This Privacy Policy sets out how Lopsa Marketing (the trading name of Evija Lopsa — Entrepreneur Individuel) collects, processes, stores, and protects personal data in connection with the operation of https://lopsamarketing.online (the “Website”), the provision of B2B digital marketing consulting services, and the supply of professional digital assets.
This policy is issued in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable French data-protection legislation. It should be read alongside our Cookie Policy and Legal Notice.
Continued use of this Website or engagement with our services constitutes acknowledgement of this policy. Where processing is based on consent, a separate and explicit consent mechanism is provided.
1. Data Controller
The entity responsible for determining the purposes and means of processing personal data collected through this Website and associated services is:
| Trading name | Lopsa Marketing |
|---|---|
| Legal entity | Evija Lopsa — Entrepreneur Individuel (EI) |
| SIREN | 106 733 785 |
| SIRET | 10673378500013 |
| APE / NAF code | 7021Z — Conseil en relations publiques et communication |
| Registered address | 12 Rue de la Roquette, 75011 Paris, France |
| Privacy contact | info@lopsamarketing.online |
| Telephone | +34 637 725 541 |
| Website | https://lopsamarketing.online |
2. Scope of This Policy
This Privacy Policy applies to personal data processed when an individual or business representative:
- Visits, browses, or otherwise interacts with the Website
- Submits an enquiry or contact form
- Engages Lopsa Marketing for strategic consulting or public relations services
- Purchases professional digital assets, including frameworks, templates, and implementation guides
- Corresponds with us by email, telephone, or any other channel
This policy does not apply to third-party websites linked to from this Website. We encourage you to review the privacy policies of any external sites you visit.
3. Categories of Personal Data Collected
We collect only the personal data that is necessary for the purposes described in this policy. The categories of data we may collect are as follows:
3.1 Identity and Contact Data
- Full name
- Professional email address
- Company name and registered address
- Professional role or job title
- Billing address
- Country or region of residence
3.2 Engagement and Project Data
- Business objectives and commercial requirements shared during an engagement
- Project briefs, strategy documents, and deliverable artefacts
- Written correspondence and communication logs relating to service delivery
3.3 Transaction and Financial Data
- Order reference numbers and purchase history
- Payment status and transaction confirmation records
- Refund history and related correspondence
Important: We do not store, access, or retain full payment card numbers, CVV codes, or any sensitive authentication data. All payment card data is handled exclusively by our PCI-DSS certified payment service providers.
3.4 Technical and Usage Data
- IP address and approximate geographic location
- Browser type and version
- Device type and operating system
- Pages visited, navigation paths, and session duration
- Referral source and traffic channel
- Interaction timestamps
3.5 Communication Preferences
- Opt-in and opt-out records for professional updates and marketing communications
- Consent timestamps and records where processing is consent-based
4. Purposes of Processing and Legal Bases
We process personal data only where a valid legal basis exists under Article 6 of the GDPR. The table below sets out each processing purpose and the corresponding legal basis:
| Purpose | Legal basis |
|---|---|
| Responding to pre-sales enquiries and scoping requests | Art. 6(1)(b) — steps prior to contract |
| Delivering contracted consulting services and digital assets | Art. 6(1)(b) — contractual necessity |
| Processing payments and issuing invoices | Art. 6(1)(b) — contractual necessity |
| Processing refund requests and managing disputes | Art. 6(1)(b) — contractual necessity |
| Maintaining accounting, tax, and financial records | Art. 6(1)(c) — legal obligation (French CGI and commercial law) |
| Complying with court orders, regulatory requests, or legal proceedings | Art. 6(1)(c) — legal obligation |
| Website security, access logging, and infrastructure protection | Art. 6(1)(f) — legitimate interests |
| Fraud detection, abuse prevention, and transaction monitoring | Art. 6(1)(f) — legitimate interests |
| Improving service quality and internal operational processes | Art. 6(1)(f) — legitimate interests |
| Analytics cookies and Website performance measurement | Art. 6(1)(a) — consent |
| Direct marketing communications to existing clients | Art. 6(1)(a) — consent (or Art. 6(1)(f) where soft opt-in applies) |
Where processing is based on legitimate interests, we have assessed that those interests are not overridden by the rights and freedoms of the individuals concerned, given the B2B nature of our services and the limited scope of data processed.
5. Payment Processing and Data Security
5.1 Payment Processing
All financial transactions are processed through certified third-party Payment Service Providers (PSPs) operating under PCI-DSS compliance standards. These providers receive only the transaction data strictly necessary to authorise payments, detect fraud, and process refunds. Lopsa Marketing does not store, process, or have access to full payment card numbers, security codes, or authentication credentials at any point.
Accepted payment methods include major credit and debit cards, iDEAL, and Bancontact. For Bancontact transactions specifically, where standard chargeback procedures are not available, we provide direct manual refunds for eligible claims for up to 365 calendar days from the purchase date.
5.2 Technical Security Measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- TLS encryption for all data transmitted between the user’s browser and our servers
- Role-based access controls limiting internal access to personal data
- Secure hosting infrastructure with continuous availability monitoring
- Regular review of third-party processor security standards
- Automated fraud screening and anomaly detection on transaction flows
6. Disclosure of Personal Data to Third Parties
We do not sell, rent, or trade personal data to any third party for commercial or marketing purposes. Personal data is disclosed only in the following limited circumstances:
6.1 Service Providers Acting as Data Processors
We engage a limited number of third-party service providers who process personal data on our behalf and under our instruction, pursuant to data processing agreements compliant with Article 28 GDPR. These providers include:
- Payment service providers — for transaction authorisation, fraud prevention, and refund processing
- Hosting and infrastructure providers — for Website operation and data storage (Hostinger International Ltd., Cyprus)
- Analytics providers — for aggregated, pseudonymous Website usage data (where consented)
- Email delivery services — for transactional and support communications
6.2 Legal and Regulatory Authorities
We may disclose personal data to competent authorities, courts, or regulators where required by applicable French or European Union law, or where necessary to establish, exercise, or defend legal claims.
6.3 Business Reorganisation
In the event of a merger, acquisition, transfer of business assets, or other organisational restructuring, personal data held by Lopsa Marketing may be transferred to the successor entity. Any such transfer will be subject to equivalent data-protection safeguards, and affected individuals will be notified in advance where required by law.
7. International Data Transfers
Where personal data is transferred to recipients located outside the European Union or European Economic Area (EU/EEA), we ensure that an adequate level of protection is maintained. Transfer mechanisms we rely on include:
- Adequacy decisions issued by the European Commission for the recipient country
- Standard Contractual Clauses (SCCs) as approved by the European Commission under Article 46(2)(c) GDPR
- Binding Corporate Rules or other approved transfer mechanisms where applicable
Copies of the relevant transfer safeguards may be requested by contacting us at info@lopsamarketing.online.
8. Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our standard retention schedule is as follows:
| Data category | Retention period |
|---|---|
| Consultancy and project engagement records | Duration of engagement plus 36 months for continuity and follow-up support |
| Financial records, invoices, and transaction history | 10 years from the date of the transaction, in accordance with French accounting and tax obligations (Code de commerce and CGI) |
| Pre-sales enquiry and contact form data | 12 months from last contact, unless an engagement commences |
| Website analytics data | Anonymised or aggregated within 13 months of collection; no individually identifiable records retained beyond that period |
| Consent records (marketing and cookies) | 3 years from the date of consent or last interaction |
| Security and access logs | Up to 12 months, unless retention is required for an ongoing investigation |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where deletion is not immediately practicable due to technical constraints, data is restricted from active processing until deletion can be completed.
9. Your Rights Under the GDPR
Individuals whose personal data we process have the following rights under Chapter III of the GDPR. These rights apply regardless of the legal basis on which processing takes place, subject to limited exemptions provided for in applicable law.
| Right | Description |
|---|---|
| Access (Art. 15) | Obtain confirmation of whether we process your personal data and receive a copy of that data. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data without undue delay. |
| Erasure (Art. 17) | Request deletion of personal data where it is no longer necessary for the purpose for which it was collected, or where processing was unlawful. |
| Restriction (Art. 18) | Request that we limit how we use your personal data in certain defined circumstances. |
| Portability (Art. 20) | Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is automated and based on consent or contract. |
| Objection (Art. 21) | Object to processing based on legitimate interests or carried out for direct marketing purposes. |
| Withdraw consent (Art. 7(3)) | Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing. |
To exercise any of the above rights, submit a written request to info@lopsamarketing.online. We will acknowledge receipt within one business day and respond substantively within 30 calendar days in accordance with Article 12 GDPR. Where a request is complex, this period may be extended by a further two months; we will notify you of any such extension and the reasons for it.
We may request verification of your identity before processing a data-subject request, in order to protect the security of personal data held about other individuals.
10. Automated Decision-Making and Profiling
Lopsa Marketing does not carry out any automated decision-making processes — including profiling — that produce legal or similarly significant effects on individuals, as described in Article 22 GDPR.
Standard fraud-screening processes performed by our payment service providers may involve automated systems. Where such screening results in a significant outcome (such as a declined transaction), appropriate human review is available upon request. These processes are operated by the relevant PSP and are subject to their own GDPR compliance obligations.
11. Supervisory Authority and Complaints
If you have concerns about how we handle your personal data and are not satisfied with our response, you have the right to lodge a complaint with the competent data-protection supervisory authority. For individuals located in France, the supervisory authority is:
Commission Nationale de l’Informatique et des Libertés (CNIL)
3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France
www.cnil.fr
Individuals resident in other EU/EEA member states may alternatively lodge a complaint with the supervisory authority in their country of habitual residence.
12. Updates to This Privacy Policy
We review this Privacy Policy periodically and update it when required to reflect changes in our processing activities, applicable law, or regulatory guidance. Where changes are material, we will bring them to your attention through a prominent notice on the Website prior to the changes taking effect.
The version number and “Last reviewed” date at the top of this document indicate when this policy was most recently revised. We encourage you to review this page periodically.
13. Contact
For any questions, requests, or concerns relating to this Privacy Policy or our data-processing practices, please contact us at:
Lopsa Marketing — Evija Lopsa, Entrepreneur Individuel
12 Rue de la Roquette, 75011 Paris, France
info@lopsamarketing.online
+34 637 725 541