This English translation is provided for convenience only. Only the French version, available at xaviers.photo/confidentialite/, is legally binding.
Last updated: 2 October 2026
1. Data controller
The controller of the personal data collected on xaviers.photo is:
Xavier Schällebaum — artist-author photographer
SIRET 437 694 375 00027
5 rue du Général Delanne, 92200 Neuilly-sur-Seine, France
Email: contact@xaviers.photo
2. Data collected
The xaviers.photo website collects the following data:
| Type of data | Source | Purpose | Duration |
|---|---|---|---|
| Surname, first name, address, telephone, email | Order form | Order fulfilment, delivery, invoicing | 10 years (accounting obligation); uncompleted orders (carts, failed or cancelled payments): 1 year |
| Email only | Newsletter form | Sending news of new editions | Until unsubscribed |
| Email, message | Contact form | Responding to enquiries | 3 years after last contact |
| Account data (login, first and last name, addresses, order history and documents) | Account creation (order or registration) | Management of your personal space: order tracking, certificates of authenticity, invoices, order documents | For the life of the account; deleted on request; inactive accounts (no sign-in or order) deleted or anonymised after 3 years, after notice |
| Aggregated browsing data | Plausible audience measurement (cookie-free) | Anonymous visit statistics | Aggregated — no individual data retained |
| Pages viewed, works looked at and their price, order amounts, IP address, browser identifier | Meta pixel — loaded only after the “Marketing & social media” category has been accepted | Measuring how effective our Facebook and Instagram advertising is, building advertising audiences | 90 days in the browser; thereafter retained by Meta under its own policy |
| Payment data | Stripe (processor) | Payment security | No banking data stored by the Seller |
| Phone number, content of WhatsApp exchanges | WhatsApp Business (contact at your initiative) | Answering your questions, personalised advice | 3 years after last contact |
| Name, email, chosen time slot and meeting topic | Video call booking (Calendly) | Organising the meeting and sending reminders | 3 years after last contact |
| Your device’s camera feed (augmented reality) | ArtPlacer widget, at your initiative | To-scale preview of the work in your home | No image retained by xaviers.photo |
| IP address, login and security logs | Browsing the site, login attempts | Site security, fraud and intrusion prevention | 30 days (events); one year at most (logins) |
Personal space — Creating an account (when ordering or registering) opens a secure personal area giving access to order tracking, certificates of authenticity, invoices and order/delivery documents. The account is activated via a confirmation e-mail sent to the address provided. Account data are kept for as long as the account is active; you may request its deletion at any time by writing to contact@xaviers.photo.
3. Legal bases
- Performance of the contract : for print orders and the management of the personal space, including transactional order and activation e-mails (art. 6.1.b GDPR)
- Consent : for the newsletter and cookies that are not strictly necessary (art. 6.1.a GDPR)
- Legitimate interest : for site security and fraud prevention (art. 6.1.f GDPR)
- Legal obligation : for the retention of invoices and accounting data (art. 6.1.c GDPR)
4. Recipients of the data
The data are processed by the Artist, his processors and, for some services, independent data controllers:
- Infomaniak (hosting, Switzerland) — data-processing agreement incorporated in its terms of service
- Stripe (payments, Ireland/USA) — EU-US Data Privacy Framework
- DHL (delivery of the works) — recipient’s name, address, telephone and e-mail, strictly necessary for delivery; DHL processes these data on its own behalf as carrier; for deliveries outside the European Union, the address is transmitted to the destination country
- PICTO Paris (printing atelier) — production files only, no client data
- Brevo (newsletter, France) — e-mail address and sign-up date, strictly necessary for sending
- Cloudflare (Turnstile — anti-bot protection of the account creation form, USA) — IP address and technical browser signals, with no advertising cookies
- Klarna (payment facility) — an independent data controller when you choose instalment payment
- Plausible Analytics (cookie-free audience measurement, hosted in the European Union)
- WhatsApp (Meta Platforms Ireland Ltd) — messaging used solely at your initiative; your number and the content of the exchanges are also processed by Meta under its own privacy policy
- Calendly LLC (video call scheduling, United States) — name, email, time slot and meeting topic, strictly necessary to organise the meeting
- ArtPlacer NA Inc. (United States) — to-scale preview of the works in your home, in augmented reality: the feature uses your device’s camera, at your initiative, within the ArtPlacer widget; no photograph of your interior is sent to xaviers.photo. The provider confirmed in writing (September 2026) that the camera feed is processed locally by your device, through the augmented-reality component of its operating system: no image, photograph or scan of your room is transmitted to ArtPlacer or to xaviers.photo. When a work is displayed in the widget, ArtPlacer’s servers receive technical connection data (IP address, browser, device, approximate country) and usage events (widget opened, work viewed, date), which feed statistics reported back to the photographer; retention periods are being confirmed with the provider
- Google Ireland Ltd / Google LLC (United States) — two distinct uses: Google Drive (Google Workspace, Google Cloud data-processing addendum), the destination of the site’s backups (daily database, weekly files), which contain orders and customer contact details and are transferred over an encrypted connection; and reCAPTCHA (Google acts as processor), anti-bot protection of the forms, loaded only when you interact with them
- Defiant, Inc. — Wordfence (site security, United States) — IP addresses and technical signals of attack attempts, shared with its security network; event logs kept for 30 days, login logs for one year at most
- Meta Platforms Ireland Limited — Meta pixel (advertising measurement, Ireland) — pages viewed, works looked at and their price, order amounts, IP address and browser identifier, only if you have accepted the “Marketing & social media” category; for this collection and its transmission, Meta and ourselves are joint controllers (Article 26 GDPR; CJEU, 29 July 2019, Fashion ID, C-40/17). Neither your name, nor your email address, nor your telephone number is sent to it. Details are set out in the cookie policy
No data is resold or transmitted for third-party commercial purposes.
5. Transfers outside the EU
Some processors (Stripe, Google, Meta — advertising pixel and WhatsApp, Calendly, Cloudflare, Defiant/Wordfence) may transfer data to the United States. Depending on the provider, these transfers are governed by the EU-US Data Privacy Framework (July 2023) and by the European Commission’s Standard Contractual Clauses (SCCs). Meta Platforms, Inc. appears on the list of organisations certified under the EU–U.S. Data Privacy Framework maintained by the U.S. Department of Commerce. The ArtPlacer widget (ArtPlacer NA Inc., New York) is hosted in the United States; its provider is not certified under the Data Privacy Framework, and the safeguard governing this transfer (Data Privacy Framework certification or Standard Contractual Clauses) is being confirmed with the provider. In the meantime, the widget is used only at your initiative, and only technical connection and usage data are transmitted to it when it is displayed (see section 4). For deliveries outside the European Union, the carrier receives the delivery address in the destination country (contractual necessity).
6. Your rights
In accordance with articles 15 to 22 of the GDPR, you have at any time the right of access, rectification, erasure, restriction, portability and objection concerning your personal data.
You can exercise these rights by email at contact@xaviers.photo. A reply will be provided within one month at most.
You also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL, the French data protection authority) : www.cnil.fr — 3 place de Fontenoy, 75007 Paris.
7. Security
The xaviers.photo website is hosted on secure Infomaniak servers (Switzerland), with HTTPS encryption across the entire domain, regular off-site backups (encrypted transfer), two-factor authentication for site administration, and anti-intrusion and anti-DDoS protection.