Privacy Policy

1. Introduction & Controller Identity

This Privacy Policy explains how Montreuil Guitar Studio (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit this website and when you contact us to request availability for guitar lessons in Paris. We operate from our studio location in France and provide services primarily in Paris and the surrounding area. This policy is written to be clear and practical, so you can understand what we do with the information you share with us.

Data Controller (responsable du traitement): MK HOLDING SAS, 18 Rue de Montreuil, 75011 Paris, France. You can contact us about privacy matters at [email protected] or by phone at +33 1 84 60 27 93.

We do not appoint a Data Protection Officer (DPO) because our processing activities do not involve large-scale processing of special-category data. If this changes, we will update this policy and clearly publish the DPO contact details.

Effective Date: March 17, 2026.

2. Personal Data We Collect

We collect only the data that is reasonably necessary to operate the website, respond to lesson inquiries, and keep the service secure. The exact data we collect depends on how you use the website (for example, reading pages versus submitting the booking request form).

• Identity and contact details: name (as provided by you), email address, and optional phone number when you submit the booking request form or contact us by email or phone.
• Form content: the message and lesson-related details you choose to share (for example, your preferred days/times, whether you play electric or acoustic, repertoire references, or your current practice routine). Please avoid including sensitive personal information in free-text fields.
• Technical data: IP address, browser type and version, device identifiers, operating system, language settings, and approximate location derived from IP (city-level).
• Usage data: pages viewed, time spent on pages, referral source, and click paths that help us understand which content is useful.
• Cookies and identifiers: essential cookies used for session continuity and storing your consent preferences; and, if you consent, analytics and marketing identifiers as described in Section 4.
• Conversion events: events related to the booking request flow (for example, form submission completed), used to measure effectiveness of website content and advertising, only when consent is provided for the relevant category.

We do not intentionally collect special-category data (such as health data, religious or political views), financial account details, or government identification numbers through this website. If you choose to provide such information in a message, we may delete or redact it where reasonably possible and will treat it with heightened care.

3. Why We Process Personal Data & Legal Basis (GDPR Art. 6)

We process personal data for specific purposes and rely on the legal bases allowed under the EU General Data Protection Regulation (GDPR) and applicable French data protection law.

• Responding to booking requests and scheduling: When you submit the contact form, we use your details to reply, confirm availability, and, if applicable, arrange lesson times. Legal basis: Art. 6(1)(b) (steps prior to entering into a contract) and Art. 6(1)(a) (consent) where the form includes a consent confirmation.
• Customer support communications: Managing email threads, clarifying lesson goals, and handling administrative questions. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) (legitimate interests in providing responsive support).
• Analytics (only with consent): Understanding how visitors use the site so we can improve content and navigation. Legal basis: Art. 6(1)(a) (consent).
• Marketing and remarketing (only with consent): Measuring advertising performance, building audience lists, and performing conversion attribution. Legal basis: Art. 6(1)(a) (consent).
• Security, abuse prevention, and fraud detection: Protecting the website, preventing automated abuse of forms, and keeping logs to investigate suspicious activity. Legal basis: Art. 6(1)(f) (legitimate interests).
• Legal obligations: Compliance with applicable laws (for example, record-keeping for invoicing if relevant to a transaction). Legal basis: Art. 6(1)(c) (legal obligation).

Automated Decision-Making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any lesson recommendations or scheduling decisions are performed by a human based on the information you provide.

4. Cookies & Tracking Technologies

Cookies are small text files stored on your device. We also refer to similar technologies such as pixel tags and server-side measurement. Our cookie categories are designed to be understandable and to match our Cookie Policy at /cookie-policy/.

4.1 Essential Cookies (Always Active)

Essential cookies are required for the website to function and for you to save your cookie preferences. These cookies do not require consent.

• _site_session: supports session continuity and basic site operation. Retention: session to up to 12 months depending on configuration.
• cookie_consent: stores your cookie choices so we can apply them on future visits. Retention: 12 months.
• CSRF / security tokens: may be used to protect form submissions and prevent abuse. Retention: typically session-based.

4.2 Analytics Cookies (Consent Required)

If you consent to analytics, we may use Google Analytics 4 (GA4) to understand traffic patterns and improve content. Where applicable, IP anonymization is used. Typical analytics cookies include _ga and _ga_XXXXXXXXXX (GA4 property-specific cookie). Data retention for analytics events is typically 14 months in GA4 settings.

4.3 Marketing Cookies (Consent Required)

If you consent to marketing, we may use Google Ads and Meta advertising measurement tools (for example, Meta Pixel) to measure campaign performance, build remarketing audiences, and attribute conversions. Typical marketing cookies include _gcl_au, _fbp, and _fbc (when click identifiers are present). These cookies generally have short retention periods (for example, 90 days).

4.4 Beyond Cookies

In addition to cookies, tracking can involve pixel tags (small image or script-based beacons) and server-side conversion measurement. Where enabled, server-side measurement may transmit hashed identifiers (for example, a hashed email address) to improve conversion attribution. We only enable such technologies when the relevant consent category is granted.

5. Consent (EEA) and How to Withdraw It

Users in France and the broader EEA receive a consent notice under GDPR and ePrivacy rules. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Art. 6(1)(a)). Your consent choice is recorded in the cookie_consent browser cookie (stored for 12 months).

You can withdraw or change consent at any time by using the “Manage cookie preferences” link in the site footer. You can also delete cookies using your browser settings; after deletion, the banner may reappear and you can choose again. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

6. Sharing With Advertising & Service Partners

We use a small set of providers to operate the site, keep it secure, and—if you consent—measure performance of content and advertising. We do not sell personal data.

• Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, remarketing): may receive cookie identifiers, usage data, and conversion events when enabled by consent. Privacy information: https://policies.google.com/privacy.
• Meta Platforms (pixel-based measurement, custom/lookalike audiences, conversion API where configured): may receive page view events and conversion events when enabled by consent. Privacy information: https://www.facebook.com/privacy/policy.
• Cloudflare (content delivery and security): may process IP address and request metadata to detect threats and improve performance. Privacy information: https://www.cloudflare.com/privacypolicy/.

We do not permit these providers to use site data for their own independent commercial purposes beyond providing services to us, subject to their contractual terms and applicable law. However, some providers may act as independent controllers for certain processing (for example, improving their own services); in such cases, their policies apply.

7. International Transfers

Some service providers (for example, Google and Meta) may process data outside the European Economic Area, including in the United States. When personal data is transferred internationally, we rely on appropriate safeguards such as the EU–US Data Privacy Framework (where applicable), the UK Extension to the DPF where relevant, and Standard Contractual Clauses (EU 2021/914) as a fallback. Where required, we also apply additional measures to reduce transfer risk.

8. Data Retention

We keep personal data only for as long as needed for the purposes described in this policy, and then delete or anonymize it. Retention periods vary depending on the type of data.

• Contact submissions: up to 2 years from the last interaction, unless a longer retention is needed to handle a dispute or a legal obligation applies.
• Analytics data: typically retained for 14 months in GA4 settings, subject to configuration and your consent choice.
• Marketing cookies: retained according to cookie lifetime (commonly up to 90 days for certain identifiers), subject to your consent choice.
• Email correspondence: retained for the duration of the relationship and up to 1 additional year for continuity and dispute handling.
• Server and security logs: typically up to 90 days unless needed longer for incident investigation.
• Cookie consent records: we may retain evidence of consent for up to 3 years for audit and compliance purposes.
• Legal and tax records: retained as required by applicable law (commonly 6 to 10 years for invoicing-related records).

9. Your Rights (GDPR & French Data Protection Law)

If you are in the EEA (including France), you have rights regarding your personal data. These include: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and the right to withdraw consent at any time (Art. 7(3)).

To exercise your rights, email us at [email protected]. We may request information to verify your identity before fulfilling certain requests, to protect you from unauthorized access. We generally respond within 30 days. For complex requests, the response time may be extended by up to 60 additional days, as permitted by GDPR.

You also have the right to lodge a complaint with a supervisory authority. In France, the competent authority is the CNIL: https://www.cnil.fr. For general EU information, you may consult the European Data Protection Board: https://edpb.europa.eu.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a child under 16 without appropriate authorization, we will delete it promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Some third-party providers may offer their own mechanisms for limiting tracking; please refer to their documentation for details.

12. Account & Data Deletion Requests

We do not offer user accounts on this website. If you want us to delete personal data related to a booking request or email conversation, please send an email to [email protected] with the subject line “Data Deletion Request”. We will confirm receipt, may ask for identity verification, and then complete the request within 30 days where applicable. We may retain limited information if required by law or necessary to establish, exercise, or defend legal claims.

13. Business Transfers

If our business undergoes a merger, acquisition, asset sale, financing, reorganization, insolvency, or similar transaction, personal data may be transferred to a successor entity. If such a transfer materially changes how personal data is used, we will provide notice through the website before the change becomes effective.

14. California (CCPA / CPRA)

This section is provided for visitors from California. Over the past 12 months, we may have collected the following categories of personal information: identifiers (such as name, email address, IP address, cookie identifiers), internet or other electronic network activity information (such as browsing interactions), and inferences (such as interest categories derived from browsing activity) where marketing consent is granted.

We do not sell personal information as defined by CCPA. We may share personal information for cross-context behavioral advertising when you consent to marketing cookies. California residents may opt out of sharing for targeted advertising by using the cookie preferences panel and disabling marketing cookies.

Subject to certain limitations, California residents have the right to know, delete, correct, and opt out of sale/sharing, as well as the right to non-discrimination. You may submit requests by emailing [email protected] with the subject “California Privacy Request”. We will verify your identity before responding. Authorized agents may submit requests with written proof of authorization.

15. Virginia (VCDPA)

This section is provided for visitors from Virginia. Subject to the VCDPA, you may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject “Virginia Privacy Request”. If we deny your request, you may appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days. If the appeal is denied, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or service offerings. If we make material changes, we will provide a notice on the homepage at least 14 days before the changes take effect, where feasible. The “Last Updated” date at the top of this page will be refreshed whenever the policy is revised.

18. Contact

If you have questions about this Privacy Policy or how we handle personal data, please contact:

MK HOLDING SAS
18 Rue de Montreuil
75011 Paris, France
Email: [email protected]
Phone: +33 1 84 60 27 93