Privacy Policy | Vellumpage

Working draft pending legal review. Bracketed fields [À COMPLÉTER : …] are intentionally left visible until completed. This document is currently provided in English for all languages of the site.

Data Controller

Controller: [À COMPLÉTER : Nom] LLC, a limited liability company organized under the laws of New Mexico (United States), [adresse à compléter] — [À COMPLÉTER : e-mail].

EU representative (Art. 27 GDPR): [À COMPLÉTER : nom + adresse du représentant UE, OU justification documentée de l'exemption après avis juridique — le vendeur étant établi hors UE et ciblant des consommateurs UE, le RGPD s'applique (art. 3 §2)].

Data Processed, Purposes and Legal Bases

Processing	Data	Legal basis (Art. 6 GDPR)	Recipient / processor	Retention
Order and delivery of the Products	e-mail, name, country, purchase history	Performance of the contract (6.1.b)	Stripe (payment), hosting provider	[À COMPLÉTER : ex. 5 ans]
Payment	card data (processed by Stripe only, never stored by the Seller), billing country	Performance of the contract (6.1.b) + legal obligation VAT/accounting (6.1.c)	Stripe Payments Europe / Stripe Inc.	10 years (accounting records)
VAT determination (location)	country, IP address, payment method	Legal obligation (6.1.c)	Stripe Tax	10 years
Transactional e-mails (confirmation, delivery)	e-mail, order content	Performance of the contract (6.1.b)	Brevo [À COMPLÉTER : et/ou Mautic auto-hébergé]	lifetime of the account
Newsletter / marketing	e-mail, preferences, open statistics	Consent (6.1.a) — opt-in, withdrawable at any time	Brevo / Mautic	until withdrawal, purge after [À COMPLÉTER : ex. 3 ans] of inactivity
Customer support	e-mail, content of exchanges	Legitimate interest (6.1.f)	[À COMPLÉTER : outil support]	[À COMPLÉTER : ex. 2 ans]
Audience measurement	see Cookie Policy below	Consent (6.1.a), or legitimate interest if an exempted solution is used	[À COMPLÉTER : outil analytics]	[À COMPLÉTER]

Transfers Outside the EU/EEA

Stripe (United States): transfers governed by [À COMPLÉTER : EU-U.S. Data Privacy Framework et/ou clauses contractuelles types — vérifier la page « Stripe Privacy Center » au moment de la publication]. Brevo: EU hosting. [À COMPLÉTER : Mautic — auto-hébergé sur (localisation serveur).] As the Seller is established in the United States (New Mexico), order data is transferred to the United States: safeguards to be documented [À COMPLÉTER : adhésion au EU-U.S. Data Privacy Framework OU clauses contractuelles types + mesures supplémentaires — à valider avec le juriste].

Your Rights

Access, rectification, erasure, restriction, objection, portability, withdrawal of consent: on request to [À COMPLÉTER : e-mail]. Reply within one month. You may also lodge a complaint with the supervisory authority: [À COMPLÉTER : CNIL si France ; sinon autorité du pays du représentant UE / de l'établissement principal].

Security

[À COMPLÉTER : mesures — HTTPS, chiffrement, accès restreints, sauvegardes.] No bank card data is stored by the Seller.

Cookie Policy

Strictly necessary cookies (session, cart, security, consent choice): exempt from consent.
Stripe sets cookies necessary for fraud prevention during payment: "necessary" category, to be documented.
Audience measurement: [À COMPLÉTER : outil retenu. Si solution exemptée configurée en audience anonyme (ex. Matomo config CNIL, ou stats sans cookies type Plausible) → pas de bannière pour ce seul usage. Sinon → consentement préalable.]
Marketing / e-mail tracking (Brevo, Mautic, Pinterest tag…): prior consent required, granular, refusing as easy as accepting, withdrawable via [À COMPLÉTER : lien « Gérer mes cookies »].
Table to be published: cookie name, issuer, purpose, duration. [À COMPLÉTER après audit technique du site.]

You can reopen the consent panel at any time via the "Your privacy choices" link in the footer.