Privacy policy

Data controller

ELLE ET LUI PHOTOGAPHIE (Elle et Lui Photographie), SAS au capital de 3 000 €, RCS Paris 493 916 472, whose registered office is at 27 rue Ballu, 75009 Paris. For any question about your data: boutique@leica-montmartre.com, or by post to 59 rue Condorcet, 75009 Paris.

What we collect

Contact or quote form: name, email address, telephone, and the message you write to us.

Booking a lesson or buying a gift voucher: name, email address, telephone, the date chosen, and the invoicing details (amount, date, means of payment). Your card details are entered directly with our payment provider and never pass through our servers.

Customer account, if you open one: your email address, your password (kept as a hash, never in plain text), your addresses and the history of your orders, including those from the former online shop.

Newsletter, if you consent to it: your email address, and the date and origin of your consent.

Browsing: the server's technical logs record the IP address, the page requested, the date and the type of browser, solely for security and diagnostics.

We collect no data classed as sensitive, and carry out no profiling and no automated decision-making.

Why, and on what basis

• Answering your contact or quote request: pre-contractual steps taken at your request (article 6.1.b GDPR).
• Booking, running and invoicing a lesson or a gift voucher: performance of the contract (article 6.1.b) and accounting and tax obligations (article 6.1.c).
• Keeping your customer account and the history of your orders: performance of the contract (article 6.1.b).
• Sending you the newsletter: your consent (article 6.1.a), which you can withdraw at any time from your account or by writing to us.
• Securing the site and its forms: legitimate interest in protecting the service (article 6.1.f).
• Measuring the site's audience: only with your consent, gathered through the banner (article 6.1.a). No measurement tool is installed to date.

Your data is neither sold, nor rented, nor passed on for advertising purposes.

Who it is passed to

• Stripe, our payment provider, to take payment for lessons and gift vouchers. Stripe processes your payment data as an independent controller, under its own policy; some of its entities are located outside the European Union, with the safeguards required by the GDPR.
• Axonaut, a French business-management and invoicing package, which keeps your customer record, quotes and invoices on our behalf.
• OVH SAS, the site's host, whose servers are located in Beauharnois (Québec, Canada). This transfer outside the European Union relies on the European Commission's adequacy decision recognising that Canada provides an equivalent level of protection (Decision 2002/2/EC, confirmed in 2024); no additional safeguard is required, and you keep all of your rights.

Each of them accesses only the data their work requires, and undertakes to protect it. No other transfer takes place, except where the law requires it or an authority demands it.

How long we keep it

• Contact or quote requests with no follow-up: three years after the last exchange.
• Bookings, gift vouchers and invoicing documents: ten years from the close of the financial year, in line with accounting obligations.
• Customer account: until it is closed, which you can do yourself from your account; accounting records then remain for ten years, without your name.
• Newsletter consent: until you withdraw it.
• Server technical logs: one year.
• The memory of your choice about cookies: until you change it or clear your browser's data.

Your rights

You have the right to access, rectify, erase, restrict the processing of, object to and port the data concerning you, as well as the right to give directions as to its fate after your death. Where processing rests on your consent, you may withdraw that consent at any time, without calling into question what was done before.

To exercise these rights, write to boutique@leica-montmartre.com ou au 59 rue Condorcet, 75009 Paris, or telephone 01 53 21 01 42. You will receive an answer within one month; proof of identity may be requested where there is reasonable doubt as to who you are. You may also lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr).

Cookies and data in your browser

The site stores only what it needs to work (session, form protection, basket, the memory of your choice). The detail, with retention periods, is on the page cookie settings, where you can change your choice at any time.

Security

Exchanges with the site are encrypted (HTTPS). Access to the data is limited to the people at the studio who need it, and protected by a password. In the event of a data breach likely to create a risk to your rights, you would be informed as the GDPR requires.