Privacy
Privacy
Last updated —
Contents
This page sets out the personal data collected on this site, why it is collected, how long it is kept and how to exercise your rights. It covers the Incxnnue Lab site only.
Data controller
The data controller is Mrs Laura Deweilde, sole trader (Incxnnue), 3 rue de la Fidélité, 75010 Paris, France.
No data is sold, rented or shared for advertising purposes.
Data collected
Only what each step requires is asked for. No field is mandatory beyond those needed to reply to you or to perform the service.
- Contact form
- Name, email, subject, workshop concerned, message content.
- Workshop booking
- Name, email, chosen slot and answers to booking questions, through Cal.com.
- Gift card
- Amount, recipient first name and email, sender first name, personal note.
- Payment
- Handled by Stripe. The card number is never sent to the publisher or stored on the site.
- Server logs
- IP address, requested page, timestamp and browser, kept by the host for security and diagnostics.
Purposes and legal bases
- Answering a message
- Legitimate interest in handling incoming requests (art. 6.1.f GDPR).
- Booking, changing or cancelling a workshop
- Performance of the contract (art. 6.1.b GDPR).
- Issuing and delivering a gift card
- Performance of the contract (art. 6.1.b GDPR).
- Taking payment and keeping accounts
- Performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
- Securing the site and preventing abuse
- Legitimate interest (art. 6.1.f GDPR).
Retention periods
The periods below run from the last contact or from the end of the service.
- Form messages
- 12 months after the reply.
- Bookings and gift cards
- Up to 12 months after the workshop or after the card expires.
- Invoices and accounting records
- 10 years, as required for accounting records.
- Server logs
- 12 months at most.
Recipients and processors
Your data is accessible only to the publisher and to the providers below, who act on instruction and only as far as their task requires.
- Vercel Inc.
- Site hosting and server logs — United States.
- Cal.com
- Slots and workshop bookings — United States.
- Stripe
- Online payment and fraud prevention — Ireland and United States.
- Resend
- Delivery of contact form emails — United States.
- Orange
- The lab's email mailbox — France.
Transfers outside the European Union
Some providers are established outside the European Union, mainly in the United States. These transfers are covered by the European Commission's standard contractual clauses and, where the provider is certified, by the EU–US Data Privacy Framework.
Your rights
You have the following rights over your data:
- Access: obtain a copy of the data held.
- Rectification: correct inaccurate or incomplete information.
- Erasure: request deletion, within the limits of legal retention duties.
- Restriction: ask for processing you dispute to be frozen.
- Objection: object to processing based on legitimate interest.
- Portability: receive your data in a machine-readable format.
- Withdrawal of consent: at any time, where processing relies on it.
A request is handled within one month. Proof of identity may be requested where there is reasonable doubt about who is asking.
If the answer does not satisfy you, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Security
The site is served over HTTPS only. Access to data is limited to the people who need it. Payments are handled by Stripe, a PCI-DSS certified provider, and the card number never passes through our servers.
Changes
This policy may change as the site's services evolve. The last update date appears at the top of the page. Where a change is substantial, the people concerned are informed by email when their address is known.