This English translation is provided for convenience only. Only the French version, available at xaviers.photo/confidentialite/, is legally binding.
Last updated: 8 September 2026
1. Data controller
The controller of the personal data collected on xaviers.photo is:
Xavier Schällebaum — artist-author photographer
SIRET 437 694 375 00027
5 rue du Général Delanne, 92200 Neuilly-sur-Seine, France
Email: contact@xaviers.photo
2. Data collected
The xaviers.photo website collects the following data:
| Type of data | Source | Purpose | Duration |
|---|---|---|---|
| Surname, first name, address, telephone, email | Order form | Order fulfilment, delivery, invoicing | 10 years (accounting obligation); uncompleted orders (carts, failed or cancelled payments): 1 year |
| Email only | Newsletter form | Sending news of new editions | Until unsubscribed |
| Email, message | Contact form | Responding to enquiries | 3 years after last contact |
| Account data (login, first and last name, addresses, order history and documents) | Account creation (order or registration) | Management of your personal space: order tracking, certificates of authenticity, invoices, order documents | For the life of the account; deleted on request; inactive accounts (no sign-in or order) deleted or anonymised after 3 years, after notice |
| Aggregated browsing data | Plausible audience measurement (cookie-free) | Anonymous visit statistics | Aggregated — no individual data retained |
| Payment data | Stripe (processor) | Payment security | No banking data stored by the Seller |
| Phone number, content of WhatsApp exchanges | WhatsApp Business (contact at your initiative) | Answering your questions, personalised advice | 3 years after last contact |
| Name, email, chosen time slot and meeting topic | Video call booking (Calendly) | Organising the meeting and sending reminders | 3 years after last contact |
| Your device’s camera feed (augmented reality) | ArtPlacer widget, at your initiative | To-scale preview of the work in your home | No image retained by xaviers.photo |
| IP address, login and security logs | Browsing the site, login attempts | Site security, fraud and intrusion prevention | 30 days (events); one year at most (logins) |
Personal space — Creating an account (when ordering or registering) opens a secure personal area giving access to order tracking, certificates of authenticity, invoices and order/delivery documents. The account is activated via a confirmation e-mail sent to the address provided. Account data are kept for as long as the account is active; you may request its deletion at any time by writing to contact@xaviers.photo.
3. Legal bases
- Performance of the contract : for print orders and the management of the personal space, including transactional order and activation e-mails (art. 6.1.b GDPR)
- Consent : for the newsletter and cookies that are not strictly necessary (art. 6.1.a GDPR)
- Legitimate interest : for site security and fraud prevention (art. 6.1.f GDPR)
- Legal obligation : for the retention of invoices and accounting data (art. 6.1.c GDPR)
4. Recipients of the data
The data are processed by the Artist, his processors and, for some services, independent data controllers:
- Infomaniak (hosting, Switzerland) — data-processing agreement incorporated in its terms of service
- Stripe (payments, Ireland/USA) — EU-US Data Privacy Framework
- DHL (delivery of the works) — recipient’s name, address, telephone and e-mail, strictly necessary for delivery; DHL processes these data on its own behalf as carrier; for deliveries outside the European Union, the address is transmitted to the destination country
- PICTO Paris (printing atelier) — production files only, no client data
- Brevo (newsletter, France) — e-mail address and sign-up date, strictly necessary for sending
- Cloudflare (Turnstile — anti-bot protection of the account creation form, USA) — IP address and technical browser signals, with no advertising cookies
- Klarna (payment facility) — an independent data controller when you choose instalment payment
- Plausible Analytics (cookie-free audience measurement, hosted in the European Union)
- WhatsApp (Meta Platforms Ireland Ltd) — messaging used solely at your initiative; your number and the content of the exchanges are also processed by Meta under its own privacy policy
- Calendly LLC (video call scheduling, United States) — name, email, time slot and meeting topic, strictly necessary to organise the meeting
- ArtPlacer NA Inc. (United States) — to-scale preview of the works in your home, in augmented reality: the feature uses your device’s camera, at your initiative, within the ArtPlacer widget; no photograph of your interior is sent to xaviers.photo. How ArtPlacer processes the camera feed is being confirmed with the provider
- Google Ireland Ltd / Google LLC (United States) — two distinct uses: Google Drive (Google Workspace, Google Cloud data-processing addendum), the destination of the site’s backups (daily database, weekly files), which contain orders and customer contact details and are transferred over an encrypted connection; and reCAPTCHA (Google acts as processor), anti-bot protection of the forms, loaded only when you interact with them
- Defiant, Inc. — Wordfence (site security, United States) — IP addresses and technical signals of attack attempts, shared with its security network; event logs kept for 30 days, login logs for one year at most
No data is resold or transmitted for third-party commercial purposes.
5. Transfers outside the EU
Some processors (Stripe, Google, Meta/WhatsApp, Calendly, ArtPlacer, Cloudflare, Defiant/Wordfence) may transfer data to the United States. Depending on the provider, these transfers are governed by the EU-US Data Privacy Framework (July 2023) and by the European Commission’s Standard Contractual Clauses (SCCs). For deliveries outside the European Union, the carrier receives the delivery address in the destination country (contractual necessity).
6. Your rights
In accordance with articles 15 to 22 of the GDPR, you have at any time the right of access, rectification, erasure, restriction, portability and objection concerning your personal data.
You can exercise these rights by email at contact@xaviers.photo. A reply will be provided within one month at most.
You also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL, the French data protection authority) : www.cnil.fr — 3 place de Fontenoy, 75007 Paris.
7. Security
The xaviers.photo website is hosted on secure Infomaniak servers (Switzerland), with HTTPS encryption across the entire domain, regular off-site backups (encrypted transfer), two-factor authentication for site administration, and anti-intrusion and anti-DDoS protection.