Privacy Policy

Last updated: 27 October 2026

This policy explains what personal data AGENCE 93 collects, why, how long it is kept and how you can exercise your rights. It is issued in accordance with the Data Protection Act 2017 of Mauritius, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data controller

AGENCE 93, trading name of Consulting - Agence93, a self-employed business operated by Quentin Barbot
Address: Saint Antoine Private Residence, 30411 Goodlands, Mauritius
Business Registration Number (BRN): I24002637
Contact for any question about your data: contact@agence93.com
We have not appointed a Data Protection Officer (DPO); all requests are handled directly by Quentin Barbot.

2. Our role

• Controller: for data relating to visitors of our website, our prospects and our clients (business relationship, invoicing).
• Processor: for all data obtained from our clients' accounts (Amazon Seller Central, Amazon Ads, Shopify, Meta Ads, Google Ads, etc.). We process this data solely on behalf of our client and on their instructions. These accounts and this data remain our client's property.

3. Data we collect

Visitors and prospects. We collect your name, email address, phone number, company name and the content of messages sent through our forms, by email or when booking a meeting. With your consent, we also collect audience measurement data (pages viewed, device type, approximate location) through cookies.

Clients. We collect your contact and billing details, as well as information relating to the contract and projects.

Client account data (authorised access and APIs). When a client grants us access to their accounts, we process:

• Advertising data: campaigns, budgets, bids, keywords, search terms, performance metrics and advertising billing information.
• Store data: products, orders and sales.
• End-customer data: limited information, only where necessary for the service, for example order details used in aggregated reports.

We access this data only through official permissions or APIs granted by the account owner, including the Amazon Ads API via Login with Amazon.

We do not knowingly collect special categories of data (health, opinions, origin, etc.) or data relating to children under 16.

4. Purposes and lawful bases

We never sell personal data, and we never use a client's account data for any purpose other than delivering our services to that client.

5. Mandatory or voluntary provision of data

Providing your data is voluntary. However, without your contact details we will not be able to respond to your request or deliver our services. Access to accounts is granted freely by our clients and can be withdrawn at any time.

6. Amazon Ads API and Login with Amazon

When you authorise AGENCE 93 through Login with Amazon:

• We receive access tokens that allow us to view and manage only the advertising accounts you yourself have access to.
• We use this access solely to manage your advertising campaigns and report on them, as agreed with you.
• We never request or store your Amazon password.
• Tokens are stored securely. You can revoke access at any time from your Amazon account settings or by contacting us.
• Data obtained from Amazon is encrypted in transit, and only the people who need it to deliver your service can access it.
• We do not share Amazon data with third parties, other than service providers strictly necessary to deliver the service, and we never submit personally identifiable information about Amazon end customers (names, addresses, contact details) to AI tools.
• Any personal data of Amazon end customers is kept only as long as necessary for the service and is deleted within 30 days, unless a longer retention period is required by law.
• When you revoke access or our engagement ends, we stop all API calls and delete the tokens and associated data.

We comply with the Amazon Ads API License Agreement and Amazon's Data Protection Policy.

7. Recipients, service providers and tools

Your data is accessible only to AGENCE 93 and, to the extent necessary, to the following service providers, which process it on our behalf:

• website hosting and forms (Squarespace);
• audience measurement and search performance tracking (Google Analytics and Google Search Console);
• meeting scheduling (Calendly);
• cloud storage, email and productivity tools;
• analytics and reporting platforms;
• artificial intelligence assistants (such as Claude, by Anthropic) used to analyse data and prepare recommendations.

Data may also be disclosed to our professional advisers (such as our accountant) or to public authorities where required by law. The platforms our clients already use (Amazon, Shopify, Meta, Google) are the natural recipients of the actions we carry out on their behalf.

8. International transfers

AGENCE 93 is established in Mauritius. Our clients are located notably in the United Kingdom, the European Union and Réunion, and several of our service providers (including Squarespace, Google, Calendly and Anthropic) are based in the United States. Your data is therefore transferred outside Mauritius and, where applicable, outside the European Union or the United Kingdom.

These transfers rely on appropriate safeguards, in accordance with section 36 of the Data Protection Act 2017 and the GDPR: the EU-US Data Privacy Framework and its UK Extension where the provider participates, the European Commission's Standard Contractual Clauses, or the necessity of the transfer for the performance of our contract with you.

9. Retention periods

• Enquiries and prospects: 3 years from our last exchange.
• Clients: for the duration of the relationship, then for the period required by our legal, accounting and tax obligations.
• Client account data: only for the duration of the engagement, then deleted or returned within 90 days. Amazon end-customer data follows the 30-day rule described in section 6.
• Access tokens: revoked and deleted at the end of the engagement.
• Audience data and cookies: 13 months maximum.

10. Automated decision-making

We do not make any decision based solely on automated processing, including profiling, that produces legal or similarly significant effects for you. The software and AI tools we use analyse campaign performance, not individuals, and any change to a client account is approved by a human.

11. Cookies

Our website uses cookies necessary for its operation as well as audience measurement cookies set by Squarespace and Google Analytics. Non-essential cookies are only set after you consent through the banner displayed on your first visit. You can change your choice at any time from this banner or in your browser settings.

12. Your rights

You may at any time request access to your data, its rectification or erasure, the restriction of its processing, object to its processing, receive it in a reusable format, not be subject to a decision based solely on automated processing, or withdraw your consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Write to us at contact@agence93.com; we will respond within one month at the latest. Where your request concerns data we process on behalf of a client, we will forward it to that client and help them respond.

If you believe your rights have not been respected, you may lodge a complaint with the Data Protection Commissioner (Data Protection Office, Mauritius: dataprotection.govmu.org) or with the data protection authority of your country: the Information Commissioner's Office (ICO) in the United Kingdom, the CNIL in France (including Réunion) or the Garante per la protezione dei dati personali in Italy.

13. Security and data breaches

We protect data through appropriate technical and organisational measures: HTTPS connections, encryption of data in transit, access limited to what is strictly necessary and protected by passwords, two-factor authentication on our tools where available, and regular review of the access we hold.

In the event of a personal data breach, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it where feasible, and inform the individuals concerned where the breach is likely to result in a high risk to them. Where we act on behalf of a client, we will inform that client without undue delay. For any incident involving Amazon data, we will also notify Amazon without delay, in accordance with its rules.

14. Changes

We may update this policy to reflect changes in our services or in the law. The date of the latest update appears at the top of this page.