This policy explains what personal data is collected when you visit https://foitou.com, why it is collected, how long it is kept and what rights you have over it. It is written in line with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
The data controller is Christina Foitou, sole trader (entrepreneur individuel), 2 rue Théophraste Renaudot, 86000 Poitiers, France — SIREN 891 053 613.
For any question about this policy or about your data: “foitouxristina@gmail.com” <foitouxristina@gmail.com>.
Given the size and nature of the activity, no Data Protection Officer has been appointed. Requests are handled directly by Christina Foitou.
No personal data is requested in order to browse the website. Data is only collected when you choose to send it, or automatically for technical and security reasons.
| Contact form: name, email address, message, and anything else you choose to include | Replying to your enquiry and following up on it | Legitimate interest in answering people who get in touch, or the steps taken before entering into a contract | 3 years from our last exchange |
| Newsletter: email address, first name (optional) | Sending news about exhibitions, new work and events | Your consent | Until you unsubscribe, or after 3 years without any interaction |
| Orders and commissions: name, billing and delivery address, email, phone, order details | Processing and delivering your order, invoicing, after-sales contact | Performance of the contract, and legal accounting obligations | Accounting records: 10 years, as required by French law |
| Technical server logs: IP address, date and time, pages requested, browser and operating system | Keeping the site running, detecting abuse and security incidents | Legitimate interest in the security and stability of the website | Up to 12 months |
| Audience measurement: pages viewed, approximate location, device type, referring site | Understanding how the site is used and improving it | Your consent, given through the cookie banner | Up to 13 months |
Your data is never sold, rented or exchanged. It is not used for automated decision-making or profiling.
Your data is accessible to Christina Foitou and to the service providers needed to run the website, each acting on instructions and under a contract that requires them to protect it:
Data may also be disclosed where required by law, for example to a court or to a public authority acting within its powers.
Data is stored on servers located within the European Union wherever possible. Where a provider processes data outside the EU, the transfer is covered by an appropriate safeguard under the GDPR — normally the European Commission’s Standard Contractual Clauses or an adequacy decision. You can ask for details of the safeguards in place at any time.
Cookies are small files stored on your device by your browser. This website uses:
No advertising or cross-site tracking cookies are used.
You can change or withdraw your choices at any time through the cookie banner, and you can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site from working.
Under the GDPR you have the right to:
To exercise any of these rights, write to [[CONTACT_EMAIL]]. You will receive a reply within one month. Proof of identity may be requested if there is genuine doubt about who is making the request.
If you are not satisfied with the response, you can lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr. You may also complain to the supervisory authority of the EU country where you live.
Reasonable technical and organisational measures are in place to protect your data, including encrypted connections (HTTPS), access restricted to the people who need it, strong authentication on the administration area, and regular software updates and backups. No system can be guaranteed completely secure, but any breach likely to affect your rights will be reported to the CNIL and, where required, to you.
This website is not directed at children under 15. No data is knowingly collected from children under 15 without the consent of a parent or guardian. If you believe a child has sent personal data through this site, please write to [[CONTACT_EMAIL]] and it will be deleted.
This policy may be updated to reflect changes to the website or to the law. The date at the top shows when it was last revised. Significant changes affecting how your data is used will be signalled on the website.
See also the Legal Notice for information about the publisher and the host of this website.