Last updated: April 2026
1. Data controller
The controller of personal data collected via the website mbta.fr is:
| Company | M.B.T.A (SAS) |
| Legal representative | Marc Bizet, President |
| SIRET | 513 947 325 00017 |
| Address | 14 rue des Pavillons, 93100 Montreuil, France |
| mbtafr@gmail.com | |
| Phone | 06 14 32 24 99 |
M.B.T.A is committed to processing your personal data in compliance with the General Data Protection Regulation (GDPR) — EU Regulation 2016/679 — and the French Data Protection Act (loi Informatique et Libertés) of 6 January 1978, as amended.
2. Data collected and purposes
M.B.T.A collects only the data strictly necessary for the performance of its services. No data is collected for commercial profiling purposes or sold to third parties.
| Purpose | Data processed | Legal basis |
|---|---|---|
| Responding to a quote / contact request | Name, first name, email, phone, message | Legitimate interest (Art. 6.1.f) |
| Order processing and follow-up | Name, address, email, phone, order details | Contract performance (Art. 6.1.b) |
| Online payment | Payment data (processed by Stripe — not stored by MBTA) | Contract performance (Art. 6.1.b) |
| Order confirmation | Email, name, order summary | Contract performance (Art. 6.1.b) |
| Invoicing and accounting obligations | Name, address, amount, order reference | Legal obligation (Art. 6.1.c) |
| Website improvement (anonymous analytics) | Anonymised browsing data | Legitimate interest (Art. 6.1.f) |
3. Retention periods
| Data category | Retention period |
|---|---|
| Contact data / unconverted quote | 1 year from last contact |
| Order data (customer) | 5 years from order date (commercial prescription) |
| Invoicing data | 10 years (legal accounting obligation) |
| Anonymised browsing data | Maximum 13 months (CNIL recommendation) |
Beyond these periods, data is permanently deleted or irreversibly anonymised.
4. Data recipients
Your personal data is processed by M.B.T.A and is not sold to third parties. It may be shared with the following sub-processors, strictly within the scope of their services:
- OVH SAS — website hosting (Roubaix, France) — data stored in France
- Stripe Inc. — secure payment processing (PCI-DSS certified)
- Carriers (Colissimo, Chronopost) — name and delivery address only
These sub-processors are contractually bound to maintain data confidentiality and comply with the GDPR. No transfer of data outside the European Union is carried out without appropriate safeguards.
5. Your rights
In accordance with the GDPR (Articles 15 to 22), you have the following rights over your personal data:
- Right of access — obtain a copy of the data relating to you
- Right of rectification — correct inaccurate or incomplete data
- Right to erasure — request the deletion of your data ("right to be forgotten"), subject to legal retention obligations
- Right to restriction — temporarily suspend the processing of your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — at any time, without affecting prior processing
If you believe your rights are not being respected, you may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — French Data Protection Authority, equivalent to the ICO in the UK, BfDI in Germany, AEPD in Spain) — 3 Place de Fontenoy, 75007 Paris — www.cnil.fr
6. Cookies and trackers
A cookie is a small text file deposited on your device when you visit a website. The website mbta.fr uses a minimal number of cookies, in line with CNIL recommendations.
| Cookie | Purpose | Duration |
|---|---|---|
| mbta-theme | Remember your theme preference (light/dark) | Permanent (localStorage) |
| mbta-lang | Remember your language preference (FR/EN) | Permanent (localStorage) |
| snipcart-* | Shopping cart management (Snipcart) | Session / 30 days |
| __stripe_* | Fraud prevention during payment (Stripe) | Session |
Preference cookies (theme, language) do not require consent as they are strictly necessary for the functioning of the service requested by the user. Snipcart and Stripe cookies are activated only when interacting with the shop.
You may configure your browser to refuse cookies. Please note: some shop features may not work correctly without cookies.
7. Data security
M.B.T.A implements appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction:
- Secure HTTPS connection (TLS) throughout the website
- Hosting with OVH in France (ISO 27001 certified data centres)
- Payments processed exclusively via Stripe (PCI-DSS Level 1) — no banking data stored by MBTA
- Data access restricted to authorised personnel only
In the event of a data breach likely to give rise to a risk to your rights and freedoms, M.B.T.A will notify the CNIL within 72 hours and inform you as soon as possible, in accordance with Article 33 of the GDPR.
8. Contact and quote form
Information entered in the contact or quote request form is sent to M.B.T.A by secure email. This data is used exclusively to respond to your enquiry. It is not recorded in a commercial database or used for prospecting purposes without your consent.
Fields marked as mandatory (*) are the only ones required to process your request. Their absence would prevent us from responding to you.
9. Minors
The website mbta.fr is intended for professional or adult audiences. M.B.T.A does not knowingly collect personal data from persons under the age of 16. If you are a parent or legal guardian and believe your child has provided us with personal data, please contact us at mbtafr@gmail.com so that we may arrange its deletion.
10. Policy updates
M.B.T.A reserves the right to amend this privacy policy at any time, in particular to comply with evolving regulations. The version in force is the one published on this page, with the last updated date indicated at the top.
In the event of a substantial amendment affecting your rights, we will notify you by email if we hold your contact details, or via a banner on the website.
11. Contact and complaints
For any questions relating to the protection of your personal data or to exercise your rights:
By email: mbtafr@gmail.com
By post: M.B.T.A — Marc Bizet, 14 rue des Pavillons, 93100 Montreuil, France
By phone: 06 14 32 24 99
Competent supervisory authority: CNIL — Commission Nationale de l'Informatique et des Libertés (French Data Protection Authority)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr