Skip to main content

Privacy Policy

Last Updated: March 17, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how MK Piano Studio ("we", "us") collects, uses, and protects your personal data when you visit our website and when you contact us to book piano lessons in Paris or online. The policy also explains how cookie-based preferences work and how you can control analytics and marketing technologies.

The data controller for processing carried out on this website is:

We do not appoint a Data Protection Officer (DPO) at this time because our website activities do not involve large-scale processing of special-category data. If this changes, we will update this policy and provide DPO contact details.

2. Personal Data We Collect

We collect only the data needed to run a lesson studio website, respond to requests, and maintain a secure and reliable service. The categories below describe what we may collect depending on how you use the site.

2.1 Identity & contact details

  • Name (for example, the name you enter in our booking request form).
  • Email address.
  • Phone number.
  • Preferred lesson format (in-studio in Paris 75015 or online).

2.2 Form content and communications

  • Messages you submit through the contact form (for example, your level, repertoire interests, availability, or scheduling notes).
  • Any information you share by email or phone when arranging lessons.

2.3 Technical and device data

  • IP address (may be used for security monitoring, rate limiting, and fraud prevention).
  • Browser type/version and basic device/operating system information.
  • Language and region settings.
  • Approximate location derived from IP (city/region level, not precise geolocation).

2.4 Usage data

  • Pages viewed and time spent on pages.
  • Referrer URLs (the page that brought you to our site).
  • Click paths and interaction events (for example, opening the cookie preferences panel).

2.5 Cookies and identifiers

We use cookies and similar technologies to keep the site functioning and (only if you consent) to understand usage and measure advertising performance. Details are provided in Section 4 and in our Cookie Policy.

2.6 Data we do not intentionally collect

We do not intentionally collect special-category data (such as health data, religious or political opinions), financial account details, or government identification numbers through our website. Please do not include such information in your messages.

3. Why We Process Personal Data & Legal Basis (GDPR Art. 6)

Under the General Data Protection Regulation (GDPR), we must have a legal basis for each processing activity. The basis depends on the context and on the choices you make in the cookie banner.

3.1 Responding to booking requests

  • Purpose: Reply to your inquiry, propose times, confirm lesson format, and coordinate scheduling.
  • Legal basis: Art. 6(1)(b) (steps prior to entering into a contract) and Art. 6(1)(a) (consent) where you explicitly provide information and tick the consent checkbox.

3.2 Website analytics (optional)

  • Purpose: Understand how visitors use the site so we can improve clarity, navigation, and content about lessons in Paris and online.
  • Legal basis: Art. 6(1)(a) consent (activated only after you opt in).

3.3 Marketing and remarketing (optional)

  • Purpose: Measure advertising performance, build remarketing audiences, and attribute conversions (for example, when a visitor submits a booking request after seeing an ad).
  • Legal basis: Art. 6(1)(a) consent (activated only after you opt in).

3.4 Security and abuse prevention

  • Purpose: Protect the website from automated abuse, suspicious submissions, and malicious activity.
  • Legal basis: Art. 6(1)(f) legitimate interests (keeping the site secure and reliable).

3.5 Legal obligations

  • Purpose: Comply with applicable laws, respond to lawful requests, and retain records where legally required.
  • Legal basis: Art. 6(1)(c) legal obligation.

3.6 Automated decision-making (Art. 22)

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Cookie-based advertising may involve audience segmentation by third-party platforms, but it does not make decisions that have legal effects for you on our site.

4. Cookies & Tracking Technologies

Cookies are small text files stored on your device. We also use similar technologies such as pixel tags and server-side event logging. The specific tools used may change over time, but they will always fall into the categories below. Detailed cookie names and retention periods are listed in our Cookie Policy.

4.1 Essential cookies (always active)

Essential cookies are required for the website to function. They help with session continuity, saving your cookie preferences, and basic security. These cookies are set regardless of your analytics/marketing choices because the website cannot work reliably without them.

  • Examples: _site_session, cookie_consent.
  • Retention: session to 12 months depending on cookie type.

4.2 Analytics cookies (consent required)

If you consent to analytics cookies, we may use Google Analytics 4 (GA4) to understand how the site is used. We aim to configure analytics in a privacy-respecting way, including IP anonymization where applicable. Analytics helps us improve pages like Lessons, Pricing, and FAQ, and it helps us see which information is most useful to visitors considering piano lessons in Paris.

  • Examples: _ga, _ga_XXXXXXXXXX.
  • Retention: typically up to 14 months for analytics data; cookie lifetimes can be up to 2 years.

4.3 Marketing cookies (consent required)

If you consent to marketing cookies, we may use advertising technologies such as Google Ads conversion linker and Meta Pixel identifiers. These tools help us measure whether advertising campaigns lead to actions on our site (for example, a booking request) and may enable remarketing audiences. The intent is measurement and relevance; it is not necessary for booking a lesson.

  • Examples: _gcl_au, _fbp, _fbc.
  • Retention: typically around 90 days for marketing cookies.

4.4 Pixel tags and server-side events

In addition to cookies, some measurement can occur via pixel tags or server-side event collection. These methods may process identifiers derived from your browser and device (for example, a cookie ID, IP address, and user agent). Where we use such tools for analytics or marketing, they are enabled only after consent.

5. Consent (EEA/UK) and How to Withdraw

Users in France and across the EEA receive a cookie consent notice. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Art. 6(1)(a)). Your choices are recorded in the cookie_consent cookie, which is stored for up to 12 months unless you delete it sooner.

You can withdraw or change your consent at any time by clicking “Manage cookie preferences” in the footer. You can also clear cookies via your browser settings. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

6. Sharing With Advertising & Service Partners

We share limited data with service providers to operate the website and, if you consent, with advertising and analytics partners. We do not sell personal data. We do not permit partners to use site data for their own independent commercial purposes beyond providing their services to us.

6.1 Google LLC

If enabled by consent, Google may receive cookie identifiers, usage data, conversion events, and remarketing list signals for Google Analytics 4 and Google Ads measurement.

6.2 Meta Platforms

If enabled by consent, Meta may receive events such as page views and conversion actions, along with identifiers used for measurement and remarketing. Where server-side options are used, identifiers may be hashed before transmission where appropriate.

6.3 Cloudflare

We may use Cloudflare for content delivery and security. Cloudflare can process IP addresses and request metadata to detect malicious traffic and improve reliability.

If you would like details about specific vendors active at the time you visit, please contact us at [email protected].

7. International Transfers

Some service providers (notably Google and Meta) may process data outside the EEA/UK, including in the United States. Where transfers occur, they are managed using recognised transfer mechanisms such as the EU–US Data Privacy Framework (DPF) where applicable, with Standard Contractual Clauses (EU 2021/914) as a fallback. For the UK, the UK Extension to the DPF or UK transfer tools (such as the UK IDTA) may apply where relevant.

We take reasonable steps to ensure that transfers include appropriate safeguards and contractual controls suitable for the type of data involved.

8. Retention

We keep personal data only as long as needed for the purposes described in this policy. Retention periods may vary based on the type of data and our legal obligations.

  • Contact submissions: up to 2 years from the last interaction, to keep continuity in scheduling and follow-up.
  • Email correspondence: typically the duration of the relationship plus 1 year, unless a longer period is needed to resolve disputes.
  • Server logs: typically up to 90 days for security and troubleshooting.
  • Analytics data: typically 14 months (tool-dependent); cookie lifetimes may be longer but can be reset or deleted by users.
  • Marketing cookies: per cookie lifetime (often around 90 days).
  • Consent record: up to 3 years for audit purposes, where appropriate.
  • Legal/tax: where applicable, retained for the period required by French or EU law.

9. Your Rights (GDPR & UK GDPR)

If you are in France, the EEA, or the UK, you have rights under data protection laws. These rights include:

  • Right of access (Art. 15).
  • Right to rectification (Art. 16).
  • Right to erasure (Art. 17).
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20).
  • Right to object (Art. 21).
  • Right to withdraw consent at any time (Art. 7(3)).
  • Right to lodge a complaint with a supervisory authority (Art. 77).

To exercise your rights, email [email protected]. We aim to respond within 30 days. For complex requests, this may be extended by up to 60 additional days as permitted by law.

If you are in France, you can also contact the French supervisory authority (CNIL) at cnil.fr. For general EU guidance, you may consult the European Data Protection Board at edpb.europa.eu.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If you believe that a child under 16 has provided personal data without verifiable parental consent, please contact us and we will delete the information promptly.

11. Do Not Track

This website does not respond to Do Not Track (DNT) browser signals. Some third-party services may have their own handling of browser signals and privacy controls.

12. Data Deletion Requests

To request deletion of personal data, email [email protected] with the subject line “Data Deletion Request.” We may need to verify your identity before completing the request. If deletion is limited due to legal obligations, we will explain what must be retained and why.

13. Business Transfers

If MK SAS is involved in a merger, acquisition, asset sale, financing, or insolvency, personal data may be transferred as part of that transaction. If the transfer materially changes how data is used, we will provide notice on the website.

14. California (CCPA/CPRA)

Although MK Piano Studio is based in France, some visitors may access the site from the United States. This section provides additional disclosures for California residents where applicable.

In the past 12 months, we may have collected the following categories of personal information: identifiers (such as name, email, IP address, cookie identifiers), internet or network activity (such as pages viewed and interactions), and inferences (such as interests derived from page views) where marketing cookies are enabled by consent.

We do not sell personal information as defined by the CCPA. However, if marketing cookies are enabled, we may share data for cross-context behavioral advertising. California residents may opt out by using our cookie preferences panel and disabling marketing cookies.

California rights may include the right to know, delete, correct, and opt out of sale/sharing, and the right to non-discrimination. To submit a request, email [email protected] with the subject line “California Privacy Request.” We will verify your identity before responding. Authorized agents may submit requests with proof of authorization.

15. Virginia (VCDPA)

Virginia residents may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. We do not sell personal data or engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject line “Virginia Privacy Request.” If we deny a request, you may appeal by emailing with the subject “Appeal of Refusal — Privacy Request.” We will respond to an appeal within 60 days as required by law.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request.” We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the website, or applicable law. Material changes will be announced via a notice on the website at least 14 days before they take effect. The “Last Updated” date at the top of this page indicates the most recent revision.

18. Contact

For privacy questions or requests, contact: