This is an English translation provided for convenience. The French version is the legally binding one and prevails in case of discrepancy.
Draft version: details in yellow will be filled in before the shop opens.
In short: we collect the bare minimum to sell and ship our prints. No ads, no analytics, no selling of data, and no tracking cookies, so no cookie banner.
Data controller
Lionel Braun, sole trader (French "entrepreneur individuel", micro-entreprise) (BROWSTERZ), TO BE COMPLETED: address. Any question about your data: crew@browsterz.com.
What data, why, and for how long
| When | Data | Why (legal basis) | Kept for |
|---|---|---|---|
| Order | Name, billing and delivery addresses, email, phone, products ordered, amount | Process, ship and invoice the order, handle after-sales and returns (performance of the contract); bookkeeping (legal obligation) | 3 years after the last order; invoices and accounting records 10 years |
| Customer account | Email, password (encrypted), addresses, order history | Let you follow your orders (performance of the contract) | Until the account is deleted, or 3 years without login |
| Payment | Card details, entered directly with Stripe | Payment and fraud prevention (performance of the contract, legitimate interest). BROWSTERZ never sees your card number | Per Stripe's policy |
| "Notify me" list / Brost Collective | Email, sign-up date, irreversible encrypted fingerprint of the IP address (anti-abuse) | Tell you about the launch and new drops (consent) | Until you unsubscribe, or 3 years without interaction |
| Contact form | Name, email, subject, message, IP address | Reply to your message; the IP is used to fight spam (legitimate interest) | While handling the request, then 1 year max |
| Likes | Random identifier (bz_vid cookie), never linked to your identity |
Remember the artworks you liked and count likes (legitimate interest, at your request) | 1 year |
| Browsing | Server logs (IP address, date, page requested) | Site security (legitimate interest, host's legal obligation) | 1 year max, at the host |
Your data is never sold or rented. No automated decision-making or profiling takes place.
Who has access
- BROWSTERZ (the crew members who handle orders).
- o2switch (Clermont-Ferrand, France): hosting of the site and database, sending of emails.
- Stripe (Stripe Payments Europe Ltd, Ireland): payment. Stripe may transfer data to the United States, under the EU–US Data Privacy Framework and standard contractual clauses. Stripe's policy.
- The carrier (TO BE COMPLETED: carrier): name, address, phone and email for delivery and parcel tracking.
- Authorities, where required by law.
Fonts are hosted on our own server: no data is sent to Google or any other third party while you browse.
Cookies
The site only uses cookies that are needed for it to work or that relate to an action you ask for. They don't require consent (article 82 of the French Data Protection Act, CNIL guidelines). No advertising or analytics cookies.
| Cookie | Purpose | Duration |
|---|---|---|
bz_gate | Remember that you entered the access code (before launch) | 30 days |
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Cart | Session to 2 days |
wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Logging in to your customer account | Session, or 14 days with "remember me" |
bz_vid | Remember your likes. Only set when you like an artwork | 1 year |
__stripe_mid, __stripe_sid | Payment security and fraud prevention (Stripe, checkout page) | 1 year / 30 minutes |
You can delete cookies in your browser settings. Without them, the cart and login won't work.
Your rights
You can access your data, correct it, delete it, restrict its use, object to its processing, get it in a readable format (portability) and withdraw your consent at any time (for example, unsubscribe from the list). You can also give instructions on what happens to your data after your death.
Email crew@browsterz.com: we answer within one month at most. We may ask you to prove your identity if in doubt. If you think your rights aren't respected, you can file a complaint with the CNIL, the French data protection authority (cnil.fr/plaintes), or with the authority of your country.
Security
The site is served over HTTPS, passwords are encrypted, access to the admin area is protected, and IP addresses on the sign-up list are only stored as an irreversible fingerprint.