Sophie COSTA

Privacy Policy

Last updated: [31/07/2026]

This policy describes how the sophiecosta.com website (the “Site”) collects and processes users’ personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (“Informatique et Libertés”).

1 — Data controller

The data controller is Sophie Costa, visual artist, SIRET 490 618 600 00020, 105 ch du Soyard, 69126 Brindas, France, e-mail: [email protected], telephone: +33 (0)6 24 36 42 61.

2 — Data collected

Depending on the user’s interactions, the following data may be collected:

  • Identity and contact data: last name, first name, e-mail, telephone, postal address.
  • Order data: works ordered, amount, delivery address.
  • Content of messages sent via the contact form.
  • Browsing data: IP address, audience measurement data.

Payment data (bank card) is processed directly by Stripe and is neither collected nor stored by the Site.

3 — Purposes and legal bases

Data is processed for the following purposes, on the legal bases indicated:

  • Responding to enquiries sent via the contact form — legal basis: legitimate interest / pre-contractual measures.
  • Processing and tracking orders for artworks — legal basis: performance of the contract.
  • Sending the newsletter — legal basis: consent.
  • Ensuring the operation and security of the Site — legal basis: legitimate interest.
  • Audience measurement (statistics) — legal basis: consent.
  • Complying with accounting and tax obligations — legal basis: legal obligation.
  • Mandatory form fields are marked with an asterisk (*); if they are not provided, the request or the order cannot be processed.

4 — Data recipients

The data is intended exclusively for the Artist and, where applicable, for her technical subprocessors acting on her behalf:

  • OVHcloud (hosting, France).
  • Stripe (payment).
  • Brevo (newsletter e-mailing).
  • The shipping provider for delivery.
  • No data is sold or transferred to third parties for commercial purposes.

5 — Transfers outside the European Union

Some providers (in particular Stripe, as well as the audience measurement tool) may process data outside the European Union. These transfers are governed by appropriate safeguards (European Commission standard contractual clauses).

6 — Cookies and trackers

The Site uses cookies and trackers, in particular for audience measurement (Google Analytics). Trackers that are not strictly necessary are only placed after the user’s consent has been obtained via the cookie management banner. Users may change their choices at any time via the “Manage cookies” link.

7 — Retention period

Data is retained for the following periods:

  • Contact / prospect data: 3 years from the last contact.
  • Order data / invoices: statutory accounting retention period (10 years).
  • Newsletter data: until consent is withdrawn (unsubscribing).
  • Audience measurement cookies: maximum period recommended by the CNIL (13 months).

8 — User rights

In accordance with the GDPR, users have the rights of access, rectification, erasure, objection, restriction and portability of their data, as well as the right to withdraw their consent at any time.

These rights may be exercised by writing to: [email protected].

Users also have the right to lodge a complaint with the CNIL (www.cnil.fr).

9 — Security

The Artist implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration or disclosure.

10 — Changes

This policy may be updated. The applicable version is the one published on the Site on the date of consultation.