Privacy Policy
Last updated: July 23, 2026
This policy describes how Pétale processes your personal data when you visit or interact with this website, in accordance with the General Data Protection Regulation (GDPR). This site is built on the principles of data minimisation and privacy by design. We only collect what is strictly necessary.
1. Data controller
The data controller is Pétale, whose registered office is located at 1 Rue de Provence, 66300 Ponteilla, France. For any question about your data, write to us at petalebienetre@gmail.com. Given the nature and volume of processing, no Data Protection Officer (DPO) has been appointed.
2. Data we collect
We only collect data when you provide it to us or when the operation and security of the site require it:
- Contact form: your full name, email address, the subject and content of your message, and the page from which it was sent.
- Cookie consent: your choice per category (accepted / refused), stored in a signed cookie, together with an anonymised technical proof of that choice.
- Technical logs: data automatically generated by the servers and the application (timestamp, event type and, for certain security events, an IP address), necessary for the proper operation and security of the site.
- Anti-spam protection: your browser is asked to solve a proof-of-work challenge when submitting a form; no additional personal data is collected for this purpose.
We collect no sensitive data (health, opinions, etc.) and use your data for no profiling or automated decision-making. Your IP address is never stored in clear text for the contact form or the consent proof: it is turned into an irreversible fingerprint (SHA-256 hash).
3. Purposes, legal bases and retention periods
| Processing | Legal basis | Retention period |
|---|---|---|
| Replying to a request sent via the contact form | Pre-contractual measures or legitimate interest in replying | 30 days |
| Remembering your cookie consent choice | Legal obligation (proof of consent) | Cookie: 180 days - Anonymised proof: 24 months (CNIL recommendation) |
| Ensuring site security and preventing abuse (anti-spam, logs) | Legitimate interest | From 7 days to 1 year depending on event severity |
| Measuring site audience (Plausible, cookieless) | Legitimate interest | Aggregated statistics, no individual data retained |
4. Cookies and trackers
This site favours a cookie-light approach. The only cookie set without your consent is strictly necessary:
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
| app_consent | Stores your consent choice. Cryptographically signed (HMAC SHA-256), it contains no data that could identify you. | 180 days | Strictly necessary |
No other cookie is set. The audience measurement (Plausible) works without cookies and no advertising or social-network tracker is integrated. You can manage or withdraw your consent at any time from the dedicated link on the site.
5. Audience measurement
This site measures its audience with Plausible Analytics, a solution self-hosted by Agence twini and cookieless. Plausible sets no tracker, builds no profile and retains no individual data. Only aggregated statistics are produced. Your IP address is used only transiently, as a rotating daily fingerprint, to distinguish visits without ever identifying you. On this basis, and in line with CNIL guidance, this audience measurement is exempt from prior consent.
6. Spam protection
Forms are protected by a proof-of-work mechanism (Cap) that asks your browser to solve a short cryptographic challenge. It sets no cookie and transmits no personal data beyond the challenge itself.
7. Recipients and processors
Your data is never sold, rented or transferred to third parties for commercial purposes. It is only accessible to Pétale and, strictly as needed, to our technical processors:
- Infomaniak Network SA (Switzerland) - hosting of the site and data.
- Agence twini (Saint-Estève, France) - design, maintenance and technical operation of the site, including anti-spam protection and self-hosted Plausible audience measurement.
Each processor acts on our instructions and is bound by strict contractual confidentiality and security obligations, in accordance with Article 28 of the GDPR.
8. Transfers outside the European Union
Hosting is provided in Switzerland by Infomaniak, a country covered by an adequacy decision of the European Commission. Your data benefits from a level of protection equivalent to that of the European Union. As the audience measurement is self-hosted, no data is transmitted to a third-party tool for this purpose.
9. Security
We implement appropriate technical and organisational measures: encryption of communications (TLS/HTTPS), anonymisation of IP addresses through hashing, logging and monitoring, regular backups and security updates. In the event of a data breach likely to create a risk to your rights, we would notify the CNIL within 72 hours and, if necessary, the individuals concerned.
10. Your rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
- Right of access to your data and to obtain a copy;
- Right to rectification of inaccurate data;
- Right to erasure (the "right to be forgotten");
- Right to restriction of processing;
- Right to object to processing based on legitimate interest;
- Right to data portability;
- Right to withdraw your consent at any time;
- Right to set instructions regarding the fate of your data after your death.
To exercise these rights, write to us at petalebienetre@gmail.com. We undertake to reply within a maximum of one month. If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the supervisory authority (in France, the CNIL).
11. Changes
This policy may be updated to reflect changes to the site or to regulations. The date of the last update appears at the top of this page; the applicable version is the one in force at the time of your visit.