Privacy policy
In carrying out its activities, MAHDI NAÏM STUDIO processes personal data in compliance with applicable law, according to the principles of lawfulness, fairness and transparency, and with respect for the privacy and rights of every person concerned.
1. Data controller
This document is provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter “GDPR”) and to Moroccan Law no. 09-08 on the protection of individuals with regard to the processing of personal data. It describes how personal data of the users (hereinafter “User” or “Users”) of the website https://mahdinaimstudio.com (hereinafter “Website”) are processed.
The data controller is Mahdi Naïm — Mahdi Naïm Studio (hereinafter “Controller”):
- Lyon: 61c rue de Gerland, 69007 Lyon, France
- Casablanca: 6 Rue 6 Octobre, Etg 3, Appt 3, Boulevard Massira, 20000 Casablanca, Morocco
Any question or request concerning data protection may be sent to lyon@mahdinaimstudio.com.
2. Types of data collected
a) Navigation data. The computer systems and software used to operate the Website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols. This includes the IP addresses or domain names of the devices used to connect to the Website, the URI addresses of the requested resources, the time of the request, the method used to submit it, the size of the response, the status code returned by the server and other parameters relating to the User’s operating system and IT environment. These data are not collected in order to be associated with identified persons. They are used only to check the correct functioning and security of the Website, and could be used to establish liability in the event of a computer crime against the Website.
b) Data provided through the contact form or by e-mail. When a User fills in the contact form or writes to one of the addresses listed in the “Contact” section of the Website, the following data are processed: first name, last name, e-mail address, position, company, subject, message, and any other personal data the User chooses to share. These data are used solely to reply to the request and to follow up on it.
c) Data provided to receive updates. When a User enters an e-mail address in the “Get updates” field, that address is used to send news about the Studio’s projects, products and events.
d) Data relating to orders. When the online shop is open, the data needed to process an order are collected: name, postal and billing addresses, e-mail address, telephone number, order details and history. Payments are handled by third-party payment providers; the Controller has no access to complete card numbers.
e) Cookies. For the processing of data through cookies, please refer to the Cookie Policy.
3. Purposes and legal basis of the processing
Users’ data are processed by the Controller in order to:
ENSURE THE CORRECT FUNCTIONING AND SECURITY OF THE WEBSITE, which is the legitimate interest of the Controller in protecting the Website and the information exchanged through it against events or unlawful acts that could compromise the availability, authenticity, integrity and confidentiality of the data stored or transmitted. Legal basis: Art. 6(1)(f) GDPR.
MANAGE CONTACT REQUESTS, that is, reply to the requests sent by the User and take the steps preceding a possible collaboration. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures taken at the request of the data subject).
SEND UPDATES AND INVITATIONS about the Studio’s projects, products and events, only where the User has given consent by subscribing. Legal basis: Art. 6(1)(a) GDPR (consent).
PROCESS ORDERS placed in the online shop, including delivery, invoicing and after-sales service. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with accounting and tax obligations).
4. Mandatory or optional nature of the provision of data
Providing the data described in point 2(b) is optional. Without them, however, the Controller will not be able to answer the request.
Providing the data described in point 2(c) is optional. The User may withdraw consent at any time and without giving reasons, by clicking the unsubscribe link included in every message or by writing to lyon@mahdinaimstudio.com.
Providing the data described in point 2(d) is necessary to process an order. Without them, the order cannot be completed.
5. Method of processing
Data are processed electronically, and where necessary on paper, by persons authorised for this purpose, using methods strictly related to the purposes indicated above. The Controller applies technical and organisational measures to protect the data against manipulation, loss, destruction and access by unauthorised persons. These measures are reviewed in line with technological developments.
6. Recipients of the data
Personal data are processed only by the Controller and by service providers acting on its behalf as processors, bound by confidentiality and security obligations: the website hosting provider (LWS, servers located in France, European Union), the e-mail service provider and, for orders, payment and delivery providers. Where required by law, data may be disclosed to competent authorities. Data are never sold and are not disseminated.
The Website loads fonts from Google Fonts (Google Ireland Ltd.) and plays videos through the Bunny.net content delivery network. To deliver these resources, the User’s browser connects directly to their servers, which receive the User’s IP address. Where such providers may transfer data outside the European Union, these transfers are covered by the safeguards provided by the GDPR (adequacy decision or standard contractual clauses).
Because the Studio operates between France and Morocco, data concerning a request or project handled from Casablanca may be accessed from Morocco. Such access takes place under the safeguards provided by Chapter V of the GDPR and in compliance with Moroccan Law no. 09-08.
7. Retention period
Personal data are kept only as long as necessary for the purposes for which they were collected:
- navigation data: no longer than 12 months;
- contact requests: 3 years from the last exchange with the User;
- subscription to updates: until the User unsubscribes, or 3 years without any interaction;
- orders and invoices: for the duration of the contractual relationship, then archived for the periods required by law (10 years for accounting documents).
At the end of these periods, the data are deleted or anonymised. The rights of access, erasure, rectification and portability can therefore no longer be exercised after the retention period has expired.
8. Users’ rights
Pursuant to Articles 15 to 22 GDPR, every User has the following rights:
- Right to be informed
- Right of access to the data
- Right to rectification
- Right to erasure (“right to be forgotten”)
- Right to restriction of processing
- Right to data portability
- Right to object
- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal
Users residing in France may also give instructions regarding the fate of their data after their death (Article 85 of the French Data Protection Act).
A User who considers that the processing of their data infringes the applicable rules may lodge a complaint with a supervisory authority: in France, the Commission Nationale de l’Informatique et des Libertés (www.cnil.fr); in Morocco, the Commission Nationale de contrôle de la protection des Données à caractère Personnel (www.cndp.ma).
9. Exercise of rights
To exercise these rights, Users may write to lyon@mahdinaimstudio.com with the subject “Privacy – exercise of rights”, or by post to Mahdi Naïm Studio, 61c rue de Gerland, 69007 Lyon, France. A reply will be given within one month of receipt of the request.
Update of this Privacy Policy
This Privacy Policy was published in November 2026. Any updates will be published on this page.