1. Scope and operator information
This policy explains the behaviour of the website files supplied in this build. The operator name, company reference and address in the footer are generated illustrative details, not a verified registered business identity. Before operating a live commercial service, the publisher must replace those details and confirm its hosting, email arrangements and applicable legal responsibilities.
The designated privacy and DPO enquiry address is [email protected]. This label provides a contact route; it does not claim that a statutory data protection officer has been appointed. The mailbox must be configured by the domain operator before it can receive messages.
2. Information collected and purposes
The supplied site has no accounts, checkout, newsletter subscription, behavioural analytics or advertising pixels. Browsing its pages does not trigger application-level collection of a profile. A hosting provider may nevertheless process IP addresses, requested URLs, timestamps, browser information and error records to deliver pages and maintain security. The deployment operator must identify and document that processing. The home page also requests externally hosted images, as explained in section 4.
The contact form checks the name, email address, topic and message locally in your browser. It does not upload those fields to a form service. After validation, you can open a prepared email in your own email application. Information is sent only if you choose to send that email. Avoid including identification documents, payment information or sensitive personal material.
3. Browser storage and legal bases
A localStorage record remembers your privacy choice so the banner does not reappear on each page. The record contains the choice, a policy version and a timestamp; it contains no name, email address or advertising identifier. No optional trackers are enabled by either consent button in this version. See the cookie policy for deletion instructions.
Where the GDPR applies to a deployed service, responding to a requested enquiry may rely on legitimate interests or necessary pre-contractual steps, depending on its content. Necessary security processing may rely on legitimate interests. Optional tracking would require a separate assessment and, where required, prior consent; it is not installed here. The operator must also assess and document the legal basis for delivering images through external providers; the banner choices do not control those image requests.
4. Image providers, processors, links and international transfers
The home page loads photographs and artwork images from images.unsplash.com and an image from commons.wikimedia.org, which may redirect to Wikimedia’s image infrastructure, including upload.wikimedia.org. Your browser connects directly to these services to retrieve the images. The providers can receive your IP address, the requested image URL, request time and browser or network information needed to deliver the file. These requests can occur without clicking a link and regardless of the privacy-banner choice. Below-the-fold images use browser-native lazy loading, so the timing of their requests depends on your browser and scrolling.
The image elements use referrerpolicy="no-referrer" to instruct supporting browsers not to send this page’s address as a referrer. This does not conceal your IP address or prevent provider-side logging. The site does not append a visitor identifier or form data to image URLs. Consult the Unsplash privacy policy and the Wikimedia Foundation privacy policy for their processing practices. Their retention, service infrastructure and any browser storage are not controlled by this site’s script.
No external fonts, embedded maps or third-party JavaScript are loaded by the supplied pages. The contact map remains a local inline schematic. Other external references are ordinary links. Following one makes a separate request to that destination, whose privacy practices then apply.
A live hosting supplier and an email supplier may act as processors, depending on their contracts. No hosting or email supplier or processing location has been selected in these files. External image delivery may involve processing outside your country. Before launch, the operator must assess the named image providers, disclose its actual hosting and email providers, determine their respective roles and document any required processing agreements and international transfer safeguards, such as an adequacy decision or applicable contractual safeguards. Self-hosting appropriately licensed image copies is an alternative that would avoid these direct browser requests to external image providers.
5. Retention and security
The browser preference is treated as valid for 180 days. On a later visit after expiry, the script removes the stale record and asks again. You can delete it sooner through browser settings. Form drafts are not saved by the site; your browser or email application may retain them under its own settings.
For deployment, the recommended enquiry retention limit is twelve months after closure unless a legal obligation or active dispute justifies longer storage. This is a proposed operational schedule, not a claim about an existing mailbox. Hosting-log retention must be configured and disclosed separately. External image providers apply their own retention policies to delivery records; clearing this site’s local preference does not delete those records. No internet transmission or storage arrangement can be guaranteed perfectly secure.
6. GDPR and California privacy rights
Subject to applicable law and exceptions, you may request access, correction, deletion, restriction or portability of personal information and object to certain processing. You may withdraw consent without affecting earlier lawful processing. You may also complain to a competent supervisory authority, including CNIL in France.
Where the CCPA or CPRA applies, California residents may have rights to know, access, correct and delete information, opt out of sale or sharing, limit certain sensitive-information uses and receive non-discriminatory treatment. The supplied site does not install cross-context behavioural advertising or intentionally sell personal information. Its script does not enable advertising when a Global Privacy Control signal is present or absent. The deployment operator must assess the external image providers’ actual practices and any applicable sale, sharing or opt-out obligations before making broader claims about third-party processing.
Send requests to the privacy address with enough context to locate relevant correspondence, but not unnecessary identity documents. An operating controller should verify requests proportionately and respond within the applicable statutory period. Requests relating to an image provider’s independent processing may also need to be directed to that provider. Material changes to actual processing must be reflected in this policy before implementation.