Personal data annex

1. Purpose

This annex supplements Article 13 of the general terms of sale. It governs the processing of personal data that STUDIO FIEF carries out on behalf of the Client as part of the services, within the meaning of Article 28 of the GDPR. The Client is the controller; STUDIO FIEF is its processor.

2. Description of the processing

The quote specifies the processing for each engagement. Failing that:

• Lead ad campaign management: form answers (name, phone, email, city, free-text answers) of the Client’s prospects, to alert the Client to new leads and prepare follow-up. FIEF keeps only technical identifiers; internal alerts are kept for the period set out in the quote.
• Advertising reports: aggregated campaign statistics, in principle with no identified person, to manage the campaigns, for the duration of the engagement.
• Page management (comments and messages): public name, comment or message of the followers and contacts of the Client’s Pages, to alert the Client and reply on its behalf, for the period set out in the quote.
• studiofief.work: the Client’s user accounts, project content and files, social network connections, relating to the Client’s employees and contacts, for project follow-up and publishing, for the period set out in the quote.
• Websites, forms and newsletters hosted or maintained by FIEF: data collected by the forms on the Client’s website (visitors, the Client’s customers), for the purposes of the website, for the period set out in the quote.

3. STUDIO FIEF’s commitments

• Process the data only on the Client’s documented instructions (quote, written exchanges).
• Ensure the confidentiality of the persons authorised to process them.
• Implement appropriate security measures: named access, encrypted connections, separation between clients, secrets kept in a vault.
• Engage a sub-processor only with the Client’s general authorisation and inform it of any change. Current sub-processors: Meta Platforms Ireland, Google Cloud (Paris region), Google Workspace, OVH, Supabase (Frankfurt), Railway, Resend, Cloudflare.
• Help the Client respond to requests from data subjects exercising their rights.
• Notify the Client of any personal data breach without delay, and no later than 48 hours after becoming aware of it.
• Help the Client with impact assessments and prior consultation of the supervisory authority, where needed.
• At the end of the service, delete or return the data at the Client’s choice, and delete any copies.
• Make available to the Client the information needed to demonstrate compliance with these obligations, and allow audits with 30 days’ notice, at the Client’s expense.

4. The Client’s commitments

• Have a legal basis for the processing and inform the data subjects, in particular through a link to its privacy policy in each lead ad form, as required by Meta’s terms.
• Accept Meta’s lead ads terms for its own Page.
• Document its instructions in writing.

For the data FIEF processes on its own behalf, see our privacy policy and the Data deletion page.

Version of 02/11/2026.