Privacy Policy

1. Data controller

[Your Name], [Address], contact@avocette-photo.fr. As data controller, we are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

2. Data collected

• Identification data: name, email address
• Delivery data: postal address, phone
• Payment data: processed exclusively by Stripe (we do not store your banking details)
• Navigation data: IP address, cookies, pages visited
• Order data: purchase history, preferences

3. Legal bases and purposes

• Contract performance: order processing, delivery, after-sales service
• Legal obligation: invoicing, accounting, tax obligations
• Consent: newsletter, non-essential cookies
• Legitimate interest: site security, fraud prevention, service improvement

4. Data recipients

• Stripe - payment processing (USA, standard contractual clauses)
• Supabase - database hosting (EU - Frankfurt)
• Vercel - website hosting (EU - Frankfurt)
• WhiteWall - print laboratory (Germany, EU)
• Resend - transactional email sending

5. Retention periods

• Account data: duration of registration + 3 years after deletion
• Order data: 10 years (legal accounting obligation)
• Payment data: not stored (managed by Stripe)
• Cookies: 13 months maximum
• Security logs: 12 months

6. Your rights

Under the GDPR, you have the following rights:

• Right of access to your data
• Right of rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object and restrict processing
• Right to withdraw consent at any time

To exercise these rights, contact us at: contact@avocette-photo.fr. You may also file a complaint with the CNIL (www.cnil.fr).

7. Transfers outside the EU

Some of our service providers (Stripe, Vercel) are based in the United States. These transfers are governed by standard contractual clauses approved by the European Commission, ensuring an adequate level of protection for your data.