01
Data controller
The controller is Abishek Elangeswaran, operating The Mossy Roots from Nantes, France.
Privacy requests: abishek.e.work@gmail.com.
The complete business identification details will appear in the Legal Notice once the mandatory registration information has been confirmed.
02
What we process and why
Project enquiries
Data: name, work email, organisation, website or social link, location, selected services, project description, desired outcome, timing, budget, discovery source and any optional message.
Purpose: assess the request, reply, prepare a proposal and take requested pre-contractual steps.
Legal basis: Article 6(1)(b) GDPR; legitimate interests may also apply to protecting the form from misuse.
Direct email
Data: sender details and the contents of correspondence.
Purpose: answer the message and manage a possible or existing business relationship.
Legal basis: pre-contractual steps, contract performance or legitimate interests depending on the context.
Hosting and security
Data: technical request information such as IP address, browser, device, time and requested resource may be processed in server and security logs.
Purpose: deliver, secure and troubleshoot the website.
Legal basis: legitimate interests in reliable and secure operation.
Language preference
Data: the selected language and whether the language invitation has already appeared.
Purpose: maintain a seamless bilingual experience.
Storage: only in localStorage and sessionStorage on your device; it is not submitted to The Mossy Roots.
03
Recipients and international transfers
Access is limited to The Mossy Roots and service providers needed to host the website, process the form or deliver email. The website and its forms use Netlify, Inc. as a processor. Data is not sold.
Netlify may process data outside the European Economic Area, including in the United States. According to Netlify’s current privacy information, international transfers are protected through applicable mechanisms including the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses where required. See Netlify’s Privacy Statement .
04
Retention periods
- Enquiries that do not become a project: up to 12 months after the last meaningful contact.
- Client and project correspondence: for the working relationship and then only as needed for legal claims or contractual records.
- Invoices and accounting records: up to 10 years where French accounting law requires it.
- Browser language preference: until you clear local storage; the invitation flag lasts for the browser session.
- Technical hosting and security logs: for the limited period defined by Netlify’s service and security settings.
Data may be retained longer only where a legal obligation or the establishment, exercise or defence of legal claims requires it.
05
Your GDPR rights
Depending on the processing, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
Send a request to abishek.e.work@gmail.com. Identity may be checked only where reasonably necessary. A response is normally provided within one month, subject to the extensions permitted by the GDPR.
You may lodge a complaint with the CNIL . No solely automated decision with legal or similarly significant effects is made through this website.
06
Cookies and browser storage
Google Analytics 4 is optional and is used only for audience measurement so The Mossy Roots can understand how the website is used and improve it. It activates only after you select “Accept analytics”. If you select “Reject”, the Google tag is not loaded and no Analytics request is sent.
When accepted, Google may receive information such as the page visited, approximate location derived from the IP address, browser, device and interaction data, and may set first-party _ga cookies. This website limits those cookies to 90 days and disables Google signals, advertising storage, advertising user data and ad personalisation. No Google Ads, remarketing or advertising profiling is implemented. See Google’s Privacy Policy .
Your analytics choice is stored locally on your device for up to six months so the banner does not reappear on every page. The bilingual experience separately uses functional localStorage and sessionStorage entries to remember your language preference.
You can change or withdraw consent at any time through “Cookie settings” in the footer. Withdrawal prevents the tag from loading on the refreshed page, stops further audience measurement and removes accessible Google Analytics cookies; it does not affect processing that occurred before withdrawal.
When a campaign link brings you to the site, limited campaign details, the landing page and the referring site origin may be kept for the browser session. If you submit an enquiry, these details and the last case study viewed may be included with the form to understand where the enquiry came from. Google Analytics remains optional and loads only after you accept it.
07
Security and changes
Reasonable organisational and technical measures are used to limit access and protect submissions. No internet service can guarantee absolute security; please avoid sending sensitive personal information that is not necessary for the project enquiry.
This notice will be updated when processing activities or service providers materially change. The revision date at the top identifies the current version.