01Privacy
Privacy policy
What this site collects, why, on what lawful basis, for how long, who has access to it and how to exercise your rights. Written under articles 13 and 14 of regulation (EU) 2016/679 and French law no. 78-17 of 6 January 1978 as amended.
Only the French version has legal effect. This English text is provided for information; where it differs from the French politique de confidentialité, the French version prevails.
02
Data controller
The controller is the legal entity that publishes this site, identified in the legal notice.
Appointing a data protection officer is mandatory only in the cases listed in article 37 GDPR. The field below must carry either the appointed officer's details or an explicit statement that none has been appointed.
- Registered company name
- I Will Code It
- Registered office address
- 27 rue d’Aubuisson, 31000 Toulouse, France
- SIREN number
- 848 265 104
- Contact address
- contact@iwci.io
- Data protection officer (DPO)
- Not appointed: the publisher falls under none of the cases listed in article 37 GDPR. Requests about personal data are handled at contact@iwci.io.
03
Contact form
The project brief form is the only point on this site through which you send us data. It collects nothing that does not change a decision: minimisation is an obligation under article 5.1.c GDPR before it is a design preference.
The retention period must be settled before launch. For business-to-business prospecting, the CNIL usually applies three years from the last contact; that reference is given as a benchmark and is not the publisher's decision.
The provider that will deliver and store enquiries has not been appointed. Until it is, neither the list of processors, nor where the data sits, nor the retention periods can be asserted here.
- Data you enter
- Name, email address, organisation and free-text message (required fields); role, project type, budget band and timing (optional fields). Two technical values accompany the submission: the language of the page and the identifier of the page you wrote from.
- Data processed without being entered
- The sender's IP address and the timestamp of the submission, for as long as it takes to verify that the submission is not automated and to limit how many messages come from one address.
- Purposes
- Answering your enquiry, qualifying the project and, where applicable, preparing a proposal. Preventing automated submissions and bulk solicitation.
- Lawful bases
- Legitimate interests of the controller (article 6.1.f GDPR): answering a business enquiry addressed to it, and protecting its form against automated submissions. Where the exchange leads to a proposal, processing falls under steps taken at your request prior to entering into a contract (article 6.1.b).
- Whether providing the data is required
- The four fields marked as required are what makes it possible to answer; without them we cannot reply. The “role”, “project type”, “budget band” and “timing” fields are optional and leaving them blank has no consequence.
- Internal recipients
- The members of the studio who handle the enquiry. No data is sold, rented, or used for advertising.
- Processors
- Vercel Inc. (site hosting and form processing, Paris region). The service that forwards form messages to the studio's inbox is named here as soon as it goes live.
- Transfers outside the European Union
- Vercel Inc. is established in the United States; form submissions are processed in the Paris region and static pages are served from its global network, without any form data.
- Retention period
- For as long as it takes to handle the enquiry and the exchange that follows, then deletion, at the latest twelve months after the last contact. The same period applies to the fallback logs described below.
- Automated decision-making and profiling
- A qualification flag is computed automatically on receipt, to route the enquiry internally. It produces no automated decision within the meaning of article 22 GDPR: a person reads every enquiry and writes every reply.
04
Server logs
As with any site reachable online, the servers that deliver this one record the requests they receive. Those logs are produced by the hosting provider; they are not audience measurement and are not used to follow you from site to site.
- Data
- Access logs: IP address, date and time of the request, page requested, response code, user agent and, where present, the referring page. If a contact enquiry cannot be delivered, the form contents may also be written to the server logs for recovery.
- Purposes
- Keeping the service running and secure, detecting abuse, diagnosing incidents.
- Lawful bases
- Legitimate interests (article 6.1.f GDPR) for security and diagnostics. Legal obligation (article 6.1.c) for the retention required by article 6 of the LCEN and decree no. 2021-1362.
- Hosting provider and processor
- Vercel Inc., Paris region (cdg1)
- Retention period
- Twelve months, the period required by decree no. 2021-1362 for connection data.
06
Your rights
You have, over data concerning you, a right of access, rectification, erasure, restriction of processing, objection, and portability where the processing rests on your consent or on a contract. You may also give directions on what happens to your data after your death, under article 85 of French law no. 78-17 of 6 January 1978 as amended.
Because enquiries received through the form are processed on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.
These rights are exercised by email to the address below. You may be asked to prove your identity where there is reasonable doubt. A reply is given within one month of receipt, extendable by two months for complex requests, in which case you are told.
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), at www.cnil.fr.
- Address for exercising your rights
- contact@iwci.io
07
Security
The site is served over HTTPS only. Form data never travels in the page address: it is sent by a POST request, and values shown back after a validation error travel in a cookie inaccessible to JavaScript, never in a URL parameter. A message placed in a URL ends up in server logs and in the header sent to every site visited afterwards.
08
Changes to this policy
This policy is updated whenever the processing described here changes, in particular when audience measurement is introduced or a processor is appointed. The date of the last update is below.
- Last updated
- 9 September 2026
- Document version
- 1.0