Privacy Policy
Last updated: 16 October 2026
1. Controller
Pierre Galle, natural person, Rue des Champs Bailly 11, 4845 Jalhay, Belgium, enterprise number: registration pending.
Contact for any question about your data: gallepierre@proton.me.
2. Data we collect
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | creating and managing your account, login, order emails | performance of contract |
| Password (stored only as an irreversible bcrypt hash) | account security | performance of contract |
| Purchase history, reservations, Premium status, withdrawal-waiver consent (date/time) | providing the service, proof of performance, accounting | contract; legal obligation |
| Stripe customer and payment IDs (never card details) | processing payments and subscriptions | contract |
| IP address and server technical logs | security and abuse prevention (login rate limiting) | legitimate interest |
| Language preference | showing the site in your language | legitimate interest |
- Not collected: no special-category data (health, opinions, etc.).
- No advertising: we do not sell your data and do no targeted advertising.
3. Cookies
We use strictly necessary cookies only, which do not require consent:
__Host-sid: session cookie, to keep you logged in and protect forms (anti-CSRF token). It expires after 7 days of inactivity or at logout.lang: remembers your chosen language.
There are no advertising or third-party analytics cookies. Stripe may set its own cookies on its hosted payment page (checkout.stripe.com): see Stripe's privacy policy.
4. Recipients and processors
- Stripe Payments Europe Ltd. (Ireland): payment and subscription processing, customer portal. Stripe acts as our processor and, for some purposes (fraud prevention, regulatory duties), as an independent controller. See stripe.com/privacy.
- OVH Hosting Inc. (OVHcloud): server and database hosting in a data centre located in Canada (Beauharnois, Quebec).
- Where applicable, an accountant bound by professional secrecy, for accounting and tax obligations.
5. Transfers outside the European Union
The site is hosted in Canada. The European Commission has recognised that Canada provides an adequate level of protection for organisations subject to the federal PIPEDA law (Decision 2002/2/EC, confirmed in the January 2024 review). Transfers to our host rely on this adequacy decision (host: OVH Hosting Inc., Montréal; where applicable, contracting party OVH SAS, France, which is subject to the GDPR).
Contact us for information about these safeguards.
6. Retention
- Account: kept while the account is active. Deleted or anonymised 30 days after a deletion request or after 3 years of inactivity.
- Order data and invoices: 7 years (Belgian accounting obligation).
- Technical logs: 30 days.
- Sessions: 7 days at most.
7. Your rights
You have the following rights:
- access, rectification and erasure;
- restriction and objection;
- data portability;
- withdrawing consent where processing is based on it.
To exercise them, email gallepierre@proton.me. We reply within one month.
You can lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
8. Security
The security measures in place are:
- encrypted connection (HTTPS);
- hashed passwords;
- secure cookies;
- anti-CSRF protection and login rate limiting;
- regular backups;
- server access restricted to SSH keys.
9. Changes
We may update this policy; the date at the top shows the latest version.