Privacy

Personal data policy, written under Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 as amended.

Controller

[NAME OR COMPANY NAME], [ADDRESS]. Contact: contact@keeptherainaway.com. No data protection officer has been appointed; the activity does not make that appointment mandatory.

What is processed, and why

• Order and delivery of a print: name, postal address, email address, order contents and amount. Legal basis: performance of the contract (article 6.1.b GDPR).
• Accounting and tax obligations: transaction records. Legal basis: legal obligation (article 6.1.c).
• Replying to a message sent through the contact form: name, email address, message. Legal basis: legitimate interest in answering an enquiry (article 6.1.f).
• Audience measurement, where enabled: a technical identifier and the pages viewed. Legal basis: consent (article 6.1.a), collected through the cookie settings and withdrawable at any time.
• Server logs: IP address, timestamp, resource requested. Legal basis: legitimate interest in the security of the service (article 6.1.f).

No data is used for marketing without separate consent. There is no automated decision-making and no profiling. No data is sold or rented.

Retention

• Orders and accounting records: 10 years from the close of the financial year (article L123-22 of the French Commercial Code).
• Customer details outside that obligation: 3 years from the last contact.
• Messages from the contact form: 3 years from the last exchange.
• Audience measurement: 25 months at most, following the CNIL recommendation.
• Proof of cookie consent: 6 months.
• Server logs: 12 months.

Recipients

• Stripe Payments Europe Ltd, to process payment. This site never collects, sees or stores card details: they are entered directly on Stripe's secure pages.
• The site host, for technical operation only.
• The carrier handling the shipment, for delivery data only.

Transfers outside the European Union

Some providers may process data outside the European Economic Area. Such transfers are covered by the European Commission's standard contractual clauses or by an adequacy decision. Details of the safeguards are available at contact@keeptherainaway.com.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to give instructions on what happens to your data after your death. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing already carried out.

Write to contact@keeptherainaway.com to exercise them. You will get an answer within one month. Proof of identity may be requested where there is reasonable doubt.

Complaints

If, after contacting us, you believe your rights are not respected, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. You may also complain to the supervisory authority of your own country of residence.

Security

Traffic to and from this site is encrypted. Administration passwords are stored as scrypt hashes. High-resolution photographic files are kept outside the web-accessible directory.