Article 1 — Data controller
The controller of the data collected on this site is:
- Association Française de Réflexologie
- Registered association governed by the French law of 1 July 1901
- 17 rue du Coq, 45600 Sully-sur-Loire, France
- SIREN 428 736 342 — SIRET (registered office) 428 736 342 00026 — RNA W452017552
- Email address: contact@institut-rop.com
- Publication director: Guy Boitout, president of the association
The association is not required to appoint a data protection officer under article 37 of the GDPR: it is not a public body, its core activity does not consist of regular and systematic monitoring on a large scale, and it does not process sensitive data on a large scale. Any question about data may be sent to the email address above.
Article 2 — Principle
The site carries no advertising tool, no social-network tracker and no third-party audience-measurement service such as Google Analytics. No data is sold, rented or transferred to third parties for commercial purposes.
The data described below is the data the site actually collects. It falls under four distinct processing activities: audience measurement, sign-up for the free chapters and the publication announcement, ordering the online book, and access to the book after purchase.
Article 3 — Audience measurement
To understand how the site is read, each page view is recorded with: an anonymous reader identifier (see article 7), a session identifier, the page viewed, the display language, the time spent, the country inferred from the IP address, the browser type, the referring page and, where present, the campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content).
The IP address is never stored. It is used by the host to infer a country, and only that country is kept.
The legal basis is the controller’s legitimate interest (article 6.1.f of the GDPR) in knowing how its site is visited. This processing is strictly limited to measuring the audience of this site alone, with no cross-referencing against other sites and no advertising profiling.
Article 4 — Free chapters and publication announcement sign-up
The free-chapter and publication-announcement forms collect: first name, last name, email address and, optionally, occupation. To these are added the language, the origin of the sign-up and the anonymous reader identifier.
This data is used solely to give access to the free chapters and to inform the person of the book’s publication. The legal basis is consent (article 6.1.a of the GDPR), collected through the form’s checkbox. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out beforehand.
Article 5 — Order and payment
An order involves: the buyer’s email address, the billing address, where applicable the business identification number they choose to provide, the product ordered, the amount, the currency, the language and the date on which the terms of sale were accepted.
No bank details pass through the site or are stored on it. Payment is carried out entirely on Stripe’s secure pages, and Stripe is the sole recipient of the card number. The site receives only the outcome of the payment from Stripe.
The legal basis is performance of the contract (article 6.1.b of the GDPR) for the order itself, and compliance with legal obligations (article 6.1.c) for retaining accounting records.
Article 6 — Access to the book after purchase
Access to the online book is attached to the email address used at purchase. The site keeps no customer database: the right of access is verified with Stripe on each request, from that address alone.
The access link sent by email is a cryptographically signed token containing the email address and an expiry date. It contains no other data and is stored nowhere.
Article 7 — Cookies
The site uses no advertising cookie and no social-network cookie. It therefore displays no cookie consent banner. The cookies set are the following:
| Cookie | Purpose | Lifetime |
|---|---|---|
reader_id | Random identifier, unconnected to identity, distinguishing a new visitor from a returning one (audience measurement) | 12 months |
free_chapters_access | Opens the free chapters after sign-up | 12 months |
paid_access | Keeps the reading session for the purchased book | 12 months |
lang | Remembers the chosen display language | 12 months |
internal_traffic | Excludes the site team’s own visits from audience measurement | 12 months |
admin_session, sales_preview | Reserved for site administration; never set on a visitor | 30 days |
With the exception of reader_id, all of these cookies are strictly necessary to the function the user asked for. They can be deleted at any time from the browser settings; deleting paid_access or free_chapters_access simply means requesting a new access link.
Article 8 — Recipients and processors
The data is accessible only to those responsible for running the site within the association, and to the following technical providers, acting as processors within the meaning of article 28 of the GDPR:
| Provider | Role | Data concerned |
|---|---|---|
| Vercel Inc. (United States) | Hosting of the site | All data passing through the site |
| Stripe Payments Europe, Ltd. (Ireland) | Payment and invoicing | Email address, billing address, payment data |
| Google Ireland Ltd. / Google LLC | Spreadsheet receiving sign-ups, visits and orders | Data described in articles 3, 4 and 5 |
| Resend, Inc. (United States) | Sending of transactional email | Recipient’s email address |
| Neon Inc. (United States) | Technical database of the internal audience-analysis tool | Anonymous reader identifier and visit date |
Some of these providers are established in the United States or may transfer data there. Such transfers are governed by the European Commission’s standard contractual clauses or by the EU-U.S. Data Privacy Framework, according to the commitments each of them has made.
Article 9 — Retention periods
| Data | Period |
|---|---|
| Audience-measurement data | 25 months |
| Free-chapter and publication-announcement sign-ups | 3 years from the last contact, or until consent is withdrawn |
| Orders, invoices and accounting records | 10 years, under article L. 123-22 of the French commercial code |
| Right of access to the online book | As long as Stripe retains the record of the corresponding payment |
Article 10 — Your rights
Under articles 15 to 22 of the GDPR, every person has a right of access, rectification, erasure, restriction of processing, objection and portability of their data, as well as the right to give directions on what becomes of their data after their death.
These rights may be exercised at contact@institut-rop.com or by post to Association Française de Réflexologie, 17 rue du Coq, 45600 Sully-sur-Loire, France. A reply is given within one month. Proof of identity may be requested where there is reasonable doubt as to the identity of the person making the request.
Any person may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or with the supervisory authority of their country of residence. www.cnil.fr
Article 11 — Security
The site is served over HTTPS only. Reading sessions rely on cryptographically signed tokens rather than guessable identifiers. Access cookies cannot be read by scripts on the page. The site stores no bank details.
Article 12 — Changes
This policy may be amended to reflect changes to the site or to the applicable regulations. The version that applies is the one published on this page, dated at the top.