Privacy Policy
Last updated: 30 April 2026
This English version is provided for information purposes only. In case of any discrepancy, the French version prevails.
1. Data controller
The controller of the data collected on the alexgab.fr website is Alex Gab, painter, residing in Paris, reachable at contact@alexgab.fr.
2. Data collected and purposes
Personal data is collected in the following situations:
When placing an order
- Data collected: first name, last name, email address, shipping address, payment data (handled directly by Stripe and never stored on the website's servers).
- Purposes: processing and execution of the order, invoicing, delivery, after-sales service, handling of any disputes and exercise of the right of withdrawal.
- Legal basis: performance of the sales contract (article 6.1.b GDPR) and legal accounting and tax obligations (article 6.1.c GDPR).
When posting a comment
- Data collected: name, email (not publicly displayed), comment content.
- Purposes: publication and moderation of the comment, prevention of abuse.
- Legal basis: legitimate interest of the controller in running and moderating the website (article 6.1.f GDPR).
When sending a message via the contact form
- Data collected: name, email, message content.
- Purposes: replying to the user's request.
- Legal basis: legitimate interest of the controller in answering enquiries (article 6.1.f GDPR).
3. Recipients and processors
Data is never sold or shared with third parties for commercial purposes. It is only transmitted to the technical service providers required to deliver the service:
- Stripe: secure payment processing (banking data);
- OVH: hosting of the website and associated data (servers located in Germany, in Frankfurt);
- Carrier (La Poste, Colissimo or equivalent): name and shipping address, strictly to the extent required to deliver the artwork.
4. Transfers of data outside the European Union
Data processed by Stripe may be transferred to the United States. These transfers are framed by the safeguards provided for by the GDPR, in particular Stripe's adherence to the Data Privacy Framework and the signing of standard contractual clauses approved by the European Commission.
5. Retention periods
| Category of data | Retention period |
|---|---|
| Order data (name, address, email) | 5 years from the order (contractual evidence) |
| Accounting records and invoices | 10 years (article L123-22 of the French Commercial Code) |
| Published comments | As long as they are published on the website |
| Contact form messages | 12 months maximum after the last exchange |
| Payment data | Not stored by the website (handled by Stripe) |
6. Cookies and trackers
The website uses a minimal number of cookies and trackers:
- Plausible Analytics: a privacy-friendly audience measurement tool, with no cookies and no collection of personal data. No consent is required.
- Stripe: the Stripe payment page may set technical and fraud-prevention cookies, essential to the proper operation and security of the payment.
- Language technical cookie (NEXT_LOCALE): the website sets a technical cookie named
NEXT_LOCALEin order to remember your language preference (French or English). This cookie is strictly necessary for the operation of the website and is not subject to consent (article 82 of the French Data Protection Act).
No advertising or profiling cookies are used.
7. Security
The website uses an encrypted connection (HTTPS) and relies on recognised providers (Stripe, OVH) applying high security standards. Access to data is restricted to what is strictly necessary.
8. Your rights (GDPR)
In accordance with Regulation (EU) 2016/679 and the amended French Data Protection Act, you have the following rights regarding your data:
- right of access;
- right of rectification;
- right to erasure ("right to be forgotten");
- right to restriction of processing;
- right to object;
- right to data portability;
- right to withdraw your consent at any time, when processing is based on it;
- right to set out instructions regarding the fate of your data after your death.
How to exercise these rights: these rights are exercised free of charge by email at contact@alexgab.fr. A reply will be provided within a maximum period of one month. Proof of identity may be requested in case of reasonable doubt about the identity of the requester.
Complaint to the CNIL: if, after contacting us, you believe that your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or via www.cnil.fr.
9. No profiling and no automated decision-making
No decision producing legal effects concerning you is made solely on the basis of automated processing. No profiling is carried out.
10. Minors
The website is not intended for persons under 15. No data is knowingly collected from minors under 15 without prior consent of the holder of parental authority.
11. Modification of this policy
This privacy policy may be modified at any time to reflect changes to the website, the providers used or the regulations. The applicable version is the one online on the date of your visit or order. The date of the last update appears at the top of this document.