This policy explains which personal data QR-cadre.com processes, why, for how long and with whom, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
QR-cadre.com, a single-member limited company (EURL) with a share capital of €500, registered with the Clermont-Ferrand Trade and Companies Register under number 928 488 428, 28 rue Jean Claret, Parc Technologique de La Pardieu, 63000 Clermont-Ferrand, France, represented by Mathieu Randon, manager.
For any question about your data: [email protected] or the support page. QR-cadre.com has not appointed a data protection officer, as this is not mandatory for its activity.
2. Data processed, purposes, legal bases and retention periods
We only collect the data needed for each purpose. Mandatory form fields are marked.
Answering your requests (contact and support forms, email, WhatsApp, appointments)
Data: name, email address, phone number if you provide it, subject, message, information about your project (date, venue, number of guests), order reference, and the blog article you came from if you clicked from one.
Legal basis: pre-contractual measures taken at your request and legitimate interest in answering people who write to us.
Retention period: 3 years from the last exchange, unless a contract is concluded.
Providing photo and video services (quote, contract, shooting, gallery, delivery)
Data: identity and contact details of clients, event information, images and films produced, exchanges related to the service.
Legal basis: performance of the contract.
Retention period: duration of the contractual relationship, then 5 years (limitation period). A backup copy of delivered files is normally kept for about 9 months after first delivery (article 11 of the terms).
Gift cards and online payments
Data: buyer’s name and email address, couple’s first names, message, wedding date, card code, amount, payment reference. The card draft stays in your browser and is not sent to us. Bank details are entered and processed directly by our payment provider: QR-cadre.com never has access to them.
Legal basis: performance of the contract.
Retention period: card validity period (24 months), then 5 years.
Retention period: 10 years from the end of the financial year (article L.123-22 of the French Commercial Code).
Newsletter
Data: email address; first and last name if you provide them; language and the page you signed up from; date and proof of consent; labels we add to sort contacts (for example a trade show); opens and clicks of the emails you receive, for statistics.
Legal basis: consent, which you can withdraw at any time using the unsubscribe link in each email.
Hosting: the list is hosted on our own server at Fly.io in Paris. It is not handed over to any email marketing platform; only our email provider (LWS, France) delivers the messages.
Retention period: until you unsubscribe, then no more than three years after the last contact. After you unsubscribe we keep your address on a suppression list, for the sole purpose of never writing to you again.
Legal basis: consent, collected through the cookie banner and editable on the cookie settings page. Cookies strictly necessary for the site to work do not require consent.
Retention period: up to 13 months for trackers, up to 25 months for audience data.
Blog measurement, without cookies
Data: for each article, the number of reads, of reads to the end and of “likes”, the answers to “Was this article helpful?” with any word you choose to leave, and the number of quiz participants. Nothing is stored on your device for this measurement. Your “like” and your answer are kept in your browser, so the heart stays on and the question does not come back; they stay on your device. To filter abuse and duplicates, your IP address and browser are transformed into daily HMAC fingerprints. These fingerprints are temporarily stored on the server, expire after 24 hours and are automatically purged. Reading and quiz tokens expire after no more than two hours. This system stores neither plain-text IP addresses nor quiz answers. No reading history is stored in your browser.
Purpose: knowing which articles are read and useful, in order to improve them. These figures are anonymous and are never combined with your contact requests or the newsletter.
Legal basis: legitimate interest. Limited to anonymous statistics, this measurement does not require consent (CNIL guidelines on audience measurement). You can object at any time with the button below; your browser’s “do not track” setting is also respected.
Hosting: on our own server, at Fly.io, in Paris.
Retention period: 25 months at most, then automatic deletion. A word left under an article is deleted on simple request.
QR-cadre.com communication (publishing images)
Data: images in which people can be recognised.
Legal basis: written authorisation from the people concerned or a clause of the contract (article 15 of the terms).
Retention period: period set out in the authorisation, and until the person asks for removal.
Site security and abuse prevention
Data: IP address and technical information related to form submissions.
Legal basis: legitimate interest in protecting the site against spam and attacks.
Retention period: up to 1 year.
3. Recipients
Your data is intended for QR-cadre.com. It is never sold. It may be shared, as relevant, with the providers that help us deliver our services and act on our instructions or as controllers of their own processing:
website hosting: LWS (France);
form, newsletter and gallery servers: Fly.io (servers located in Paris), photo and video storage: Amazon Web Services, gallery database: MongoDB;
online payment: Stripe, and PayPal when this method is offered;
email and confirmation messages: our email provider;
audience measurement and Google tools (Google Tag Manager, Google Analytics, Google Calendar for appointments, embedded YouTube videos), Cloudflare performance measurement;
WhatsApp conversations when you choose this channel (Meta);
where applicable, independent professionals working on a service, our accountant, and authorities when required by law.
4. Transfers outside the European Union
Some of these providers are based in the United States or may access data from there (in particular Stripe, Amazon Web Services, Google, Cloudflare, Fly.io and Meta). These transfers are covered by the European Commission’s adequacy decision on the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission’s standard contractual clauses.
5. Security
The site is served over HTTPS, forms are protected against spam and abuse, access to data is limited to those who need it, and private galleries can only be accessed with their personal link. QR-cadre.com does not store any bank details.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, objection (in particular to marketing), data portability, and the right to withdraw your consent at any time. Under French law, you can also give instructions about what happens to your data after your death. Anyone visible in an image published by QR-cadre.com can ask for its removal.
To exercise these rights, write to [email protected] or use the support page. We reply within one month, which may be extended by two months for complex requests. Proof of identity may only be requested if there is reasonable doubt about your identity.
If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your country of residence.
7. Automated decisions
QR-cadre.com does not make any decision based solely on automated processing, and does not carry out profiling producing legal effects concerning you.
8. Changes
This policy may change, for example when the online shop opens. The update date appears at the top of the page. In the event of a significant change, we will inform you through a notice on the site or by email.
9. Contact
QR-cadre.com, 28 rue Jean Claret, Parc Technologique de La Pardieu, 63000 Clermont-Ferrand, France. Email: [email protected].
