Privacy policy
Last updated: [to be dated at publication]
Data controller
Fabrice Jolivet, entrepreneur individuel (micro-entreprise), 37 rue Blanqui, 33110 Le Bouscat, France — publisher of PacePoster. Contact: hello@paceposter.com
No data protection officer has been appointed. Appointing one is not required here: the processing involves neither systematic large-scale monitoring nor special categories of data within the meaning of Article 37 GDPR. Any question about personal data can be sent directly to hello@paceposter.com.
Data collected
Placing an order on PacePoster involves collecting the following:
- email address, for order confirmation and tracking;
- name and shipping address;
- the finisher name and time you enter, which are printed on the poster and are therefore personal data processed by the printer;
- the race you chose and the specifications of the poster ordered;
- technical browsing data (server logs).
The race request form separately collects an email address, the name of the race you are asking for, and a free-text message.
No payment card data is received or stored by PacePoster: payment is handled entirely by the payment provider.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Fulfilling and delivering the order | Performance of a contract (Art. 6(1)(b) GDPR) |
| Printing the name and time on the poster | Performance of a contract (Art. 6(1)(b) GDPR) |
| Invoicing and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Customer service and answering enquiries | Legitimate interest (Art. 6(1)(f) GDPR) |
| Handling a race request | Legitimate interest (Art. 6(1)(f) GDPR) |
| Technical logs and service security | Legitimate interest (Art. 6(1)(f) GDPR) |
| Analytics and advertising | Consent (Art. 6(1)(a) GDPR) |
Recipients
Data is shared only with the providers required to deliver the service:
- Stripe Payments Europe Ltd. (Ireland) — payment processing, PCI-DSS Level 1 compliant;
- Vercel Inc. (United States) — website hosting;
- Supabase Inc. — order database;
- Cloudflare R2 — storage of poster files;
- Gelato ASA (Norway) — printing and shipping: name, shipping address and the poster file, which carries the finisher name and time;
- Resend Inc. (United States) — transactional email (order confirmation, shipping);
- Google Ireland Ltd. (Ireland) — analytics (Google Analytics) and advertising measurement (Google Ads), only after consent (see the Cookies section).
Internal notification. A submission through the race request form — and only that — triggers a message to the operator's internal inbox, hosted by Telegram FZ-LLC, containing the race name, the email address and the message. No order data travels through that channel.
Data is never sold, rented, or shared for advertising purposes.
Transfers outside the European Union
Some processors are established outside the European Union, or operate infrastructure there. These transfers are governed by the European Commission's standard contractual clauses, supplemented where applicable by the EU–US Data Privacy Framework for US providers that participate in it.
- Vercel, Cloudflare, Resend, Telegram — standard contractual clauses;
- Google — standard contractual clauses and the EU–US Data Privacy Framework;
- Supabase — standard contractual clauses;
- Stripe (Ireland) and Gelato (Norway, European Economic Area) — no transfer outside the EEA for the service provided.
A copy of the safeguards in place can be requested at hello@paceposter.com.
Retention periods
- Order data (customer, address, printed name and time): 5 years, the retention period for commercial records;
- Accounting and tax records: 10 years (Article L123-22 of the French Commercial Code);
- Stored poster files: 30 days after delivery;
- Race requests: 12 months from the request;
- Technical logs: 90 days, then anonymised;
- Cookie consent choice: 6 months, after which it is asked again.
Your rights
You have the right to access, rectify, erase, restrict, object to, and port your data. These rights are exercised by email to hello@paceposter.com, and are answered within one month.
The right to erasure is subject to the statutory retention periods listed above: a paid order cannot be erased before its accounting deadline.
If a disagreement persists, a complaint can be lodged with the French data protection authority — Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Cookies
Strictly necessary cookies (no consent required). PacePoster sets an order-draft cookie — technical, httpOnly, tied to the domain — which keeps your choices between picking the poster and paying. It is required for the service you asked for and is not subject to consent. The choice you make on the banner is itself stored (local storage, key pp-consent) so it is not asked again on every visit.
Language preference. Clicking the FR / EN switch sets a pp_lang cookie (lifetime: one year) that remembers the language you chose, so the site does not fall back to the country-derived language on your next visit. It holds only fr or en, allows no tracking, and is set only as a result of your click: a functional cookie requested by the user, it is not subject to consent. Without it, the language shown on a first visit is derived from the country of your IP address, which is not stored.
Cookies subject to consent. With your agreement — and only with it — the site uses Google Analytics (audience measurement) and Google Ads (advertising performance measurement), loaded through Google Tag Manager. Until consent is given, or if it is declined, no advertising or measurement cookie is set; only cookieless, identifier-free technical signals (Consent Mode) are sent.
Your choice. Accepting and declining are offered as equals on the banner; declining does not affect your browsing. The choice lasts 6 months and can be changed at any time via “Cookies” in the footer.
Applicable law
This policy is provided in English for convenience. The processing is governed by French law and by the GDPR; in case of any discrepancy, the French version prevails.