Privacy policy

1. Who is responsible

This site, williambrisa.fr, is published by William BRISA, entrepreneur individuel (EI), registered in France under SIREN 988 777 744. For the purposes of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR), I am the data controller.

You can reach me at contact@williambrisa.fr, and the publisher’s full details are in the mentions légales.

There is no statutory requirement for a data protection officer here, and none has been appointed. Write to that address and I answer myself.

2. The short version

This is a static portfolio. There are no accounts, no forms, nothing to upload and no database behind it, and it sets no cookie. Nothing you type here is sent anywhere. What it tells me is how many pages are viewed: totals the host draws from its own server logs, and a finer count only if you agree to it.

3. What is collected

When you load a page, the host, Netlify, receives what any web server receives: your IP address, the page asked for, the time, your browser’s user agent and the page that linked here. It uses them to deliver the page and to block abuse, and keeps them for a short time in its logs. From those same logs, Netlify Analytics shows me totals: page views, unique visitors, the most viewed pages, the sites that linked here and the pages not found. Nothing runs in your browser for it and nothing is stored there, and what I see are totals, never a person. I do not copy the logs or store them anywhere.

If you agree to measurement, Umami records which page was viewed, the page or search that sent you to it, and coarse technical facts: a country and region, an operating system, a browser, a screen size, a language, whether you are on a phone. To count one visit once rather than every page of it, Umami derives a hash from your IP address and browser, salted with a value that changes every month, and cannot reverse it; the address itself is never stored. No identifier is left in your browser, nothing follows you to another site, and what I see are totals, never a person. Refuse and none of it is collected. Section 5 says how that choice is made and unmade.

If you write to me at the address shown here, from your own mail app, I receive your email address, your name if your mail client sends it, your message and anything you attach.

If we work together, I also hold what a project and its invoices need: your contact details, your company’s details and billing address, and our correspondence about the work.

Nothing else. The font is served from this site rather than from a font service, there are no embedded videos, maps or social buttons, and no third-party script runs here other than the measurement above, once you have agreed to it. The projects shown here link out to their own sites, which have their own policies.

4. Why, and on what legal basis

Each purpose below carries its basis under Article 6(1) of the GDPR.

• Serving the site and keeping it safe. My legitimate interest in a site that works and is not abused, Article 6(1)(f).
• Counting page views from the server logs. My legitimate interest in knowing which pages are read, Article 6(1)(f). It only produces totals and touches nothing in your browser, and you can object under Article 21.
• Measuring the audience with Umami. Your consent, Article 6(1)(a), which you can withdraw at any time. Umami counts nothing before you give it.
• Answering you when you write. My legitimate interest in replying to the people who contact me, Article 6(1)(f), or steps taken at your request before a contract, Article 6(1)(b).
• Running a project we agreed on. Performance of a contract, Article 6(1)(b).
• Keeping invoices and accounting records. Legal obligation, Article 6(1)(c).

5. Cookies and browser storage

This site sets no cookie, and there is no advertising and no cross-site tracking anywhere on it.

The page view totals in Section 3 come from the host’s logs, read nothing from your browser, and so need no banner. Umami is the one thing that has to ask. It runs on your consent under Article 6(1)(a) of the GDPR and Article 82 of the French Data Protection Act (loi Informatique et Libertés), which is what the banner in the corner of the page is for, and it does not run until you have said yes. Refusing means the script is never loaded, not that it loads and discards what it sees; withdrawing later stops it sending anything from that moment. Either answer is one press, and Cookies at the foot of every page brings the question back so you can change it. Your answer is remembered for six months, then you are asked again.

Two things are kept in your own browser’s local storage. Both are strictly necessary for something you asked for, so neither needs consent, and both are listed so the list is complete:

• Your answer to the measurement question, and the date you gave it. It is never sent anywhere, and clearing your site data forgets it.
• Your light or dark preference, if you used the switch. It is never sent anywhere.

6. Who processes it for me

I do not sell personal data, and I never have. Two companies handle it for me, each as my processor under Article 28 of the GDPR:

• Netlify, Inc., which hosts the site and counts its page views from the server logs.
• Umami Software, Inc., which runs the audience measurement in Section 5, once you have agreed to it.

Beyond that, personal data is only passed on when the law requires it, for example invoices to the tax authorities.

7. Where it is held, and transfers

Netlify and Umami are United States companies. The site is delivered from Netlify’s global network and the measurement is processed on Umami’s servers in the United States or the European Union, so personal data may be processed in the United States or be accessible from there. Those transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the standard contractual clauses adopted by the Commission in Decision 2021/914, under Chapter V of the GDPR.

8. How long it is kept

• Server logs are kept by Netlify for a short period under its own retention, then deleted. I keep no copy.
• The page view totals drawn from them cover the last 30 days, on a rolling basis. Older days are dropped.
• Measurement data is kept by Umami for six months, then deleted. The salt behind the visit hash changes every month, so a visit cannot be tied to one from another month.
• An email that does not lead to a project is kept for three years after our last exchange, then deleted.
• For a client, project correspondence is kept for the length of the engagement and five years after it ends, the limitation period for contractual claims under Article 2224 of the French Civil Code. Invoices and accounting records are kept for as long as French tax and accounting law requires, up to ten years.
• Your answer to the measurement question stays in your browser for six months, or until you clear it.

9. Your rights under the GDPR

Wherever you live, and in particular in the European Economic Area, you have the right to:

• Ask for a copy of what I hold about you. Article 15.
• Have inaccurate data corrected. Article 16.
• Have your data deleted. Article 17.
• Have processing restricted. Article 18.
• Receive the data you gave me in a structured, commonly used, machine-readable format, and have it sent elsewhere. Article 20.
• Object to processing based on my legitimate interest. Article 21.
• Withdraw a consent you have given, without affecting what was done while it stood. Article 7(3).
• Leave instructions about what happens to your data after your death, under Article 85 of the French Data Protection Act.

Measurement data cannot be traced back to you, so there is nothing in it for these rights to reach. For everything else, write to contact@williambrisa.fr. I answer within one month, as Article 12(3) requires. If the answer does not satisfy you, you can lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) at cnil.fr, or with the supervisory authority where you live.

10. Changes

When this policy changes, the date at the top changes with it.

11. Related

The terms cover the use of this site and how I work with clients, and the publisher’s details are in the mentions légales.