01
Data controller
The controller is Abishek Elangeswaran, operating The Mossy Roots from Nantes, France.
Privacy requests: abishek.e.work@gmail.com.
The complete business identification details will appear in the Legal Notice once the mandatory registration information has been confirmed.
02
What we process and why
Project enquiries
Data: name, work email, organisation, website or social link, location, selected services, project description, desired outcome, timing, budget, discovery source and any optional message.
Purpose: assess the request, reply, prepare a proposal and take requested pre-contractual steps.
Legal basis: Article 6(1)(b) GDPR; legitimate interests may also apply to protecting the form from misuse.
Direct email
Data: sender details and the contents of correspondence.
Purpose: answer the message and manage a possible or existing business relationship.
Legal basis: pre-contractual steps, contract performance or legitimate interests depending on the context.
Hosting and security
Data: technical request information such as IP address, browser, device, time and requested resource may be processed in server and security logs.
Purpose: deliver, secure and troubleshoot the website.
Legal basis: legitimate interests in reliable and secure operation.
Language preference
Data: the selected language and whether the language invitation has already appeared.
Purpose: maintain a seamless bilingual experience.
Storage: only in localStorage and sessionStorage on your device; it is not submitted to The Mossy Roots.
03
Recipients and international transfers
Access is limited to The Mossy Roots and service providers needed to host the website, process the form or deliver email. The website and its forms use Netlify, Inc. as a processor. Data is not sold.
Netlify may process data outside the European Economic Area, including in the United States. According to Netlify’s current privacy information, international transfers are protected through applicable mechanisms including the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses where required. See Netlify’s Privacy Statement .
04
Retention periods
- Enquiries that do not become a project: up to 12 months after the last meaningful contact.
- Client and project correspondence: for the working relationship and then only as needed for legal claims or contractual records.
- Invoices and accounting records: up to 10 years where French accounting law requires it.
- Browser language preference: until you clear local storage; the invitation flag lasts for the browser session.
- Technical hosting and security logs: for the limited period defined by Netlify’s service and security settings.
Data may be retained longer only where a legal obligation or the establishment, exercise or defence of legal claims requires it.
05
Your GDPR rights
Depending on the processing, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
Send a request to abishek.e.work@gmail.com. Identity may be checked only where reasonably necessary. A response is normally provided within one month, subject to the extensions permitted by the GDPR.
You may lodge a complaint with the CNIL . No solely automated decision with legal or similarly significant effects is made through this website.
06
Cookies and browser storage
The current website does not use advertising cookies, behavioural profiling or marketing analytics. It therefore does not display a consent banner for non-essential trackers.
The bilingual experience uses functional localStorage and sessionStorage entries to remember the language selected and avoid repeatedly showing the language invitation. These entries stay on the user’s device and are used only to provide the requested interface preference.
If analytics, advertising tools or other non-essential trackers are introduced, they must remain disabled until valid consent is collected and this notice is updated.
07
Security and changes
Reasonable organisational and technical measures are used to limit access and protect submissions. No internet service can guarantee absolute security; please avoid sending sensitive personal information that is not necessary for the project enquiry.
This notice will be updated when processing activities or service providers materially change. The revision date at the top identifies the current version.