Privacy policy

Last updated: 10 October 2026.

This page explains what data Pâtisserie Agathe Olivet (TEVILO) collects via this website and how it is used, in accordance with the GDPR.

Data controller

TEVILO (trading as "Pâtisserie Agathe Olivet"), Centre commercial Le Boulidou, Place du Boulidou, 34980 Saint-Clément-de-Rivière, France · Email us · 04 67 86 61 81.

Data collected and purposes

We process the information you enter in our forms (contact, orders, gift cards, table bookings, workshops, private workshops, professionals, job applications): first name, surname, e-mail, phone number, the details of your request and, where applicable, the files you attach. No account is created. This data is used solely to handle your request: reply, quote, preparation of an order or booking, notification about upcoming workshops if you asked for it, or review of an application. It is never sold or used for advertising.

If you mention an allergy or an ingredient to leave out, this information is used only to adapt the recipe. If you give a gift card, we also receive the first name and, where applicable, the e-mail address of the person it is for, solely to deliver the gift; this data is kept like your order.

After each submission, an acknowledgement summarising your request is sent to the e-mail address you gave. A copy of the request is also written to a backup log, kept on our OVH hosting in France and not accessible from the website. We use it if an e-mail goes missing.

You can attach inspiration photos and, to a job application, a CV and a cover letter. Photos are resized in your browser. These files are attached to the e-mail of your request, sent from our OVH hosting to our mailbox, also hosted by OVH, and are kept with it. If that sending fails, the photos are stored on our OVH hosting, under a randomly generated name, in a folder that cannot be listed or indexed: only the link included in your request gives access to them, and they are automatically deleted after one year. These files are used solely to review your request. They are never published or used for marketing.

The seasonal letter

If you sign up for the seasonal letter, we collect your e-mail address, the language of the page and the page where you signed up. It is used solely to send you this letter: our Christmas log menu before it opens, Epiphany cakes, every new seasonal menu and workshop dates, four times a year at most. It is never sold, lent or used for anything else.

You are subscribed as soon as you send the form, with no confirmation e-mail: that action, together with the information shown next to the field, is your consent. We keep a record of the sign-up date and page. Every letter ends with a one-click unsubscribe link; you can also email us.

We do not measure who opens our letters or who clicks their links: this individual tracking is switched off at Brevo for our subscribers. Only the date of the last opening may be kept, to remove from the list addresses that no longer receive our letters (a deliverability purpose exempted from consent by the CNIL).

The list is kept by Brevo (Sendinblue SAS, France), which sends the letters on our behalf and states that it hosts this data in the European Union. Your sign-up passes through our OVH hosting; if Brevo is temporarily unavailable, it waits there to be forwarded, for 60 days at most.

Legal bases

• Replying to your requests, quotes, orders, bookings, enrolments and applications, and sending the acknowledgement: pre-contractual measures or performance of a contract (Article 6(1)(b) GDPR).
• Keeping accounting records for orders: legal obligation (Article 6(1)(c)).
• Notification about upcoming workshops, if you ask for it, the seasonal letter, visit statistics and display of the Google Maps map: your consent (Article 6(1)(a)). For the letter, it is given by sending the sign-up form.
• Protecting our forms (anti-bot check, limit on submissions per device) and the backup log of requests: our legitimate interest (Article 6(1)(f)) in keeping the site secure and losing no request.

The required fields of a form are needed to handle your request: without them, it cannot be sent. The other fields are optional.

Recipients

Your data is intended only for the house's team. The following providers process it on our behalf:

• OVH SAS (France): website hosting, sending of forms and acknowledgements, backup log, the house's mailbox;
• Web3Forms (Web3Creative, India), only if sending through our hosting fails: it then delivers your request, without attachments, to our mailbox. It uses its own hosting providers (including Amazon Web Services, Cloudflare and Hetzner) and two spam filters, CleanTalk and Akismet, which receive your IP address and e-mail address;
• Brevo (Sendinblue SAS, France): seasonal letter list and sending of the letters;
• Cloudflare, Inc. (United States): anti-bot check on our forms (see below);
• Vercel Inc. (United States) and Supabase (contract with Supabase Pte. Ltd, Singapore): hosting of our visit statistics tool (see "Visit statistics").

If no sending succeeds, your e-mail software opens with the request pre-filled: it then goes through your own e-mail provider. Your data is not shared with any other third party, except where required by law.

To prevent automated submissions, our forms are protected by Cloudflare Turnstile, provided by Cloudflare, Inc. This check loads when you start using a form (as soon as you touch it or select a field), or at the last step of an order, a gift card or a workshop booking. It processes your IP address and technical information about your browser, and may read or store information in it from its own frame (challenges.cloudflare.com), for the time needed to check that the request does not come from a robot. On submission, our hosting also sends your IP address to Cloudflare to validate the check. Legal basis: our legitimate interest in keeping the site secure and preventing spam. Cloudflare acts on our behalf for this check. It states that it also uses this information for its own purposes, to improve its bot detection (Turnstile addendum).

To limit abuse, our hosting keeps a fingerprint (hash) of your IP address and the time of your submissions for about 24 hours.

Transfers outside the European Union

Some providers are based outside the European Union or may process data from abroad:

• Cloudflare, Inc. and Vercel Inc. (United States) state that they participate in the EU–U.S. Data Privacy Framework, recognised by the European Commission's adequacy decision of 10 July 2023;
• Supabase Pte. Ltd (Singapore) and Web3Creative (India) cover these transfers with the European Commission's standard contractual clauses, included in their data processing terms;
• Google, only if you display the map: see "Google Maps".

You may ask us for a copy of these safeguards.

Retention

• Enquiries, quotes, workshop waiting-list sign-ups and e-mail exchanges, with their attachments: 3 years after the last contact. For the workshop list, retention ends earlier if you withdraw your consent.
• Orders: for the duration of our accounting and tax obligations, i.e. 10 years for accounting records.
• Job applications: no more than 2 years after the last contact, unless you ask for earlier deletion.
• Seasonal letter: until you unsubscribe. After 3 years without hearing from you, we ask whether you wish to keep receiving it; without a reply, your address is deleted.
• Backup log of requests: about 6 months, then automatic deletion.
• Photos stored on our hosting when the main sending failed: 1 year, then automatic deletion.
• IP fingerprint used to limit submissions: about 24 hours.
• Requests delivered by Web3Forms: no more than 3 years with that provider, according to its policy.
• Visit statistics (Umami): 25 months, then automatic deletion.
• Your choice about visit statistics: 6 months, after which you are asked again.

Your rights

You have the right to access, rectify, erase, restrict and port your data. You can object to processing based on our legitimate interest and set instructions regarding what happens to your data after your death. Where processing is based on your consent, you can withdraw it at any time (for visit statistics: the "Manage my cookies" button below and in the footer), without affecting what was done before. To exercise these rights, email us or write to the registered office address given above; we will reply within one month. If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr · 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).

Cookies and browser storage

This website sets no cookies of its own. It only stores in your browser, without sending them anywhere, information needed for what you ask of it:

• for the life of the tab, the draft of an order in progress (including the contact details already entered) and the fact that you closed the holiday notice: they are cleared when the tab is closed, and the draft also after sending;
• your choice about visit statistics (accepted or declined), for 6 months; if you decline, a second flag stops the analytics tool from sending anything;
• the date the small seasonal letter window was shown to you, so that it does not reappear for 7 days, or the fact that you signed up, so that it never does; and, for the duration of the tab, the number of pages viewed, which decides when it appears. No address is stored there.

This information does not require your consent.

Other services may, however, read or store information in your browser: the Cloudflare Turnstile anti-bot check, on forms (see "Recipients"), the visit statistics tool, only if you accept it, and the Google Maps map, only if you ask to display it (see below).

Google Maps

On the Contact page, the interactive map loads only if you click "Accept and show the map". That click is your agreement: your browser then connects to Google's servers. Google receives, in particular, your IP address and may read or set its own cookies, for its own purposes, under its privacy policy; it may process this data outside the European Union. Without that click, nothing is loaded from Google, and the directions links on the page still work. This choice is not remembered: the "Hide the map" button removes the map from the page, and it only loads again if you ask for it. Any cookies Google has already set are Google's responsibility; you can delete them in your browser settings.

Visit statistics

Only with your consent, given or declined in the banner shown on your first visit, we measure visits to the site with Umami, open-source analytics software that we run ourselves and that sets no cookies. Until you accept, nothing is loaded. The script and data collection go through our subdomain stats.agathe-olivet.com, served by Vercel Inc. (functions running in Paris). Statistics are stored in a Supabase database located in Paris. Your IP address is not stored in that database. Combined with your browser's characteristics and a secret value renewed every month, it is used to compute a visit identifier specific to this site, and to derive an approximate location. This data is pseudonymised: it is used only to produce statistics about the site and about how well our actions work (campaigns, social networks, Google listing), never for advertising.

What is measured:

• pages viewed, including the parameters in their address (for example utm_… campaign tags);
• the page the visit comes from;
• approximate country, region and city;
• device type, browser, operating system, screen size and language;
• page loading speed;
• certain actions, without any content you type: clicks on the phone number, e-mail, map or a social network; the start, steps, refused date, sending or failure of a form, and the estimated amount of a priced order request; seasonal letter sign-up; use of the filters and photos on the Creations page; page not found.

Statistics are automatically deleted after 25 months.

Vercel states in its privacy notice that it also processes, for its own purposes, traffic data of the sites it hosts, such as the IP address and the location derived from it.

You can give or withdraw your consent at any time. Your choice is stored in this browser for 6 months: you will need to set it again if you clear its data or change device.

Manage my cookies