Privacy policy

The data controller

Compagnie des Blasons, 6 rue du Château, 12190 Estaing, France, SIREN 944 919 968. For any question about your data: marceletlesblondes@gmail.com.

What we collect, and why

Your order

name, delivery and billing address, e-mail address, telephone number if you give one, the items and their personalisation. Needed to perform the contract of sale.

Your photograph

if you compose a print with a photograph — the “Portrait” birth print or the star map with photo — the photograph you upload is stored privately with our host so that we can make your print file. It is never published, never used as an example or as marketing imagery, and we strip the data cameras slip into it — the location of the shot in particular. Without a photograph those two designs cannot be made; the others require none.

Your basket

an identifier held in a cookie named “cart”, linking your browser to the basket kept on our server. Without it the basket does not survive a page change.

Where you came from

if you arrive through a tagged link — a pin, a post — a cookie named “src” keeps the name of the network (“pinterest”) for thirty days, and that name is recorded with your order. It does not identify you: thousands of people carry the same value. The click identifier the platform adds to the address is never kept. It is not set if your browser signals “Do Not Track” or “Global Privacy Control”.

Your messages to us

the content of what you send and our reply, to provide customer service.

Server logs

IP address, date, page requested, browser type. Kept for security and for the proper running of the site.

What we do not do

• no advertising tracker, no social network pixel, no profiling;
• two cookies, both ours, and none set by a third party: the basket one, and the one holding the network you came from;
• the “share” buttons are plain links: nothing is loaded from Pinterest, Facebook or WhatsApp until you click;
• no font or image loaded from another domain: everything is served by us;
• no selling, sharing or renting of your data.

Audience measurement, without cookies

We measure traffic with Snorklee, a European service built to count visits without cookies and without a visitor identifier. It tells us which pages are read and where visitors come from — nothing more. It does not follow you from one site to another.

What is sent

the page address, without anything after the “?”; the domain name you arrive from, never the full address; how far down the page you scrolled; how long you stayed; and the fact — never the content — of a form submission, a download or a click to another site.

What is not kept

neither your IP address nor your browser string. They are used for the length of the request to derive a country, a browser family and a device type, then discarded: they never enter the database.

What is never measured

pages carrying a private link — your order, your invoice, your files to download — and the administration. They are not counted at all.

How to refuse

your browser’s “Do Not Track” or “Global Privacy Control” signal is enough: measurement stops on its own, with nothing to click.

Who processes data for us

We use processors, strictly for the purposes above:

Clever Cloud SAS

hosting of the site and the database. A French company, 4 rue Voltaire, 44000 Nantes.

Mollie B.V.

payment processing, in the Netherlands. Your card details are entered on their systems and never pass through ours.

La Poste

carrying parcels: name and delivery address.

OpenStreetMap Foundation

looking up a place in the poster editor. The address you type is sent to their geocoding service from our server, never from your browser, and with nothing that identifies you.

Snorklee

audience measurement, without cookies and without a visitor identifier. European service, hosted in the Union.

Brevo

sending order and shipping e-mails: your e-mail address and the content of the message. French company.

Boxtal

buying shipping labels: name, delivery address and phone, passed on to the carrier. French company.

How long

Orders and invoices

ten years, as accounting and tax law requires.

Unconfirmed basket

thirty days, then deleted.

Customer service messages

three years after the last exchange.

Photographs uploaded for a print

thirty days after the order ships, then deleted. A photograph uploaded that never leads to an order is deleted after the same thirty days.

Server logs

twelve months at most.

Where the data is

The site, the database and the orders are hosted by Clever Cloud, in Europe. Our processors are established in the European Union. No data is transferred outside the European Union.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over your data, and the right to give instructions on what happens to it after your death.

To exercise them, write to marceletlesblondes@gmail.com. We answer within one month. If our answer does not satisfy you, you may complain to the French data protection authority, the CNIL: www.cnil.fr.

Changes

This policy may change, in particular when a new payment or delivery method goes live. The update date at the top of the page is the one that counts.