Data controller
Fleur Française — controller to be configured, Controller address to be configured before production. For any question about your data, write to privacy@example.test or use our contact form.
Data processed
We process identity and contact data, account and session information, billing address, orders and subscriptions, consents, saved lessons, forms and contributions, as well as technical logs needed for security. Full card details are transmitted directly to the payment provider and are not stored by Fleur Française.
Purposes and legal bases
Performance of the contract is the legal basis for account creation, content delivery, and management of orders, subscriptions and gifts. Accounting and tax obligations are the basis for archiving required records. Our legitimate interest is the basis for securing the service, preventing abuse and defending our rights, after balancing the relevant interests. Marketing communications rely solely on your consent, which you may withdraw at any time.
Recipients and transfers
Data is accessible only to authorized persons and processors necessary to provide the service: DigitalOcean for hosting and files, Stripe for payments, Brevo for transactional emails and Sentry for technical diagnostics. Production settings must limit transmitted data to what is strictly necessary. When processing involves a transfer outside the European Economic Area, it must be covered by an adequacy decision or the safeguards required by the GDPR and the relevant processor agreement.
Retention periods
Active account data is retained for the duration of the contractual relationship. After a deletion request, a 30-day period allows cancellation, after which identifiers, preferences, contributions and personalization data are deleted or anonymized. Accounting records and order evidence are kept in a restricted-access archive for 10 years from the close of the relevant financial year. Marketing consents are deleted when the account is erased; an objection may be retained separately and to the strict minimum needed to prevent further contact.
Backups follow their rotation cycle and are not restored to the active service except during a controlled security recovery. Any recovery must reapply deletion requests that have already been completed.
Your rights
Under the GDPR, you may request access, rectification, erasure, restriction or portability of your data, object to certain processing and withdraw consent at any time. You may also lodge a complaint with the CNIL.
Manage your preferences in My data and communications or use our contact form. A complaint may be submitted to the CNIL at cnil.fr.
Cookies and local storage
Strictly necessary cookies and storage maintain the session, security, selected language, account navigation, CMS preferences and duplicate-reaction prevention. No advertising tracker is enabled. Any future non-essential tracker must be disabled by default and, where required by law, subject to prior consent that is as easy to withdraw as to give.