team, strong passwords and two-factor authentication on our accounts, double backup of sessions on encrypted drives kept in separate places, secure deletion at the end of retention periods.
In the event of a data breach posing a risk to your rights, we notify the CNIL within 72 hours and inform you if the risk is high (Articles 33 and 34 GDPR).
Back to contents§10Your rights
You have the following rights over your data:
- right of access (Article 15 GDPR) and rectification (Article 16);
- right to erasure (Article 17) and to restriction of processing (Article 18);
- right to portability of the data you provided (Article 20);
- right to object to processing based on our legitimate interest (Article 21);
- right to withdraw your consent at any time, without affecting earlier processing;
- right to give instructions on what happens to your data after your death (Article 85 of the Loi Informatique et Libertés).
To exercise them, write to [email protected] or by post to the registered office. We reply within one month, extendable by two months for complex requests (Article 12 GDPR). We may ask for additional information if we have reasonable doubts about your identity.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
Back to contents§11Marketing and cold calling
We send no newsletter and carry out no commercial prospecting by e-mail or phone. If you are registered on the French Bloctel opt-out list (bloctel.gouv.fr), we will not call you for commercial purposes outside an ongoing contract (Article L.223-2 of the French Consumer Code).
Back to contents§12Changes
We may update this policy to reflect changes in our services or the law. The date of the last update is shown at the top of the page. If there is a significant change, a message on the home page will say so for one month.
Back to contents