1. Who processes your data
Nafissa MAIGA, a sole trader operating under the trading name Style by Nafi.
20 rue de Brest, 35000 Rennes, France — SIRET: 904 514 601 00023
Email: maiga@style-bynafi.com — Telephone: +33 (0)6 27 81 36 06
Nafissa MAIGA is the data controller. Access is restricted to duly authorised persons involved in managing client or partner enquiries, strictly within the scope of their duties.
2. What data is collected
When you contact us
Your first and last name, email address, telephone number, the nature of your enquiry, your preferred format and timeframe, and the content of your message.
When you become a client
The information required to provide the service: body shape, measurements and sizes, skin tone, the contents of your wardrobe, budget, personal and professional constraints and, where applicable, photographs you send us.
This information is personal by nature. It is not used for any purpose other than providing the service and is shared only with people or service providers whose involvement is strictly necessary for its performance. It is handled with the same discretion that governs the service itself.
When you contact us on WhatsApp
Your telephone number, the content of your messages and any photographs you send. These exchanges pass through WhatsApp (Meta) servers under that service's terms.
If you prefer not to use WhatsApp, you may use the contact form or email address instead; your enquiry will be handled in the same way.
What we do not collect
We request only the information strictly necessary to provide the service. No biometric recognition or identification is performed using the photographs you send.
Style by Nafi does not request data concerning your health or racial or ethnic origin. If information of this kind is essential to adapt the service and you choose to provide it, it will be processed only after your separate, explicit consent has been obtained. Any unnecessary sensitive data is deleted.
For billing purposes
Billing address, amounts, dates and payment methods.
When you browse the website
Technical connection data required for the website to operate: IP address, browser type and pages viewed.
3. When a partner sends us your data
As part of the Signature service, a concierge service, hotel, family office or agency may send us information in order to organise a service for you: your identity and contact details, place of stay or delivery, sizes, preferences, photographs, dates and assignment constraints.
This data is received from the partner, who remains your main point of contact. Depending on the framework of the assignment, Style by Nafi will provide you with separate information about this processing no later than one month after receiving your data, or at the time of the first contact if this occurs sooner.
The data is used solely to perform the requested assignment and is then retained for the periods stated in Section 6.
You may exercise your rights directly with us at any time using the contact details in Section 1, even if you have not been in direct contact with Style by Nafi.
4. Why this data is processed and on what legal basis
| Purpose | Legal basis |
|---|---|
| Respond to your enquiry and prepare a possible service | Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) |
| Provide the service and any follow-up | Performance of a contract (Article 6(1)(b) GDPR) |
| Issue invoices and maintain accounting records | Legal obligation (Article 6(1)(c) GDPR) |
| Use a testimonial, photograph or mention for communication purposes | Your consent, obtained separately and revocable at any time (Article 6(1)(a) GDPR) |
| Adapt the service to a personal constraint you choose to disclose | Performance of a contract (Article 6(1)(b) GDPR). Where the information is sensitive data, your separate, explicit and revocable consent is also required (Article 9(2)(a) GDPR) |
| Ensure the website operates securely | Legitimate interests (Article 6(1)(f) GDPR) |
5. Who has access to your data
Your data is accessible only to duly authorised persons involved in managing client or partner enquiries, strictly within the scope of their duties. Named access permissions are documented internally.
Three categories of third parties may be involved. Technical processors act on our instructions and do not use your data for their own purposes; messaging services you choose to use apply their own terms; and people involved in an assignment receive only the information strictly necessary for their role.
| Service provider | Role |
|---|---|
| Cloudflare | Static hosting, delivery and website security |
| Google Analytics (Google Ireland Limited) | Audience measurement, only after your consent |
| IONOS | Hosting of style-bynafi.com email services |
| WhatsApp (Meta) | Instant messaging at your initiative. Transfers outside the EEA may occur — see Section 7. |
Depending on the service, other parties may receive the information strictly necessary to carry it out: an alterations service, a carrier making a delivery, a boutique arranging an appointment, or the hotel where you are staying. Only essential data is shared, and only with your prior agreement.
Your data is never sold, rented or shared for commercial or advertising purposes. It may be disclosed to an administrative or judicial authority where required by law.
6. How long your data is retained
| Data type | Retention period |
|---|---|
| Enquiry that does not lead to a service | 12 months from the last contact, then deletion |
| File required to provide the service | For the duration of the service |
| Evidence of the contract and management of a potential dispute | 5 years from the end of the relationship |
| Accounting records and invoices | 10 years, in accordance with the French Commercial Code |
| Photographs and assessment materials | Deleted at the end of the service. If you make a written request for later follow-up, they may be retained for up to 12 months. |
| Published testimonials and evidence of the related consent | Until you withdraw your consent, then 3 years for evidential purposes |
| Data received from a partner under the Signature service | For the duration of the assignment, then only as required to comply with accounting obligations |
| Technical connection logs | For a period limited to the website's security and operational needs, according to the settings applied by Cloudflare |
7. Where your data is hosted and transferred
The static website is hosted and delivered by Cloudflare through its global network. Technical data required to deliver and secure the website may be processed outside the European Economic Area, including in the United States. Cloudflare safeguards these transfers through its data processing agreement and the mechanisms provided for under European law.
Professional email is hosted by IONOS.
When you accept audience measurement, Analytics data is processed by Google Ireland Limited. Processing may take place outside the European Economic Area under the safeguards described in Google's privacy policy.
Exchanges you choose to have on WhatsApp are governed by the operation of that service, which is owned by Meta. They may involve transfers outside the European Economic Area, including to the United States, under the mechanisms Meta states that it applies in its privacy policy for the European Economic Area, available at whatsapp.com/legal/privacy-policy-eea.
If you prefer not to use this channel, the contact form and email address provide access to exactly the same service.
8. How your data is protected
Access to our tools is protected by personal login credentials. Exchanges with the website are encrypted using HTTPS. Photographs and working documents are retained only for as long as needed to provide the service.
No system is infallible. If a data breach is likely to result in a high risk to your rights, you will be informed without undue delay in accordance with Article 34 GDPR.
9. Your rights
Depending on the processing concerned and its legal basis, you may exercise the following rights: access, rectification, erasure, restriction of processing, objection and data portability. You may also issue instructions concerning what should happen to your data after your death. Certain rights do not apply to every processing operation; for example, the right to object cannot be exercised in relation to processing based on a legal obligation.
You may exercise these rights by emailing maiga@style-bynafi.com. We will reply within one month. Proof of identity may be requested where there is reasonable doubt about your identity.
Where consent is the legal basis for processing, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.
10. Cookies
Necessary storage
The website uses browser local storage to remember your audience-measurement choice for six months. This storage is not used for advertising or to measure your browsing.
WhatsApp questionnaire
The information entered in the WhatsApp questionnaire remains in your browser and is used only to prepare the message. It is not transmitted to Style by Nafi or Cloudflare until you decide to send that message through WhatsApp.
Audience measurement — Google Analytics
Google Analytics is loaded only after you accept. It measures information such as pages viewed, general device characteristics and an approximate geographic area. The legal basis is your consent, which you can withdraw at any time using the “Cookies” button shown at the bottom of the website. This mechanism does not activate advertising trackers.
11. Complaints
If, after contacting us, you believe that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.
12. Changes to this policy
This policy may be amended to reflect legal or technical developments. The applicable version is the one published on the website on the date of your visit.
Last updated: 7 October 2026
Back to top