This English text is a courtesy translation. The French version is the only binding one.

Last updated: [TO BE COMPLETED]

This policy describes the processing of personal data carried out on this site under Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 as amended.

Data controller

Camille Ayasse Staletti, 16 rue Visconti, 75006 Paris, mail@camilleayassestaletti.com.

Data collected, purposes and legal bases

Book orders. Name, delivery and billing address, email, order contents — necessary for performance of the sales contract (article 6.1.b). Card details are never received or stored by the seller; they go directly to Stripe.

Appointment requests. Name, email, subject, message, requested date and time slot (articles 6.1.a and 6.1.b). The request creates an event in the gallery's professional calendar, hosted by Google, to which the requester is invited by email.

Accounting obligations. Invoicing data is kept under a legal obligation (article 6.1.c).

No profiling or automated decision-making takes place.

Recipients

Data is never sold, rented or transferred. It is shared only with the providers needed to run the service:

• Vercel Inc. (United States) — website hosting;
• Sanity.io — editorial content and image hosting;
• Google Ireland Limited — professional calendar where appointment requests are recorded;
• Stripe — payment processing;
• Infomaniak Network SA (Switzerland) — domain name and mailboxes.

Some providers may process data outside the European Union, under the safeguards of Chapter V of the GDPR, in particular the European Commission's standard contractual clauses.

Retention periods

• Order and delivery data: for the duration of the contract, then archived for the applicable limitation period.
• Accounting records and invoices: ten years (article L123-22 of the French Commercial Code).
• Appointment requests and contact messages: three years after the last contact.

Cookies and trackers

This site sets no advertising cookies, no analytics and no third-party trackers. It loads no fonts, scripts or content from any third-party server: every resource is served by the site itself.

Only two items are stored in the browser's local storage, on the visitor's device:

• cas-cart — the contents of the basket, so it survives from page to page;
• cas-mode — the light or dark display preference.

Both are strictly necessary for a service expressly requested by the visitor. They are therefore exempt from prior consent and no cookie banner is required. They are never sent to a server and disappear when site data is cleared in the browser.

Your rights

Everyone has the right to access, rectify, erase, restrict, object to and port their data, and to give directions as to its fate after their death.

These rights may be exercised at mail@camilleayassestaletti.com; a reply is given within one month.

A complaint may be lodged with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.

Security

The site is served exclusively over HTTPS. Access to the content administration interface is password-protected, and exchanges with the content management system are authenticated by token.