Privacy policy

Last updated: 4 October 2026.

This policy explains which personal data is processed when you use the website www.lorenz-piano.fr, for what purpose, on what legal basis, with which service providers and for how long, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French Data Protection Act (Act No. 78-17 of 6 January 1978).

In short: the website sets no cookies and uses no audience measurement or advertising tools. Your data is only processed to display the website, when you write to me, request a quote or book an appointment, or when you choose to use an embedded service (Google Maps address entry, YouTube video). It is neither sold nor used for advertising.

Data controller

• Controller: Lorenz Viegener, sole trader (auto-entrepreneur), trading as Lorenz Piano
• Address: 92 Quai de Pierre Scize, 69005 Lyon, France
• Email: info@lorenz-piano.fr
• Phone: +33 (0) 6 51 91 55 09
• SIRET: 91241890200017

For any question about your data or to exercise your rights (see "Your rights"), write to info@lorenz-piano.fr or to the postal address above.

Hosting and use of the website

• Purpose: making the website available to you, running the server functions (forms, booking) and keeping the service secure.
• Data: IP address, date and time of the request, page requested and technical information sent by your browser (browser type, operating system, referring page).
• Legal basis: legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR).
• Recipient: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, the website host (static pages and server functions), acting as processor.
• Transfer: possible to the United States, see "Transfers outside the European Union".
• Retention: server logs kept for a limited period by Vercel, in accordance with its terms of service.

Lorenz Piano does not use these logs to measure website traffic or to track visitors.

Cookies and local storage

The website sets no cookies and uses no audience measurement, advertising or social media tools. No consent banner is therefore displayed.

For your convenience, it only stores the following in your browser: the language you choose in the menu (local storage, key "lorenz-lang"); for the current session, the fact that the redirect to your language has already taken place and, where applicable, that you closed the absence banner, as well as what you have entered so far in the booking form, so that it is kept if you reload the page or go back, and the summary of an appointment you have just confirmed, so that it is shown again if you reload the page (session storage, cleared when you close the browser). This information stays on your device, is not sent to me and can be deleted at any time in your browser settings.

The Google Maps and YouTube services are only loaded at your request (see below); Google may then store or read information in your browser under its own rules.

Contact forms (workshop and services)

• Purpose: answering your request and, where applicable, preparing a quote.
• Data: name, email address, phone number, address (restoration and repair form), information about the instrument (type, brand, model, serial number or year, last tuning), service requested, description, wishes, budget, preferred period, message, and the photos and videos you attach (up to 6 files).
• Legal basis: pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
• Recipients: Lorenz Piano; Brevo (Sendinblue SAS, France), which delivers the email containing your request; Vercel Inc., which runs the sending function and stores the attachments (Vercel Blob service).
• Retention: attachments deleted from storage 180 days after upload; the email with your request is kept in Lorenz Piano’s mailbox for as long as needed to handle your request and follow up the business relationship, at most 3 years after the last exchange.

Attachments are uploaded directly from your browser to Vercel’s storage. Each file receives a public web address with a random suffix; this address is only given to Lorenz Piano, in the email with your request, but anyone who knew it could open the file. Please only attach photos or videos relevant to your request.

Quote request (surface repair, silent system, humidity control system)

• Purpose: preparing a quote (surface repair from your photos, installation of a silent system or a humidity control system) and acknowledging receipt of your request.
• Data: first name, last name, email address, phone number, address and access details (floor, door code), service and model requested, number of areas to repair, type of damage, finish, information about the instrument (type, brand, model, serial number, last tuning), message, photos (up to 10) and website language.
• Legal basis: pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
• Recipients: Lorenz Piano; Brevo (Sendinblue SAS, France), which sends the request to Lorenz Piano and the acknowledgement to your address; Vercel Inc., which runs the sending function and stores the photos (Vercel Blob service).
• Retention: photos deleted from storage 180 days after upload; emails kept in Lorenz Piano’s mailbox at most 3 years after the last exchange.

Photos are stored in the same way as contact form attachments: a public web address with a random suffix, given only to Lorenz Piano.

Online booking

• Purpose: recording your appointment request, having it confirmed by email, organising and carrying out the service, and sending you the confirmation and a reminder the day before.
• Data: service and options chosen, number of instruments, date and time, appointment address and access details (floor, door code), first name, last name, email address, phone number, student status (discount), optional information about the instrument (type, brand, model, last tuning), message, website language, calculated price (service, discounts, travel costs) and area.
• Legal basis: pre-contractual steps and performance of the contract (Article 6(1)(b) GDPR).
• Recipients: Lorenz Piano; Neon Inc., which hosts the booking database (servers located in Frankfurt, Germany); Google, which provides Lorenz Piano’s Google Calendar; Brevo (Sendinblue SAS, France), which sends the emails; Vercel Inc., which runs the booking functions; Google (Routes API) for the distance calculation, see the next section.
• Transfer: possible to the United States, see "Transfers outside the European Union".
• Retention: in the database, unconfirmed requests are deleted 7 days after the confirmation link expires and confirmed appointments one year after their date; calendar entries and emails are kept for as long as needed to follow up the business relationship, at most 3 years after the last appointment; any invoices are kept for 10 years (Article L123-22 of the French Commercial Code).

Your request is first recorded as "pending" and an email containing a confirmation link, valid for 30 minutes, is sent to you; this link is only stored as a fingerprint (hash). If you do not confirm, Lorenz Piano is informed by email, by the following day at the latest, of your pending request (service, requested date, address and contact details) so that he can get back to you. When you confirm it, the appointment is entered in Lorenz Piano’s Google Calendar: the entry contains the service and your name (title), the appointment address (location), and your phone number, email address, language, access details, information about the instrument, your message and the price breakdown (description). You then receive a confirmation email with a calendar file (.ics), followed by a reminder the day before the appointment; Lorenz Piano receives an email notification.

Silent systems and humidity control systems are requested by quote, without an online appointment: see "Quote request" above. Nothing is entered in the calendar at this stage; the date is then agreed with you.

To display the available time slots, the postcode of the address entered is sent to the website’s server so that a "tour" discount can be offered where applicable; it is not recorded at this stage.

Address entry and travel costs (Google Maps)

• Purpose: suggesting addresses as you type and calculating the road distance from the workshop, in order to show the indicative travel costs (Pricing page) or the price of the appointment (online booking).
• Data: characters typed in the address field and the address selected, as well as your IP address and your browser’s technical information, sent to Google when the service loads.
• Legal basis: legitimate interest in offering reliable address entry and an accurate price, the service only being loaded at your request, when you activate the address field (click or typing) (Article 6(1)(f) GDPR); for a booking, pre-contractual steps (Article 6(1)(b)).
• Recipient: Google (Google Maps Platform: address autocomplete, distance calculation and Routes API), under its privacy policy: https://policies.google.com/privacy
• Transfer: possible to the United States, see "Transfers outside the European Union".
• Retention: Lorenz Piano only keeps this data as part of a booking (see above); its retention by Google is governed by Google’s privacy policy.

Until you activate the address field, no request is sent to Google. When you book, the website’s server may also send the appointment address to Google’s Routes API to recalculate the distance reliably; only this address is sent, together with the workshop’s address.

If you prefer not to use this service, you can get a price or an appointment by phone or by email.

YouTube videos

• Purpose: playing the musicians’ videos shown on the website.
• Data: IP address, technical browser information, video watched and interactions with the player.
• Legal basis: the video is only loaded at your request, when you click on it; legitimate interest in presenting these videos (Article 6(1)(f) GDPR).
• Recipient: Google (YouTube), via the youtube-nocookie.com domain (privacy-enhanced mode) and the player library loaded from youtube.com, under Google’s privacy policy: https://policies.google.com/privacy
• Transfer: possible to the United States, see "Transfers outside the European Union".

Before you click, only a preview image hosted on the website is shown and no data is sent to YouTube. After the click, YouTube may store or read information in your browser.

Customer reviews

• Purpose: presenting reviews left by customers on Google.
• Data: name or pseudonym and profile picture as published on Google, rating, date and text of the review.
• Source: reviews published publicly on Lorenz Piano’s Google business profile.
• Legal basis: legitimate interest in presenting genuine reviews of the business (Article 6(1)(f) GDPR).
• Retention: until the selection of reviews is updated or until you ask for removal.

Profile pictures are copied to the website’s server, so displaying the reviews sends no request to Google. If you wrote a review and no longer wish it to appear on the website, write to info@lorenz-piano.fr.

Protection against abuse

• Purpose: preventing automated submissions and abuse (bots, mass submissions, blocking of time slots, emails sent to an address that did not ask for anything).
• Data: fingerprint of your IP address, fingerprint of the email address entered, number of recent requests, anti-bot proof.
• Legal basis: legitimate interest in keeping the website and its services secure (Article 6(1)(f) GDPR).
• Recipients: no third-party detection service: the anti-bot check (ALTCHA) is computed by your browser and verified by the website’s server, without cookies; the counters are stored in the database hosted by Neon Inc.
• Retention: fingerprints and counters deleted automatically after 24 hours.

Apart from the host’s server logs (see "Hosting and use of the website"), your IP address is never stored in clear: it is turned into a fingerprint using a keyed hash function (HMAC), which cannot be reversed to the address without the secret key, and is only used to limit the number of requests per hour. The forms also contain an invisible field designed to catch bots and, for bookings, a minimum completion time.

Online withdrawal

• Purpose: receiving your withdrawal statement and acknowledging receipt on a durable medium.
• Data: name, email address, appointment or contract concerned, date and time of receipt, reference assigned to the statement, website language.
• Legal basis: legal obligation (Article 6(1)(c) GDPR; Articles L221-18 et seq. of the French Consumer Code, in particular L221-21).
• Recipients: Lorenz Piano; Brevo (Sendinblue SAS, France), which sends the statement to Lorenz Piano and the acknowledgement to your address; Vercel Inc., which runs the sending function.
• Retention: emails kept for as long as needed to prove that the right was exercised, at most 5 years (general limitation period, Article 2224 of the French Civil Code). The statement is not recorded in the website’s database.

Recipients and processors

• Vercel Inc. (United States): website hosting, server functions and storage of uploaded files (Vercel Blob).
• Neon Inc. (United States): database for bookings and anti-abuse counters, hosted in Frankfurt (Germany).
• Sendinblue SAS (Brevo, France): sending emails.
• Google Ireland Limited (Ireland) and Google LLC (United States): Lorenz Piano’s Google Calendar, Google Maps Platform (address entry, distance) and, at your request, the YouTube player.

These providers process data on behalf of Lorenz Piano, only to the extent necessary for their task. When loaded at your request, Google Maps and YouTube also process certain data under Google’s own rules. Your data is not disclosed to any other third party, except to authorised authorities where required by law.

Transfers outside the European Union

Vercel, Neon and Google are companies established in the United States or belonging to a US group: data may therefore be transferred to, or be accessible from, the United States. These transfers take place under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or under standard contractual clauses adopted by the European Commission.

Your rights

Under Articles 15 to 21 GDPR, you may request access to your data, its rectification, its erasure or the restriction of its processing, object to processing based on legitimate interest, and receive the data you provided in a structured, commonly used format (portability) where the processing is based on a contract or pre-contractual steps.

Under French law, you may also set instructions on the retention, erasure and disclosure of your data after your death (Article 85 of Act No. 78-17 of 6 January 1978).

To exercise these rights, write to info@lorenz-piano.fr or to Lorenz Piano, 92 Quai de Pierre Scize, 69005 Lyon, France. You will receive a reply within one month, which may be extended as provided for by the GDPR; if there is reasonable doubt about your identity, proof of identity may be requested.

If you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Mandatory information

Information marked as required in the forms is necessary to process your request or booking: without it, the request cannot be processed. You can always contact Lorenz Piano by phone.

Security

The website is served over HTTPS only. Booking confirmation links rely on a random key stored only as a fingerprint, IP addresses are pseudonymised, submissions are checked and rate-limited, and access to the technical services (database, calendar, email, storage) is protected by keys kept on the server. As no transmission over the Internet is completely secure, these measures cannot rule out all risk.

Changes to this policy

This policy may be amended to reflect changes to the website, its service providers or the law. The date of the last update is shown at the top of the page.