Privacy Policy

1. Data Controller

The data controller is GRIS CIEL STUDIO, France. For all data protection matters, please contact us exclusively through the PGP-encrypted contact form on the Contact page or at griscielstudio@proton.me.

2. Personal Data We Collect

We collect only the personal data that is strictly necessary for the purposes described below (data minimization principle). This may include:

• Contact information (name, email address) when you use our contact form or subscribe to updates (with consent).
• Order information (name, email, shipping address, order details) when you place a purchase.
• Technical and usage data (IP address, browser type, pages visited, device information) for security, site operation, and analytics limited to what is essential.
• Payment information: handled directly by our payment processor (Stripe). We do not store full card details.

3. Purposes and Legal Bases for Processing

We process personal data for the following purposes on the following legal bases:

• Providing our e-commerce services and fulfilling orders (performance of contract).
• Responding to inquiries and customer support (legitimate interest or consent).
• Complying with legal and tax obligations (legal obligation).
• Improving and securing the website (legitimate interest).
• Marketing communications, only with your prior consent (consent; easily withdrawable at any time).

4. Recipients and Data Sharing

Your personal data may be shared with trusted service providers acting as processors on our behalf, including:

• Payment processing: Stripe (compliant with PCI-DSS).
• Hosting, CDN, and security: Cloudflare.
• Email / communication infrastructure as needed for encrypted delivery of contact messages.

We do not sell your personal data. We only share data when necessary to provide the service, to comply with law, or to protect rights.

5. International Data Transfers

Some of our service providers (such as Stripe and Cloudflare) may process data in countries outside the European Economic Area, including the United States. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or other valid transfer mechanisms.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations (e.g., accounting and tax records typically 5–10 years in France), or to resolve disputes. When data is no longer needed, it is securely deleted or anonymized.

7. Your Rights

Under the GDPR and French law, you have the following rights regarding your personal data (subject to legal exceptions):

• Right of access and to obtain a copy of your data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing (including direct marketing).
• Right to withdraw consent at any time (without affecting prior processing).
• Right to lodge a complaint with the French data protection authority (CNIL) or your local supervisory authority.

To exercise any of these rights, please contact us via the encrypted contact form. We may request information to verify your identity before responding.

8. Cookies and Tracking Technologies

We use only strictly necessary cookies and similar technologies required for the basic functioning of the website (e.g., session management, cart functionality, and security). We do not use third-party advertising or unnecessary analytics cookies that require prior consent under ePrivacy rules.

You can control or delete cookies through your browser settings. Disabling certain cookies may affect site functionality.

9. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. Contact form submissions are encrypted end-to-end using PGP before transmission. Payment processing is handled by Stripe using industry-standard security.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the bottom will indicate the effective version. Material changes will be communicated via the website or our contact channels.

11. Contact Us

For any questions about this Privacy Policy or to exercise your rights, please use the secure PGP contact form available on the Contact page. This ensures end-to-end encryption of your inquiry.