Privacy & Cookie Policy

Last updated: 11 November 2026

This policy explains what personal data PROJECT 1804 collects through 1804bureau.com and in its business relationships, why, on what legal basis, for how long, and which rights you have under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Who is responsible

The controller is PROJECT 1804, SASU with share capital of €8,000, RCS Paris 999 748 353, registered office at 60 rue François 1er, 75008 Paris, France. For any privacy matter, write to hello@project-1804.com. We have not appointed a Data Protection Officer because the law does not require one for our activity; the Président handles privacy requests personally.

2. What we collect and why

Answering your enquiry (email, phone, brief form)

• Data: Name, email, phone number and country, role in your company, project description, our correspondence
• Legal basis: Steps taken at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f))
• Retention: 3 years from your last contact with us if no contract follows

Running client projects

• Data: Contact details of client representatives, briefs, project files, correspondence, quotes, contracts
• Legal basis: Performance of the contract (Art. 6(1)(b))
• Retention: Length of the contract, then 5 years (limitation period for claims)

Invoicing and accounting

• Data: Client company identity, representatives’ names, invoices, payment records
• Legal basis: Legal obligation (Art. 6(1)(c))
• Retention: 10 years from the end of the financial year

Keeping professional contacts informed about our work

• Data: Name, professional email, company, role
• Legal basis: Legitimate interest (Art. 6(1)(f)); you can opt out at any time
• Retention: 3 years from your last contact with us; for clients, 3 years after the relationship ends

Website audience measurement (Google Analytics)

• Data: Pseudonymous identifiers, pages viewed, approximate location, device and browser data
• Legal basis: Your consent (Art. 6(1)(a))
• Retention: Cookies up to 13 months; statistics up to 14 months

Advertising measurement (Meta Pixel)

• Data: Pseudonymous identifiers, pages viewed, browser data, IP address
• Legal basis: Your consent (Art. 6(1)(a))
• Retention: Cookies up to 90 days

Operating and securing the Website

• Data: IP address, browser data, technical logs
• Legal basis: Legitimate interest in delivering a secure website (Art. 6(1)(f))
• Retention: Up to 12 months, as set by our hosting and delivery providers

Applications (job, internship, freelance)

• Data: CV, portfolio, contact details, correspondence
• Legal basis: Steps taken at your request before a contract and legitimate interest in recruiting
• Retention: 2 years from our last contact, unless you ask us to delete earlier

Fields marked as required are needed to process your enquiry; without them we cannot reply. A person reads every enquiry. We do not sell personal data or use it for any purpose other than those listed above. You can object to our business emails when we collect your details and through the unsubscribe link in every message. If we obtained your professional details from your employer or a public source, we name that source in our first message.

3. Who receives your data

Within PROJECT 1804, only the team accesses your data. Our service providers (hosting, email, analytics, accounting) process it under contract. Some technical providers (code and file delivery) receive your IP address when your browser loads a page and process it under their own terms. We also disclose data to public authorities when the law requires it.

Webflow, Inc.

• Role: Website hosting and form submissions
• Location: United States

Google Cloud EMEA Limited and Google LLC

• Role: Email and calendar (Google Workspace)
• Location: Ireland, United States

Google Ireland Limited

• Role: Audience measurement (Google Analytics)
• Location: Ireland, United States

Meta Platforms Ireland Limited

• Role: Advertising measurement (Meta Pixel)
• Location: Ireland, United States

cdnjs (Cloudflare), jsDelivr, unpkg

• Role: Delivery of website code libraries
• Location: European Union, United States

Spotify AB

• Role: Embedded playlist player on the About page; Spotify may set its own cookies when the player loads
• Location: Sweden, United States

Accountants, legal advisers and our bank

• Role: Accounting, legal and payment obligations
• Location: France, European Union

Project management and file-sharing tools

• Role: Client project work
• Location: European Union, United States

For the Meta Pixel, Meta Platforms Ireland Limited and PROJECT 1804 are joint controllers for collecting and transmitting the data, under Meta’s Controller Addendum. Meta alone is responsible for its later use, described in Meta’s Privacy Policy.

4. Transfers outside the European Union

Some providers are based in the United States or may access data from there. For our service providers, these transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, as Webflow, Google and Meta are, or on the Commission’s Standard Contractual Clauses, a copy of which is available on request. Technical delivery providers receive your IP address under their own terms.

5. Cookies and similar technologies

Without your agreement, we only store what the Website needs to work. Analytics and advertising cookies are placed only after you click “Accept” in the cookie banner. Refusing is as easy as accepting and does not limit your access to the Website.

Consent record (set by our consent tool)

• Provider: PROJECT 1804
• Purpose: Remembers your cookie choice
• Duration: 6 months
• Consent: Not required

audioTime, isPlaying (local storage)

• Provider: PROJECT 1804
• Purpose: Remembers whether the soundtrack is on and where it stopped
• Duration: Until you clear your browser storage
• Consent: Not required

_ga, _ga_T7CQQMPK7M

• Provider: Google Analytics
• Purpose: Distinguishes visitors and sessions for statistics
• Duration: 13 months
• Consent: Required

_fbp

• Provider: Meta
• Purpose: Measures visits linked to Meta advertising
• Duration: 90 days
• Consent: Required

_fbc

• Provider: Meta
• Purpose: Attributes visits arriving from Meta ads
• Duration: 90 days
• Consent: Required

We keep your choice for 6 months, then ask again. You can change it at any time through “Cookie settings” at the bottom of every page, or by deleting cookies in your browser.

6. Your rights

You have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• have your data erased;
• restrict its processing;
• object to processing based on our legitimate interest, and to direct marketing at any time without giving a reason;
• receive the data you gave us in a portable format;
• withdraw your consent at any time, without affecting earlier processing;
• set instructions for what happens to your data after your death.

Write to hello@project-1804.com. We reply within one month and may ask for proof of identity if we have reasonable doubts about it. If you believe your rights are not respected, you can complain to the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr).

7. Security

Access to your data is limited to the people who need it. The Website uses encrypted connections (HTTPS), and our providers are bound by confidentiality and security obligations.

8. Children

The Website is aimed at professionals, not at children under 15, and we do not knowingly collect their data.

9. Links to other websites

Links to Instagram, LinkedIn, Behance, Spotify and SoundCloud lead to services with their own privacy policies.

10. Changes to this policy

We may update this policy. The date at the top shows the current version, and we will flag significant changes on the Website.