This policy explains what personal data Riva collects through this website, WhatsApp and email, why we hold it and how you can have it removed. It is written under the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is Paul Consulting LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, contactable at paulcompain.pro@gmail.com. Riva is the trading name used by that company for this website.
2. What we collect
- When you write to us on WhatsApp or by email: your phone number or email address and the content of the conversation.
- When you browse the site: pages viewed, approximate location derived from your IP address, device and browser type, referring source, and the actions measured by our analytics and advertising trackers. See the cookie policy.
We do not knowingly collect data from anyone under 16, and we do not ask for special-category data. Please do not send us identity documents, payment card numbers or health information on WhatsApp or by email.
3. Why we use it, and on what legal basis
- To answer your enquiry, prepare a quote and introduce you to a photographer : pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
- To follow up after the session and handle any complaint : our legitimate interest in the quality of the service (Article 6(1)(f)).
- To send occasional news about the studio : your consent, withdrawable at any time from any email we send (Article 6(1)(a)).
- To measure the audience of the site and the performance of our advertising : your consent, given or refused on the cookie banner (Article 6(1)(a)).
- To meet accounting and legal obligations : legal obligation (Article 6(1)(c)).
4. Who we share it with
We share the details of your enquiry with the independent photographer assigned to your session, so they can quote and contact you. That photographer is a separate data controller for their own booking and invoicing records.
We also use the following service providers, who process data on our behalf or as independent controllers: Vercel (website hosting and logs), Google (Analytics 4), Meta (advertising pixel), WhatsApp, and our email provider.
We never sell your data.
5. Transfers outside the European Union
Riva is established in the United States, and several of the providers listed above are as well. Transfers outside the EU are covered by the European Commission's standard contractual clauses and, where the provider is certified, by the EU-US Data Privacy Framework.
6. How long we keep it
- Enquiries that do not lead to a booking: 3 years from our last contact with you.
- Enquiries that lead to a booking: 3 years from the end of the session, then archived where an accounting or legal obligation requires it.
- Invoicing and accounting records: 10 years, as required by law.
- Analytics and advertising data: see the retention periods in the cookie policy.
7. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable format, withdraw your consent at any time, and give directives on what happens to your data after your death.
To exercise any of these, write to paulcompain.pro@gmail.com. We reply within one month. You do not need to give a reason to ask for deletion of an enquiry.
If you are not satisfied with our response, you can lodge a complaint with your national data protection authority. In France, that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
8. Security
This website is served over an encrypted connection, and our conversations take place on WhatsApp, which is end-to-end encrypted. Galleries are password protected. Access to enquiry data is limited to the people at Riva who need it and to the photographer assigned to your session.
9. Changes
We may update this policy. The date of the current version appears at the top of this page.