Privacy notice
What we collect, why we collect it, how long we keep it, and how to make us stop.
Who is responsible
AtelierPlate SAS, Studio no. 4, 18 Rue des Capucins, 69001 Lyon, France, registered under SIREN 902 447 118, is the data controller for this website and for the weekly email known as The Monday Plate.
Our data protection contact is [email protected]. We are a nine-person studio, so that address reaches a person, usually within two working days.
What we collect
| Category | Examples | Source |
|---|---|---|
| Subscription data | Email address, consent timestamp, opt-in source page | You, via the sign-up form |
| Email engagement | Opens, link clicks, bounce and unsubscribe events | Our email provider |
| Site analytics | Page path, referrer, device class, country, session duration | Analytics, only after consent |
| Saved preferences | Plating style toggle, palette filter, cookie choice | Your browser, stored locally |
| Correspondence | Messages you send us and our replies | You |
| Workshop bookings | Name, email, dietary notes, payment reference | You, via our booking partner |
We do not ask for your date of birth, your address, or your phone number. We do not build advertising profiles and we have never sold a mailing list.
Legal bases
- Consent (Art. 6(1)(a) GDPR) for the weekly email and for analytics cookies. Withdrawable at any time, with no effect on what came before.
- Contract (Art. 6(1)(b)) for workshop bookings and any paid course.
- Legitimate interests (Art. 6(1)(f)) for security logging, fraud prevention, and aggregate measurement of which recipes are read. Our assessment is on file and available on request.
- Legal obligation (Art. 6(1)(c)) for invoices and tax records under French commercial law.
Who processes it
| Processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Website hosting and server logs | Paris, France |
| Brevo (Sendinblue SAS) | Weekly email delivery | Paris, France |
| Plausible Insights OU | Cookieless page analytics | Tallinn, Estonia |
| Stripe Payments Europe Ltd | Workshop payments | Dublin, Ireland |
Each processor works under a written agreement meeting Art. 28 GDPR. We do not use Google Analytics on this site.
How long we keep it
- Subscription data: while you are subscribed, then 12 months so we can prove the original consent, then deleted.
- Email engagement: 14 months, rolling.
- Analytics: aggregated on collection, retained 24 months, never linked to an individual.
- Server logs: 30 days.
- Invoices: 10 years, as required by Article L123-22 of the French Commercial Code.
Transfers outside the EEA
Our processors are established in the European Union. If a future provider requires a transfer outside the EEA, we will rely on the European Commission's standard contractual clauses, publish the change in this notice, and record the transfer impact assessment before the first transfer takes place.
Your rights
Under the GDPR you may request access to your data, correction, deletion, restriction of processing, portability in a machine-readable format, and you may object to processing based on legitimate interests. You can also withdraw consent at any time using the unsubscribe link in any email, which takes effect immediately and needs no explanation.
We answer within one month. If a request is complex we will tell you before that month is out and explain the delay. We do not charge for the first request in any twelve-month period.
Contact and complaints
Write to [email protected] or by post to the studio address above. If our answer does not satisfy you, you may complain to the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or to the supervisory authority of your country of residence.
This notice is written for a showcase build of atelierplate.site. It describes the intended data practice of the studio and should be reviewed by counsel before the site handles live personal data.