Privacy policy

Data controller

The controller of the processing described here is Player One Labs, a simplified joint-stock company (SAS) with a share capital of €1,000, 55 avenue Marceau, 75116 Paris, France, Paris Trade and Companies Register 914 014 329, which publishes the website oshiborimedia.com (Oshibori Media).

For any question about your data or to exercise your rights: ruben@playeronelabs.com, or by post to Player One Labs, 55 avenue Marceau, 75116 Paris, France.

Data protection officer

Player One Labs has not appointed a data protection officer, as this is not mandatory for the processing it carries out. Requests are handled at ruben@playeronelabs.com.

Form “Eligibility test”

Data requested: establishment name, type of venue, average footfall, peak season activity (optional), customer profile, city, postcode (optional), other addresses (optional), preferred model, your name, your role, email, website (optional) and a note (optional). It is used to assess your establishment's eligibility and reply to you.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) of the GDPR).

Required fields are marked: without them, the request cannot be processed. The others are optional.

Recipients: the Player One Labs team, through the Studio, its internal tool. This data is never sold or passed on to third parties.

Retention period: 36 months after our last exchange.

Form “Start a brief”

Data requested: brand or company name, business email, objective, types of venues, target audiences, target volume and cost per lead, geographic areas, timing and approximate date (optional), your name, your role and a note (optional); for “Other” choices, the details you enter. It is used to answer your brief.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) of the GDPR).

Required fields are marked: without them, the request cannot be processed. The others are optional.

Recipients: the Player One Labs team, through the Studio, its internal tool. This data is never sold or passed on to third parties.

Retention period: 36 months after our last exchange.

Newsletter

If you subscribe to the Oshibori Media newsletter, we use your email address to send it to you, and for nothing else. We also keep the page you subscribed from and the consent sentence displayed, to be able to prove your consent.

Legal basis: your consent, given when subscribing (Article 6(1)(a) of the GDPR).

Recipient: Player One Labs, publisher of the website, which hosts the subscriber list in the Studio. Your address is never sold or passed on to third parties.

Retention: until you unsubscribe. We then keep only a record of your unsubscription, so as not to write to you again.

Unsubscribing: at any time, on the page oshiborimedia.com/desinscription or through the link in each newsletter.

Audience measurement

The website measures its traffic without cookies: this measurement sets no cookie and stores nothing in your browser. For each page viewed, the website sends the Studio the page address, the name of the website you came from, your screen width, the page title and, where applicable, the campaign named in the link that brought you. It also sends how long the page stayed on screen, how far you scrolled, the text and destination of the links and buttons you click, and the name of the forms you submit, without anything you typed in them.

Your IP address and browser type are used only to infer your country, to count the day's unique visitors and to leave out our own team's visits: the Studio derives fingerprints from them that change every day and cannot identify you, then deletes them without storing them. These measurements are used only for the website's statistics: they are neither combined with other data nor shared with third parties.

Legal basis: our legitimate interest in knowing the website's traffic in order to improve it (Article 6(1)(f) of the GDPR). Details of page views, clicks and submissions are deleted after 90 days; the statistics drawn from them are kept for 25 months at most.

To object, enable the Global Privacy Control (GPC) signal in your browser: no page view is then measured.

Technical logs

Like any website, the host's server records technical logs (IP address, date and time, page requested, browser type) to keep the website secure and working. Legal basis: our legitimate interest in protecting the website (Article 6(1)(f) of the GDPR). These logs are kept for a short period set by the host, then deleted.

Email prospecting

We may write to professionals who have not contacted us, at their business email address, to present an offer related to their activity. This processing is based on our legitimate interest in making our services known to the businesses concerned (Article 6(1)(f) of the GDPR).

For this purpose we use your last name, first name, job title, business email address, the name, city and website of your company, and public information about its activity that helps us tailor the message. We do not process any sensitive data.

This data does not come from you. It comes from official business registers (the INSEE SIRENE database and the French government's company directory), from your company's website and from professional directories in your sector. For some campaigns, it also comes from the public profiles you maintain in a professional capacity on social networks. Address search and verification tools are then used to find or confirm your email address. On request, we will tell you the precise source of your data.

Only the people in charge of prospecting have access to it, together with our technical processors, namely the email sending tool and the address search and verification tools. We never sell, rent or pass on this data to third parties.

Where one of these tools is established outside the European Union, the transfer is governed by an adequacy decision, in particular the Data Privacy Framework, or by the European Commission's standard contractual clauses.

You can refuse these messages at any time, without giving a reason. Simply reply “stop” to the email or write to the contact address shown on this page. We remove your address from our mailings within 48 hours.

We delete your data three years after it was collected, or three years after your last exchange with us if you replied. If you refuse our messages, we keep only your email address in an opt-out list, for three years, to make sure we do not write to you again. Your rights of access, rectification and erasure, described in this policy, also apply to this data.

Recipients and processors

Your data is processed by the Player One Labs team, each for their own part, and by the following technical processors, bound by contract and by confidentiality:

Vercel Inc.: hosting of the site and of the Studio; United States, execution in Dublin, Ireland.

Supabase Inc.: Studio database; Ireland, eu-west-1 region.

Resend: alert emails sent to the team; United States.

Slack (Salesforce): internal notifications, depending on the Studio settings; United States.

The prospecting tools described under “Email prospecting”.

We never sell, rent or pass on your data to third parties.

Transfers outside the European Union

Some of these processors are established in the United States. The resulting transfers are safeguarded as follows:

Vercel Inc.: certified under the EU–U.S. Data Privacy Framework, and standard contractual clauses.

Supabase Inc.: data stored in the European Union; access by its support team from the United States is governed by standard contractual clauses.

Resend: certified under the EU–U.S. Data Privacy Framework, and standard contractual clauses.

Slack (Salesforce): covered by the Salesforce Data Privacy Framework certification, and standard contractual clauses.

You may obtain a copy of these safeguards by writing to ruben@playeronelabs.com.

Retention periods

Requests sent through the forms: 36 months after our last exchange, unless another period is stated above for a form.

Newsletter: until you unsubscribe.

Audience measurement: 90 days for page-view details, 25 months at most for statistics.

Prospecting: three years after collection or after the last exchange; opt-out list: three years.

Clients: invoices and accounting records are kept for ten years (Article L. 123-22 of the French Commercial Code).

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to its processing, at any time and without giving reasons in the case of prospecting (Articles 15 to 21 of the GDPR).

Where processing is based on your consent, you may withdraw your consent at any time, without affecting what was done before.

You may also set instructions regarding what happens to your data after your death (Article 85 of the French Data Protection Act).

To exercise these rights, write to ruben@playeronelabs.com. We reply within one month, which may be extended by two months for complex requests, in which case we will let you know. We only ask for proof of identity in case of reasonable doubt about your identity.

If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.

No automated decision-making

No decision producing legal effects concerning you, or similarly significantly affecting you, is based solely on automated processing, including profiling.

Cookies and browser storage

The website's audience measurement works without cookies (see Audience measurement).

sessionStorage “wizard:lieux-eligibilite”: keeps your answers to the eligibility test during your visit, so you can pick up where you left off. It contains the information you entered: it stays on your device and is sent to us only when you submit the form. Duration: until the tab is closed; cleared as soon as the request is sent.

sessionStorage “wizard:marques-brief”: keeps your answers to the brief during your visit, so you can pick up where you left off. It contains the information you entered: it stays on your device and is sent to us only when you submit the form. Duration: until the tab is closed; cleared as soon as the request is sent.

Apart from what is described in this policy, the website sets no cookie and stores nothing in your browser. It sets no advertising cookie.

Security

Exchanges with the website are encrypted (HTTPS). Data received is stored in the Studio, access to which is restricted to the Player One Labs team, with a personal account for each member. Service access keys never leave our servers.

Minors

The website is intended for professionals and adults. It does not knowingly collect data about minors.

Changes

This policy may change, in particular if the website offers new services. Policy updated on 8 October 2026.

Language

This document is a translation of the French original. In case of discrepancy, the French version prevails.