Privacy Policy

01Data Controller Identity & Contact Details

This Privacy Policy describes how your personal data is collected, processed, and protected when you visit bulbulagency.com or use our digital marketing and public relations services. In accordance with the European General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the French Loi Informatique et Libertés, the legal entity responsible for processing your personal data (the “Data Controller”) is:

Privacy & Data Protection Contact: For any questions regarding this Privacy Policy or to exercise your data protection rights, please contact us at info@bulbulagency.com.

Supervisory Authority: You have the right to lodge a complaint with the competent French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL) (www.cnil.fr).

02Personal Data We Collect, Purposes & Lawful Basis

We collect and process personal data only when we have a valid legal basis to do so under Article 6 of the GDPR. Depending on how you interact with our website and services, we process personal data across five main categories:

A. Identity & Inquiry Data

Data Collected: Full name, business email address, phone number, company name, job title, estimated project budget, and the content of your message or inquiry.

Purpose of Processing: Responding to contact form submissions, scheduling and managing consultation meetings via HubSpot Meetings, and preparing custom proposals, RFPs, or scopes of work.

Lawful Basis: Performance of a contract or taking pre-contractual steps at your request (GDPR Art. 6(1)(b)).

Retention Period: Retained for the duration of active business communications, plus 3 years from the last contact for prospects.

B. Client Account & Billing Data

Data Collected: Login credentials, company billing address, purchased service packages, transaction logs, invoices, and payment history.

Purpose of Processing: Managing access to the reserved Bulbul Connect client portal, processing online payments and recurring service subscriptions via Stripe, and complying with statutory tax and accounting duties.

Lawful Basis: Performance of a contract (GDPR Art. 6(1)(b)) and Legal Obligation (GDPR Art. 6(1)(c)).

Retention Period: Active client account data is retained for the duration of the contract. Financial, transaction, and invoicing records are archived for 10 years in accordance with Article L123-22 of the French Commercial Code.

C. Marketing & Communications Data

Data Collected: Full name, business email address, and newsletter subscription preferences.

Purpose of Processing: Sending agency newsletters, industry insights, promotional updates, and direct B2B marketing communications via HubSpot Email.

Lawful Basis: Consent (GDPR Art. 6(1)(a)) for direct newsletter opt-ins, or Legitimate Interest (GDPR Art. 6(1)(f)) for standard B2B professional communications.

Retention Period: Retained for 3 years from the date of your last active interaction (e.g., clicking an email link), or until you unsubscribe or withdraw your consent.

D. Analytics & Advertising Measurement Data

Data Collected: IP address, browser type, operating system, pages viewed, time spent on site, referral URLs, and cookie/advertising identifiers.

Purpose of Processing: Measuring website traffic and performance via Google Analytics, and tracking ad conversions or running retargeting campaigns via Meta Pixel, Google Ads, and the LinkedIn Insight Tag.

Lawful Basis: Consent (GDPR Art. 6(1)(a)), obtained via our cookie consent banner prior to any tracking script activation.

Retention Period: Cookie identifiers are stored for up to 13 months in accordance with French CNIL guidelines. Anonymized statistical reports are retained for up to 25 months.

E. PR & Client Campaign Data (Data Processor Role)

When Bulbul Agency executes PR campaigns, influencer outreach, or digital marketing services on behalf of client organizations, Bulbul Agency acts as a Data Processor under Article 28 of the GDPR. In such cases, processing is strictly governed by the specific service agreements and Data Processing Agreements (DPAs) executed with our clients.

03Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies (such as pixels and web beacons) to ensure proper website functionality, analyze audience traffic, and deliver targeted advertising campaigns.

A. Categories of Cookies We Use

• Strictly Necessary / Essential Cookies: Required for the basic operation and security of our website and the Bulbul Connect portal — session management and security protocols. These do not require user consent under French CNIL guidelines.
• Analytics & Performance Cookies: We use Google Analytics to measure website traffic, user interactions, and page performance. These cookies collect anonymized usage data to help us improve user experience.
• Advertising & Retargeting Pixels: We use marketing scripts and tracking pixels — including Meta Pixel, Google Ads, and the LinkedIn Insight Tag — to measure advertising effectiveness, track conversions, and display tailored B2B advertisements to previous visitors.

B. Your Consent & CNIL Compliance

In strict compliance with French CNIL guidelines and European privacy laws:

• Consent Prior to Activation: Non-essential cookies (analytics and advertising trackers) are blocked by default and only activate after you give explicit consent through our cookie consent banner.
• Equal Choice: Refusing tracking is as simple as accepting it. Our consent banner provides clear “Accept All” and “Refuse All” options without hidden settings or pre-checked boxes.
• Modifying Your Preferences: You can change or withdraw your cookie consent at any time via the “Cookie Settings” link in our footer, or by configuring your browser to block third-party cookies.

C. Cookie Retention Lifespan

In accordance with CNIL recommendations, cookie consent choices and tracking identifiers are stored for a maximum period of 13 months from the date they are saved on your browser.

04Data Sharing & Third-Party Service Providers

We respect your privacy and explicitly guarantee that we do not sell, rent, or trade your personal data to third parties for commercial or marketing purposes.

A. Third-Party Subprocessors

To operate our agency and deliver our services efficiently, we share limited personal data with trusted third-party service providers (data subprocessors) acting strictly on our instructions. Each provider is vetted for compliance with GDPR requirements under Article 28:

• CRM & Email Marketing: HubSpot, Inc. (B2B contacts, client communications, contact form submissions, appointment scheduling via HubSpot Meetings, email updates).
• Payment Processing & Subscription Management: Stripe, Inc. (secure credit card processing, recurring invoicing, and subscription payments via Bulbul Connect).
• Website Analytics: Google LLC (aggregated website performance metrics via Google Analytics).
• Advertising & Marketing Platforms: Meta Platforms Ireland Ltd., Google LLC, and LinkedIn Ireland Unlimited Company (ad effectiveness and target audience reach).
• Cloud Infrastructure & Web Hosting: Secure cloud infrastructure providers used to host bulbulagency.com and store agency operations data safely.

B. Legal & Regulatory Disclosures

We may disclose personal data if required to do so by applicable French or European law, or in response to a valid court order, subpoena, or request from competent administrative, judicial, or legal authorities (such as tax authorities or police services).

05International Data Transfers

As a France-based agency, our primary operations and data storage occur within the European Economic Area (EEA). However, some of our trusted third-party service providers (such as HubSpot, Stripe, Google, Meta, and LinkedIn) are headquartered or operate servers outside the EEA, notably in the United States.

Whenever personal data is transferred outside the EEA, we ensure that adequate safeguards are implemented in compliance with Chapter V of the GDPR, including:

• EU-U.S. Data Privacy Framework (DPF): Transferring data to certified US organizations recognized by the European Commission as providing an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Using standard data protection clauses approved by the European Commission in our data processing agreements with non-EU processors.

06Your Rights & French Specific Provisions

Under the European GDPR and the French Loi Informatique et Libertés (Law No. 78-17), you hold several key rights regarding your personal data:

A. Your Rights Under GDPR

• Right of Access (DSAR): Request a copy of the personal data we hold about you.
• Right to Rectification: Request that incomplete or inaccurate data be updated or corrected.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your data when no longer necessary, subject to statutory retention obligations (e.g., accounting records).
• Right to Restriction of Processing: Request that we temporarily suspend or restrict processing under specific legal circumstances.
• Right to Data Portability: Request a copy of your data in a structured, machine-readable format to transfer to another controller.
• Right to Object: Object at any time to processing for direct B2B marketing or profiling purposes.
• Right to Withdraw Consent: Where processing is based on consent (e.g., newsletter, analytics cookies), withdraw it at any time without affecting the lawfulness of prior processing.

B. Post-Mortem Data Directives (French Specific Provision)

In accordance with Article 85 of the French Loi Informatique et Libertés, you have the specific right to define advance directives regarding the retention, deletion, and communication of your personal data after your death. You may designate a trusted person to carry out these directives, or register general directives with an authorized digital trust body.

C. How to Exercise Your Rights

To exercise any of these rights, please send your request directly to our Data Protection contact at info@bulbulagency.com.

We will respond within one (1) month of receipt. If your request is particularly complex or you submit multiple requests, this period may be extended by two additional months, in which case we will inform you of the extension.

D. Right to Lodge a Complaint

If you believe our processing of your personal data violates applicable privacy laws, you have the right to lodge a formal complaint with the competent supervisory authority:

07Data Security & Policy Updates

A. Technical & Organizational Security

We implement appropriate technical, administrative, and physical security measures designed to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include SSL/TLS encryption for all website transmissions, restricted internal data access policies, and secure authentication controls for the Bulbul Connect client portal. However, please note that no method of electronic transmission over the internet can be guaranteed to be 100% secure.

B. Changes to This Privacy Policy

We reserve the right to modify or update this Privacy Policy at any time to reflect changes in our operational practices, services, or legal obligations. Any updates will be posted directly on this page with an updated “Last Modified” date at the top of the policy. We encourage you to review this page periodically.