Privacy Policy

Effective Date: March 2026; Last Updated: March 2026

1. Who We Are

Alchimie Marketing is a trading name operated by Stephanie Ayars, a sole trader registered in France (SIRET 914 942 578 00016), based in Nice, France 06300. We provide marketing strategy, communications consulting, content development, and related advisory services to clients across a range of industries.

Alchimie Marketing is also conducting market research into the feasibility of a healthcare navigation service designed to assist English-speaking expatriates living in or relocating to France. This research is in a pre-commercial phase. No healthcare product is currently available for sale.

For the purposes of data protection law, Stephanie Ayars, trading as Alchimie Marketing, is the data controller in respect of all personal data collected through this website and research activities.

Data Controller: Alchimie Marketing (Stephanie Ayars)
Website: www.alchimiemarketing.com
SIRET: 914 942 578 00016 — Nice, France 06300
Privacy Contact: stephanie@alchimiellc.com

2. What Personal Data We Collect and Why

We collect personal data only in specific, defined circumstances. We do not collect data speculatively or in bulk. The table below describes each data collection activity, what data is involved, and the legal basis under GDPR.

2.1  Website Contact Form

When you submit an enquiry via the contact form on www.alchimiemarketing.com, we collect:

  • Your name

  • Your email address

  • The content of your message

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — responding to a business enquiry you have voluntarily initiated. Where enquiries may lead to a contractual relationship, we may also rely on Article 6(1)(b).

Purpose: To respond to your enquiry and, if appropriate, discuss a potential engagement with Alchimie Marketing.

Retention: Enquiry data is retained for up to 24 months from the date of last contact, then deleted unless a client relationship is established.

2.2  Market Research Survey

Alchimie Marketing is currently conducting market research to assess demand for a potential future service that would help English-speaking expatriates navigate the healthcare system in France. This research is in a pre-commercial phase only. No product is currently sold or offered.

Anonymous survey responses
Responses to survey questions 1 through 9 are collected anonymously. We do not collect your name or email address in connection with these questions, and we have no way to identify you from your answers.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — conducting market research to inform a potential future business decision. No personal data is processed at this stage.

Retention: Anonymous responses are retained for up to 2 years from the date of collection.

Email opt-in (survey question 10)
At the end of the survey, you may voluntarily provide your first name, last name, and email address if you wish to receive updates about the development of this service. This is entirely optional. If you do not provide your email, your survey responses remain fully anonymous.

Legal basis: Consent (Article 6(1)(a) GDPR) — your explicit, freely given, specific, informed, and unambiguous opt-in via a checkbox. You may withdraw consent at any time.

Purpose: To send you occasional updates about the research initiative and, if the service launches, information about its availability. We will never send unrelated commercial communications.

Retention: Your contact details are retained until you unsubscribe, plus one additional year for suppression list compliance. Following an unsubscribe, we retain only your email address on our suppression list to ensure you are not contacted again.

2.3  Website Analytics

Our website may use analytics tools (such as Google Analytics) to collect anonymous information about how visitors interact with www.alchimiemarketing.com. This may include pages visited, time spent on the site, browser type, and approximate geographic location. This data is not linked to any individual and is used solely to improve the website experience.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) — understanding how our website is used so we can improve it.

3. How We Use Your Data

We use personal data only for the purpose for which it was collected. We do not sell, rent, trade, or otherwise disclose your personal data to third parties for their own marketing purposes.

Specifically, we use your data to:

  • Respond to enquiries submitted through the website contact form

  • Communicate with existing and prospective clients about services

  • Send research update emails to individuals who have explicitly opted in via the market research survey

  • Analyze anonymous survey responses to inform future business development decisions

  • Comply with our legal obligations

  • Protect the security and integrity of our systems and services

4. Third-Party Data Processors

We use a small number of trusted third-party tools to operate our business and research activities. Each of these companies acts as a data processor on our behalf, meaning they process data only according to our instructions and are bound by data processing agreements.

  • Tally.so: Survey platform used for survey form hosting and response collection (Ireland - EU) (tally.so/privacy)

  • HubSpot, Inc.: CRM and email marketing platform used for contact management and email communication for opted-in subscribers only (USA / EU - US DPF) (legal.hubspot.com/dpa)

  • Airtable, Inc.: Database and research workspace used for storage and analysis of survey research data (USA - SCCs in place) (airtable.com/privacy)

  • Zapier, Inc.: Automation / data routing used for routing opted-in contact data from Tally to HubSpot (USA - SCCs in place) (zapier.com/privacy)

  • Google LLC: Website analytics used for anonymous website traffic analysis via Google Analytics (USA / EU US DPF) (policies.google.com/privacy)

NOTE: We have reviewed each processor's Data Processing Agreement (DPA) and privacy documentation. We will update this table as our tech stack evolves.

5. International Data Transfers

Alchimie Marketing is operated by Stephanie Ayars, based in Nice, France. Some of our third-party processors are US-based companies. If you are located in the European Union or European Economic Area, your personal data may be transferred to and processed in the United States by these processors.

We ensure that any such transfers are carried out with appropriate safeguards in place, in accordance with GDPR Chapter V. These safeguards include:

  • EU-US Data Privacy Framework (DPF) — HubSpot and Google are certified participants in the EU-US DPF, which provides a valid legal mechanism for transatlantic data transfers.

  • Standard Contractual Clauses (SCCs) — For processors not covered by the DPF (including Airtable and Zapier), we rely on the European Commission’s approved Standard Contractual Clauses.

  • HubSpot EU Data Residency — We have configured HubSpot to store contact data on EU-based servers where this option is available.

You may request a copy of the relevant transfer safeguards by contacting stephanie@alchimiellc.com.

6. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

  • Website contact form inquiries are retained for up to 24 months from last contact; Deletion trigger is auto-delete or manual review at 24 months, unless a client relationship is established

  • Anonymous survey responses (Q1-9) are retained for up to 2 years from collection; Deletion trigger is action or data deletion request; email retained on suppression list

  • Open-text survey responses linked to email are retained in the same manner as email opt-ins; Deletion trigger is within 30 days of a verified data erasure request

  • CRM contact records (HubSpot) are retained and active until unsubscribe; Deletion trigger is suppressed on unsubscribe; fully deletable on verified request

7. Your Data Protection Rights

Depending on your location, you have certain rights in relation to your personal data. If you are located in the EU/EEA, the following rights apply to you under GDPR:

‍ ‍Right of Access (Art. 15): Request a copy of all personal data we hold about you
‍ ‍ Right to Rectification (Art. 16): As us to correct inaccurate or incomplete data
‍ ‍Erasure (Art. 17): As us to delete your data where there is no compelling reason for continued processing.
‍ ‍Restrict Processing (Art. 18): Ask us to pause processing your data in certain circumstances.
‍ ‍Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
‍ ‍Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
‍ ‍Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
‍ ‍Right to Lodge a Complaint (Art. 77): Lodge a complaint with your national supervisory authority at any time.

To exercise any of these rights, please contact us at stephanie@alchimiellc.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

We will not charge a fee for reasonable requests. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to act, and we will explain why.

8. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with your national data protection supervisory authority.

If you are located in France, the relevant authority is:

Commission Nationale de l’Informatique et des Libertés (CNIL)
www.cnil.fr
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
+33 1 53 73 22 22

If you are located in another EU/EEA member state, please contact your national supervisory authority. A full list of EU data protection authorities is available at edpb.europa.eu.

We would, however, always appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact us first at stephanie@alchimiellc.com.

9. Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience and to understand how visitors interact with our site.

9.1  What are cookies?

Cookies are small text files placed on your device by a website when you visit. They allow the website to remember certain information about your visit, such as your preferences or whether you have previously visited the site.

9.2  Types of cookies we use

  • Essential cookies — Necessary for the website to function correctly. These cannot be disabled.

  • Analytics cookies — Help us understand how visitors use our site (e.g., Google Analytics). These are anonymous and aggregate only.

  • Preference cookies — Remember settings or choices you have made to personalise your experience.

9.3  Your choices

You can control and manage cookies in your browser settings. Please note that disabling certain cookies may affect the functionality of our website. Most browsers allow you to refuse cookies or to delete cookies that have already been set.

Where required by law, we will ask for your consent before placing non-essential cookies on your device.

10. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, alteration, or disclosure.

These measures include:

  • Using reputable, security-certified third-party processors with their own robust security programmes

  • Limiting access to personal data to those within Alchimie Marketing who have a genuine need to access it

  • Storing opted-in contact data on EU-based servers via HubSpot’s EU data residency feature

  • Using encrypted connections (HTTPS) for all data transmission via our website and third-party tools

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.

11. Children’s Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at stephanie@alchimiellc.com and we will delete that data promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business activities, the services we use, or applicable law. When we make material changes, we will update the “Last Updated” date at the top of this document and, where appropriate, notify you by email or by a prominent notice on our website.

We encourage you to review this Policy periodically. Your continued use of our website or services after any changes constitutes your acknowledgement of the updated Policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way we handle your personal data, please contact us:

‍ ‍Company: Alchimie Marketing (Stephanie Ayars)
‍ ‍SIRET: 914 942 578 00016 — Nice, France 06300
‍ ‍Website: www.alchimiemarketing.com
‍ ‍Email: stephanie@alchimiellc.com
‍ ‍Subject line: Please use: “Privacy Request — [Your Name]”
‍ ‍Response time: We aim to respond to all privacy requests within 30 days.