Privacy policy

1. Data controller

Fanny Labbé EI, trading as MNLA.
2153 route de Pommiers, 24350 Lisle
SIRET: 93792603800020
Email: mnla.contact@gmail.com

This document informs you of the processing of personal data carried out on the website www.fanny-labbe.fr, in accordance with Articles 13 and 14 of the GDPR (General Data Protection Regulation). It does not call for any acceptance on your part: it provides you with information, and you may exercise your rights at any time under the conditions set out in section 10.

2. Data collected

When you use a contact form:

• surname, first name, email address, telephone number;
• the content of your request and the project details you describe.

When you purchase a gallery or a gift card:

• email address, name and billing address, passed on by Stripe after your payment;
• order details: product, amount, date, status, Stripe session and payment identifiers;
• personal link giving access to the gallery, in the form of a random token sent by email;
• for a gift card, the recipient's first name, your own and the message you write.

Evidence relating to the order:

• date and time of the waiver of the right of withdrawal, when you tick the box provided before payment;
• reference of the version of the terms and conditions of sale accepted;
• date of issue and content of the invoice.

Technical data:

• connection logs generated by the hosting provider, including the IP address;
• IP address and timestamp of attempts, used to limit the number of requests on the forms and the payment, in order to prevent abuse;
• aggregated audience measurement, without cookies and without a persistent identifier (see section 11).

Mandatory data. The data requested when placing an order, email address, name and billing address, is necessary for the conclusion of the contract and for issuing the invoice, which is required by law. If it is not provided, the purchase cannot be completed. Fields in the contact forms marked as optional may be left blank.

Photographs:

Photographs taken during a service constitute personal data of the people who appear in them. They are stored with Cloudflare and made available in a private or paid gallery. This processing is described in detail in section 4.

3. Source of the data

• Directly from you, when you fill in a form or place an order.
• From Stripe, which passes on your email, your name and your billing address after payment.
• Automatically, for connection logs and audience measurement.

4. Purposes and legal bases

• Responding to a contact request: performance of pre-contractual measures taken at your request, Article 6(1)(b) of the GDPR, where the message concerns a service. For any other question, legitimate interest, Article 6(1)(f), consisting in replying to people who write in. You are not asked to tick any consent box: sending the form already implies wanting a reply, and consent that had to be ticked in order to write would not be freely given. The data provided is used solely to handle the request, never for marketing communications.
• Performing the order, opening access to the gallery, sending the gift card and the personal link: performance of the contract, Article 6(1)(b).
• Issuing and keeping the invoice: legal obligation, Article 6(1)(c), under accounting and tax obligations.
• Keeping evidence of the waiver of the right of withdrawal and of the version of the terms accepted: legitimate interest, Article 6(1)(f), consisting in being able to establish one's rights in the event of a dispute.
• Ensuring the security of the site and preventing abuse: legitimate interest, Article 6(1)(f).
• Producing and delivering the photographs: performance of the service contract concluded with the person who books the session, Article 6(1)(b). Their public dissemination by the photographer, for portfolio or promotional purposes, is based on the distinct consent of the people depicted, Article 6(1)(a), obtained separately and revocable at any time.
• Measuring audience in aggregate form: legitimate interest, Article 6(1)(f), as no cookie or persistent identifier is placed.

No automated decision-making. In accordance with Article 13(2)(f) of the GDPR, no processing is based on automated decision-making producing legal effects, and no profiling is carried out.

5. Who processes your data?

Technical service providers act as processors, each for a specific purpose:

• Vercel Inc.: hosting of the Site, connection logs and audience measurement.
• Supabase: database for galleries, purchases, gift cards and invoices.
• Cloudflare: storage of photographs and archives.
• Stripe: payment processing. Stripe collects the name, billing address and email address. Bank details are entered on its pages and never pass through the Site.
• Resend: delivery of transactional emails, purchase confirmations, gift cards and invoices.

Information may also be disclosed to comply with a legal or regulatory obligation, or in connection with protecting the rights, security or property of the Site.

No data is sold, exchanged or shared for commercial purposes.

6. Hosting and security

The Site is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, California 91723, United States).

Communications are encrypted using HTTPS, gallery passwords are stored as hashes and never in plain text, access to galleries relies on signed cookies, and links to photographs are temporary. Access to the database is restricted to the server.

7. Retention periods

• Contact requests: 12 months from the last exchange.
• Invoices and accounting records: 10 years, in accordance with Article L.123-22 of the French Commercial Code (Code de commerce).
• Orders and proof of consent, including the waiver of the right of withdrawal: 5 years, the applicable limitation period.
• Online galleries: two months after purchase for a paid gallery. The original files are then kept offline for as long as necessary for any reprints, and deleted on request.
• Gift cards: until they are used or expire, then with the corresponding accounting records.
• Connection logs: 6 months.
• Rate-limiting counters, which contain an IP address: 24 hours, automatically purged thereafter.
• Cookies: see section 11. No audience measurement cookie is placed.

8. Transfer outside the European Union

The database is hosted in the European Union. As Supabase Inc. is established in the United States, access from that country remains possible as part of its technical support, subject to the same safeguards as those described below.

The other providers listed in section 5 are established in the United States or process part of the data there: hosting of the Site, storage of photographs, payment processing and sending of emails.

These transfers are governed by the mechanisms provided for in Chapter V of the GDPR, namely the data protection framework between the European Union and the United States, known as the EU-US Data Privacy Framework, or the standard contractual clauses of the European Commission. The conditions specific to each provider are set out in its privacy policy:

• Vercel
• Stripe
• Cloudflare
• Resend
• Supabase

9. People who are photographed

If you appear in a photograph without having booked the service, you have the same rights as any data subject. You may request access to the images showing you, their rectification or their erasure, or object to their dissemination.

No photograph is published on the site, on social media or in any other promotional medium without the agreement of the people depicted. This agreement may be withdrawn at any time, in which case the photograph is removed from the media concerned.

10. Your rights

In accordance with the GDPR and the French Data Protection Act (loi « Informatique et Libertés »), you have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to withdraw consent at any time, solely for the processing that relies on it, including the dissemination of photographs;
• right to set out instructions regarding what happens to your data after your death.

These rights are exercised by writing to mnla.contact@gmail.com. A response is provided within a maximum of one month, which may be extended by two months in the case of a complex request.

Certain requests may be limited by a legal obligation: an invoice cannot be erased before the accounting retention period has expired.

You may also lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr.

11. Cookies and audience measurement

The Site only places cookies that are strictly necessary for its operation, which do not require prior consent:

• galerie_session: maintains access to a private gallery after the password has been entered. Duration: 24 hours.
• galerie_achat: maintains access to a paid gallery after payment, on the device used. Duration: two months, in line with the gallery access period. After that, the personal link received by email remains the means of access.

Both of these cookies are signed, inaccessible to the page's JavaScript code, and are used only to verify an access right.

Audience measurement. The Site uses Vercel Web Analytics and Vercel Speed Insights, which measure traffic and loading times without placing any cookie or building a persistent identifier. No profiling is carried out, and no consent banner is therefore required for this purpose.

No advertising, social media or third-party tracking cookie is placed.

12. Managing cookies from your browser

Refusing functional cookies prevents access to the galleries, which relies on them.

• Microsoft Edge: Settings → Cookies and site permissions.
• Firefox: Options → Privacy & Security → Cookies and Site Data.
• Safari: Preferences → Privacy.
• Google Chrome: Settings → Privacy and security → Clear browsing data.
• Opera: Settings → Clear browsing data.