MALPAIS

Privacy policy

This policy explains what personal data MALPAIS processes, why, on what legal basis, with whom and for how long, and how to exercise your rights. It applies Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi n° 78-17 du 6 janvier 1978, “Informatique et Libertés”).

This English version is a translation provided for convenience. The French version, politique de confidentialité, prevails.

Controller

Paolo Rossetto, French sole trader (entrepreneur individuel, EI), trading as MALPAIS.

MALPAIS has not appointed a data protection officer, as its activity does not require one. Any question can be sent to the address above.

Audience measurement

To see how the site is used and improve it, MALPAIS uses PostHog, an analytics service. Everything goes through malpais.studio itself, which passes it on to PostHog: no script is loaded from another site.

By default: anonymous, without cookies

Unless you accept the option described below, and if you refuse it, visits are counted without cookies and without storing anything on your device. What is measured: the pages viewed, clicks and how far you scroll, how fast pages load, the site you came from and the campaign tags in the link (utm_…), and your browser, type of device and screen size. To tell visits apart, PostHog computes on its servers an identifier from your IP address and browser that changes every day, so a visit cannot be linked to your visits on other days or on other sites. Your IP address is used for this and then discarded: MALPAIS’s analytics project is set not to store IP addresses.

  • Purpose: measuring the site’s audience and how it performs, to improve it. These statistics are used by MALPAIS alone, are never combined with other data and are not used to follow you on other sites.
  • Legal basis: MALPAIS’s legitimate interest in measuring its website’s audience (GDPR Art. 6(1)(f)).
  • Retention: one year.
  • Your right to object: you can stop this counting on this browser at any time. A single setting is then stored on your device so that your choice is remembered, and nothing is measured on this browser any more.

If you accept: cookies and session recordings

If you click “Accept” in the banner, PostHog also stores an identifier on your device (a cookie and local storage) so that your visits from this browser are linked together, and records how the pages are used: page changes, mouse movements, clicks and scrolling, which can be replayed. Everything you type in a field is masked in your browser before anything is sent. If you then send the contact form, the sending is linked to these visits; your name, email address, company and message never go to PostHog.

  • Legal basis: your consent (GDPR Art. 6(1)(a) and Art. 82 of the French Data Protection Act).
  • Retention: recordings, 30 days; other measurements, one year; the identifier on your device, one year.
  • Withdrawing your consent: at any time, as easily as you gave it, from “analytics choice” at the bottom of every page or with the button below. Refusing changes nothing about how you can use the site.

Host’s technical logs

The website is delivered by Cloudflare, which hosts and distributes it. On each visit, Cloudflare processes technical data: IP address, browser and operating system (“user agent”), page requested, date and time.

  • Purpose: delivering the website and protecting it against abuse and attacks.
  • Legal basis: MALPAIS’s legitimate interest in an available and secure website (GDPR Art. 6(1)(f)).
  • Retention: as set by the host, limited to what delivering and securing the website requires.

MALPAIS does not use these logs to identify visitors or to measure audience.

Contact form

When you use the contact form, the following information is sent:

  • your name;
  • your email address;
  • your company;
  • the topics you chose;
  • your message, if any (optional);
  • the language of the page, its address and any campaign tags in it (utm_…).

The form sends it, through a function run by the host on malpais.studio, to an email delivery provider, Resend, Inc. (United States). The provider delivers it to MALPAIS’s inbox and sends you an automatic acknowledgement. Nothing is stored on the website itself.

As soon as your message arrives, MALPAIS is alerted on its phone through Telegram. The alert contains only your name or company, the language of the page and its campaign tag: not your email address, not your message. The sending is also counted in the audience measurement (see above), without your name, email address, company or message.

If the form is unavailable, the website opens your own email application instead: your message then reaches us as an ordinary email.

  • Purpose: answering your request and, where relevant, preparing a conversation or a proposal.
  • Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)); for a general question, MALPAIS’s legitimate interest in answering people who contact it (GDPR Art. 6(1)(f)).
  • Required fields: only your email address, so that we can reply; the other fields are optional.
  • Retention: three years from your last contact, unless a contract follows (see “Clients”).

Booking a call

The links to book a call lead to a page hosted by Cal.com, Inc. (United States). Nothing from that service is loaded on malpais.studio: you only reach it by clicking.

The information you enter there (name, email address, chosen time slot and, where applicable, your answers) is passed to MALPAIS to prepare the call, with the same purpose, legal basis and retention period as the contact form. Cal.com, Inc. (United States) acts as a service provider to MALPAIS and also applies its own privacy policy, available from its page.

Business-to-business prospecting

MALPAIS may contact by email professionals whose work its services may concern. If you receive such a message, your data was not collected from you; here is the information required by Article 14 GDPR.

  • Source: public professional sources (your company’s website, professional directories and registers, public professional profiles).
  • Data: first and last name, job title, company and sector, professional email address and, where applicable, professional phone number, and the history of our exchanges.
  • Purpose: presenting MALPAIS services relevant to your role.
  • Legal basis: MALPAIS’s legitimate interest in prospecting professionals (GDPR Art. 6(1)(f)), within the framework set by the CNIL: the message relates to your professional activity, you are informed that your details are used, and you can easily object.
  • Right to object: at any time, without giving a reason and free of charge, by simply replying to the message or writing to hello@malpais.studio. Every message reminds you of this.
  • Retention: three years from collection or from your last contact. After an objection, only your email address is kept, on a suppression list, for three years, so that you are not contacted again.

Clients

For client companies, MALPAIS processes the contact details of its counterparts, contract documents, exchanges related to the engagement, and billing data.

  • Purposes: performing the engagement, invoicing, meeting accounting and tax obligations.
  • Legal basis: performance of the contract (GDPR Art. 6(1)(b)) and legal obligations (GDPR Art. 6(1)(c)).
  • Retention: invoices and accounting records, ten years (French Commercial Code, Art. L. 123-22); contracts, for the applicable limitation period; other data, for the duration of the relationship and then three years from the last contact.

Where, during an engagement, MALPAIS processes personal data on behalf of a client, it acts as a processor within the meaning of Article 28 GDPR: that processing is governed by the contract with the client, which remains the controller.

Recipients

The data is intended for Paolo Rossetto only. It is never sold, rented or transferred. Only the following have access, within the limits of their role:

  • Cloudflare, for hosting and delivering the website and routing the form;
  • Resend, Inc. (United States), for transmitting form messages and the acknowledgement;
  • Telegram, for the instant alert of a new message (your name or company only);
  • PostHog, for audience measurement;
  • Cal.com, Inc. (United States), for call booking;
  • the providers of MALPAIS’s email and work tools;
  • MALPAIS’s chartered accountant, for client billing data only;
  • public authorities, where the law requires it.

Technical service providers act on behalf of MALPAIS and on its instructions.

Transfers outside the European Union

Some providers, including Cloudflare, Inc. and PostHog, Inc., are established in the United States or may process data outside the European Union. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it and, failing that, on the standard contractual clauses adopted by the European Commission (GDPR Art. 46). You can obtain information about these safeguards by writing to hello@malpais.studio.

Your rights

Under the conditions set by the GDPR, you have the right to access, rectify and erase your data, to restrict its processing, to object to it and to data portability (GDPR Arts. 15 to 21), as well as the right to set instructions on what happens to your data after your death (Art. 85 of the French Data Protection Act). You can object at any time, without giving a reason, to the use of your data for prospecting.

To exercise these rights, write to hello@malpais.studio. You will receive an answer within one month, which may be extended in the cases set out in Article 12 GDPR. If there is reasonable doubt about your identity, proof may be requested.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): www.cnil.fr.

No automated decision-making

MALPAIS takes no decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Changes

This policy is updated when the processing changes, in particular before any new tool or provider is added. The version in force is the one published on this page.

Last updated: 09.10.2026 · Version française